v7:
- fix copy/paste-o from v6 CONFIG additions.
v6: https://lore.kernel.org/lkml/20210315180229.1224655-1-keescook@chromium.org/
v5: https://lore.kernel.org/lkml/20210309214301.678739-1-keescook@chromium.org/
v4: https://lore.kernel.org/lkml/20200622193146.2985288-1-keescook@chromium.org/
v3: https://lore.kernel.org/lkml/20200406231606.37619-1-keescook@chromium.org/
v2: https://lore.kernel.org/lkml/20200324203231.64324-1-keescook@chromium.org/
rfc: https://lore.kernel.org/kernel-hardening/20190329081358.30497-1-elena.reshetova@intel.com/
Hi,
This is a continuation and refactoring of Elena's earlier effort to add
kernel stack base offset randomization. In the time since the earlier
discussions, two attacks[1][2] were made public that depended on stack
determinism, so we're no longer in the position of "this is a good idea
but we have no examples of attacks". :)
Earlier discussions also devolved into debates on entropy sources, which
is mostly a red herring, given the already low entropy available due
to stack size. Regardless, entropy can be changed/improved separately
from this series as needed.
Earlier discussions also got stuck debating how much syscall overhead
was too much, but this is also a red herring since the feature itself
needs to be selectable at boot with no cost for those that don't want it:
this is solved here with static branches.
So, here is the latest improved version, made as arch-agnostic as
possible, with usage added for x86 and arm64. It also includes some small
static branch clean ups, and addresses some surprise performance issues
due to the stack canary[3].
At the very least, the first two patches can land separately (already
Acked and Reviewed), since they're kind of "separate", but introduce
macros that are used in the core stack changes.
If I can get an Ack from an arm64 maintainer, I think this could all
land via -tip to make merging easiest.
Thanks!
-Kees
[1] https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html
[2] https://repositorio-aberto.up.pt/bitstream/10216/125357/2/374717.pdf
[3] https://lore.kernel.org/lkml/202003281520.A9BFF461@keescook/
Kees Cook (6):
jump_label: Provide CONFIG-driven build state defaults
init_on_alloc: Optimize static branches
stack: Optionally randomize kernel stack offset each syscall
x86/entry: Enable random_kstack_offset support
arm64: entry: Enable random_kstack_offset support
lkdtm: Add REPORT_STACK for checking stack offsets
.../admin-guide/kernel-parameters.txt | 11 +++++
Makefile | 4 ++
arch/Kconfig | 23 ++++++++++
arch/arm64/Kconfig | 1 +
arch/arm64/kernel/Makefile | 5 +++
arch/arm64/kernel/syscall.c | 10 +++++
arch/x86/Kconfig | 1 +
arch/x86/entry/common.c | 3 ++
arch/x86/include/asm/entry-common.h | 8 ++++
drivers/misc/lkdtm/bugs.c | 17 ++++++++
drivers/misc/lkdtm/core.c | 1 +
drivers/misc/lkdtm/lkdtm.h | 1 +
include/linux/jump_label.h | 19 +++++++++
include/linux/mm.h | 10 +++--
include/linux/randomize_kstack.h | 42 +++++++++++++++++++
init/main.c | 23 ++++++++++
mm/page_alloc.c | 4 +-
mm/slab.h | 6 ++-
18 files changed, 181 insertions(+), 8 deletions(-)
create mode 100644 include/linux/randomize_kstack.h
--
2.25.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
As shown in jump_label.h[1], choosing the initial state of static
branches changes the assembly layout. If the condition is expected to
be likely it's inline, and if unlikely it is out of line via a jump. A
few places in the kernel use (or could be using) a CONFIG to choose the
default state, which would give a small performance benefit to their
compile-time declared default. Provide the infrastructure to do this.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/jump_label.h?h=v5.11#n398
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/lkml/20200324220641.GT2452@worktop.programming.kicks-ass.net/
Signed-off-by: Kees Cook <redacted>
---
include/linux/jump_label.h | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
The state of CONFIG_INIT_ON_ALLOC_DEFAULT_ON (and ...ON_FREE...) did not
change the assembly ordering of the static branches: they were always out
of line. Use the new jump_label macros to check the CONFIG settings to
default to the "expected" state, which slightly optimizes the resulting
assembly code.
