Thread (13 messages) flat view 13 messages, 3 authors, 2017-04-04
STALE3461d

[PATCH v4 0/3] arm64: usercopy: Implement stack frame object validation

From: Kees Cook <hidden>
Date: 2017-02-17 00:54:21

On Thu, Feb 16, 2017 at 10:29 AM, James Morse [off-list ref] wrote:
quoted hunk ↗ jump to hunk
Hi all,

This version of Sahara's arch_within_stack_frames() series replaces the
open-coded stack walker with a call to arm64's existing walker.

Patch 2 can be tested independently with this change[0].

lkdtm's use of unallocated stack regions is a separate problem, patch 3
tries to address this.

Sahara, it would be good to get your review of this!
I'm afraid I omitted your patch-3 as it stopped the lkdtm test from working,
I suspect its not tricking the compiler, but I haven't investigated.


Thanks,

James

[0] Change to lkdtm to generate accesses that overlap stack frames.
--------------%<--------------
diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
index 1dd611423d8b..fcbba3a14387 100644
--- a/drivers/misc/lkdtm_usercopy.c
+++ b/drivers/misc/lkdtm_usercopy.c
@@ -57,7 +57,8 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)

        /* This is a pointer to outside our current stack frame. */
        if (bad_frame) {
-               bad_stack = do_usercopy_stack_callee((uintptr_t)&bad_stack);
+               bad_stack = __builtin_frame_address(0);
+               bad_stack -= sizeof(good_stack)/2;
Ah, sneaky, yeah, that'll work nicely.

(Though it should likely get wrapped in a CONFIG_STACK_GROWSUP/DOWN test...)

-Kees

-- 
Kees Cook
Pixel Security
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help