Reviewed-by: Alexander Potapenko <glider@google.com>
Link: https://lore.kernel.org/lkml/CAG_fn=X0DVwqLaHJTO6Jw7TGcMSm77GKHinrd0m_6y0SzWOrFA@mail.gmail.com/
Acked-by: Vlastimil Babka <redacted>
Link: https://lore.kernel.org/lkml/5d626b9b-5355-be94-e8e2-1be47f880f30@suse.cz
Signed-off-by: Kees Cook <redacted>
---
include/linux/mm.h | 10 ++++++----
mm/page_alloc.c | 4 ++--
mm/slab.h | 6 ++++--
3 files changed, 12 insertions(+), 8 deletions(-)
Allow for a randomized stack offset on a per-syscall basis, with roughly
5-6 bits of entropy, depending on compiler and word size. Since the
method of offsetting uses macros, this cannot live in the common entry
code (the stack offset needs to be retained for the life of the syscall,
which means it needs to happen at the actual entry point).
Signed-off-by: Kees Cook <redacted>
---
arch/x86/Kconfig | 1 +
arch/x86/entry/common.c | 3 +++
arch/x86/include/asm/entry-common.h | 8 ++++++++
3 files changed, 12 insertions(+)
Allow for a randomized stack offset on a per-syscall basis, with roughly
5-6 bits of entropy, depending on compiler and word size. Since the
method of offsetting uses macros, this cannot live in the common entry
code (the stack offset needs to be retained for the life of the syscall,
which means it needs to happen at the actual entry point).
__visible noinstr void do_syscall_64(unsigned long nr, struct pt_regs *regs)
{
+ add_random_kstack_offset();
nr = syscall_enter_from_user_mode(regs, nr);
quoted hunk
@@ -83,6 +84,7 @@ __visible noinstr void do_int80_syscall_32(struct pt_regs *regs) { unsigned int nr = syscall_32_enter(regs);+ add_random_kstack_offset();
unsigned int nr = syscall_32_enter(regs);
int res;
+ add_random_kstack_offset();
quoted hunk
@@ -70,6 +71,13 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs, */ current_thread_info()->status &= ~(TS_COMPAT | TS_I386_REGS_POKED); #endif++ /*+ * x86_64 stack alignment means 3 bits are ignored, so keep+ * the top 5 bits. x86_32 needs only 2 bits of alignment, so+ * the top 6 bits will be used.+ */+ choose_random_kstack_offset(rdtsc() & 0xFF); }
1)
Wondering why the calculation of the kstack offset (which happens in
every syscall) is separated from the entry-time logic and happens
during return to user-space?
The two methods:
+#define add_random_kstack_offset() do { \
+ if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+ &randomize_kstack_offset)) { \
+ u32 offset = this_cpu_read(kstack_offset); \
+ u8 *ptr = __builtin_alloca(offset & 0x3FF); \
+ asm volatile("" : "=m"(*ptr) :: "memory"); \
+ } \
+} while (0)
+
+#define choose_random_kstack_offset(rand) do { \
+ if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+ &randomize_kstack_offset)) { \
+ u32 offset = this_cpu_read(kstack_offset); \
+ offset ^= (rand); \
+ this_cpu_write(kstack_offset, offset); \
+ } \
+} while (0)
choose_random_kstack_offset() basically calculates the offset and
stores it in a percpu variable (mixing it with the previous offset
value), add_random_kstack_offset() uses it in an alloca() dynamic
stack allocation.
Wouldn't it be (slightly) lower combined overhead to just do it in a
single step? There would be duplication along the 3 syscall entry
points, but this should be marginal as this looks small, and the entry
points would probably be cache-hot.
2)
Another detail I noticed: add_random_kstack_offset() limits the offset
to 0x3ff, or 1k - 10 bits.
But the RDTSC mask is 0xff, 8 bits:
+ /*
+ * x86_64 stack alignment means 3 bits are ignored, so keep
+ * the top 5 bits. x86_32 needs only 2 bits of alignment, so
+ * the top 6 bits will be used.
+ */
+ choose_random_kstack_offset(rdtsc() & 0xFF);
alloca() itself works in byte units and will round the allocation to 8
bytes on x86-64, to 4 bytes on x86-32, this is what the 'ignored bits'
reference in the comment is to, right?
Why is there a 0x3ff mask for the alloca() call and a 0xff mask to the
RDTSC randomizing value? Shouldn't the two be synced up? Or was the
intention to shift the RDTSC value to the left by 3 bits?
3)
Finally, kstack_offset is a percpu variable:
#ifdef CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET
...
DEFINE_PER_CPU(u32, kstack_offset);
This is inherited across tasks on scheduling, and new syscalls will
mix in new RDTSC values to continue to randomize the offset.
Wouldn't it make sense to further mix values into this across context
switching boundaries? A really inexpensive way would be to take the
kernel stack value and mix it into the offset, and maybe even the
randomized t->stack_canary value?
This would further isolate the syscall kernel stack offsets of
separate execution contexts from each other, should an attacker find a
way to estimate or influence likely RDTSC values.
Thanks,
Ingo
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
On Sat, Mar 20, 2021 at 12:58:20PM +0100, Ingo Molnar wrote:
* Kees Cook [off-list ref] wrote:
quoted
Allow for a randomized stack offset on a per-syscall basis, with roughly
5-6 bits of entropy, depending on compiler and word size. Since the
method of offsetting uses macros, this cannot live in the common entry
code (the stack offset needs to be retained for the life of the syscall,
which means it needs to happen at the actual entry point).
quoted
__visible noinstr void do_syscall_64(unsigned long nr, struct pt_regs *regs)
{
+ add_random_kstack_offset();
nr = syscall_enter_from_user_mode(regs, nr);
quoted
@@ -83,6 +84,7 @@ __visible noinstr void do_int80_syscall_32(struct pt_regs *regs) { unsigned int nr = syscall_32_enter(regs);+ add_random_kstack_offset();
quoted
unsigned int nr = syscall_32_enter(regs);
int res;
+ add_random_kstack_offset();
quoted
@@ -70,6 +71,13 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs, */ current_thread_info()->status &= ~(TS_COMPAT | TS_I386_REGS_POKED); #endif++ /*+ * x86_64 stack alignment means 3 bits are ignored, so keep+ * the top 5 bits. x86_32 needs only 2 bits of alignment, so+ * the top 6 bits will be used.+ */+ choose_random_kstack_offset(rdtsc() & 0xFF); }
1)
Wondering why the calculation of the kstack offset (which happens in
every syscall) is separated from the entry-time logic and happens
during return to user-space?
The two methods:
+#define add_random_kstack_offset() do { \
+ if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+ &randomize_kstack_offset)) { \
+ u32 offset = this_cpu_read(kstack_offset); \
+ u8 *ptr = __builtin_alloca(offset & 0x3FF); \
+ asm volatile("" : "=m"(*ptr) :: "memory"); \
+ } \
+} while (0)
+
+#define choose_random_kstack_offset(rand) do { \
+ if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+ &randomize_kstack_offset)) { \
+ u32 offset = this_cpu_read(kstack_offset); \
+ offset ^= (rand); \
+ this_cpu_write(kstack_offset, offset); \
+ } \
+} while (0)
choose_random_kstack_offset() basically calculates the offset and
stores it in a percpu variable (mixing it with the previous offset
value), add_random_kstack_offset() uses it in an alloca() dynamic
stack allocation.
Wouldn't it be (slightly) lower combined overhead to just do it in a
single step? There would be duplication along the 3 syscall entry
points, but this should be marginal as this looks small, and the entry
points would probably be cache-hot.
In earlier threads it was pointed out that one way to make things less
predictable was to do the calculation at the end of a syscall so that it
was more distant from entering userspace (with the thinking that things
like rdtsc were more predictable by userspace if it was always happening
X cycles after entering a syscall). Additionally, the idea of using
percpu meant that the chosen values wouldn't be tied to a process,
making even "short" syscalls (i.e. getpid) less predictable because an
attacker would need to have pinned the process to a single CPU, etc.
I can include these details more explicitly in the next change log, if
you think that makes sense?
2)
Another detail I noticed: add_random_kstack_offset() limits the offset
to 0x3ff, or 1k - 10 bits.
But the RDTSC mask is 0xff, 8 bits:
+ /*
+ * x86_64 stack alignment means 3 bits are ignored, so keep
+ * the top 5 bits. x86_32 needs only 2 bits of alignment, so
+ * the top 6 bits will be used.
+ */
+ choose_random_kstack_offset(rdtsc() & 0xFF);
alloca() itself works in byte units and will round the allocation to 8
bytes on x86-64, to 4 bytes on x86-32, this is what the 'ignored bits'
reference in the comment is to, right?
Why is there a 0x3ff mask for the alloca() call and a 0xff mask to the
RDTSC randomizing value? Shouldn't the two be synced up? Or was the
intention to shift the RDTSC value to the left by 3 bits?
Yes, it's intentional -- the 0x3ff limit is there to make sure the
alloca has a distinct upper bound, and the 8 bits is there to let the
compiler choose how much of those 8 bits it wants to throw away to stack
alignment. The limit to "at most 8 bits" (really 5) is chosen as a
middle ground between raising unpredictability without shrinking the
available stack space too much. (Note that arm64's alignment has to
tweak this by 1 more bit, so it is masking with 0x1ff.
I could attempt to adjust the comments to reflect these considerations.
3)
Finally, kstack_offset is a percpu variable:
#ifdef CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET
...
DEFINE_PER_CPU(u32, kstack_offset);
This is inherited across tasks on scheduling, and new syscalls will
mix in new RDTSC values to continue to randomize the offset.
Wouldn't it make sense to further mix values into this across context
switching boundaries? A really inexpensive way would be to take the
kernel stack value and mix it into the offset, and maybe even the
randomized t->stack_canary value?
This would further isolate the syscall kernel stack offsets of
separate execution contexts from each other, should an attacker find a
way to estimate or influence likely RDTSC values.
I think this was discussed at some point too, though my search-foo is
failing me. I'm open to adding this to the mix, though care is needed
for both stack address and stack canary values, since they both have
specific structure (i.e. high and low bits of address are "known", and
low bits of canary are always zero) and we don't want to run the risk
of entangling secret values: if one can be exposed, does the entangling
expose the others?
I've had to deal with both of these issues with the slab freelist pointer
obfuscation, so my instinct here is to avoid mixing the other values in.
I'm open to improving it, of course, but I think rdtsc is a good first
step.
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
From: Thomas Gleixner <hidden> Date: 2021-03-28 14:20:05
On Fri, Mar 19 2021 at 14:28, Kees Cook wrote:
+
+ /*
+ * x86_64 stack alignment means 3 bits are ignored, so keep
+ * the top 5 bits. x86_32 needs only 2 bits of alignment, so
+ * the top 6 bits will be used.
+ */
+ choose_random_kstack_offset(rdtsc() & 0xFF);
Comment mumbles about 5/6 bits and the TSC value is masked with 0xFF and
then the applied offset is itself limited with 0x3FF.
Too many moving parts for someone who does not have the details of all
this memorized.
Thanks,
tglx
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
On Sun, Mar 28, 2021 at 04:18:56PM +0200, Thomas Gleixner wrote:
On Fri, Mar 19 2021 at 14:28, Kees Cook wrote:
quoted
+
+ /*
+ * x86_64 stack alignment means 3 bits are ignored, so keep
+ * the top 5 bits. x86_32 needs only 2 bits of alignment, so
+ * the top 6 bits will be used.
+ */
+ choose_random_kstack_offset(rdtsc() & 0xFF);
Comment mumbles about 5/6 bits and the TSC value is masked with 0xFF and
then the applied offset is itself limited with 0x3FF.
Too many moving parts for someone who does not have the details of all
this memorized.
Each piece is intentional -- I will improve the comments to explain
each level of masking happening (implicit compiler stack alignment mask,
explicit per-arch mask, and the VLA upper-bound protection mask).
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
This provides the ability for architectures to enable kernel stack base
address offset randomization. This feature is controlled by the boot
param "randomize_kstack_offset=on/off", with its default value set by
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT.
This feature is based on the original idea from the last public release
of PaX's RANDKSTACK feature: https://pax.grsecurity.net/docs/randkstack.txt
All the credit for the original idea goes to the PaX team. Note that
the design and implementation of this upstream randomize_kstack_offset
feature differs greatly from the RANDKSTACK feature (see below).
Reasoning for the feature:
This feature aims to make harder the various stack-based attacks that
rely on deterministic stack structure. We have had many such attacks in
past (just to name few):
https://jon.oberheide.org/files/infiltrate12-thestackisback.pdfhttps://jon.oberheide.org/files/stackjacking-infiltrate11.pdfhttps://googleprojectzero.blogspot.com/2016/06/exploiting-recursion-in-linux-kernel_20.html
As Linux kernel stack protections have been constantly improving
(vmap-based stack allocation with guard pages, removal of thread_info,
STACKLEAK), attackers have had to find new ways for their exploits
to work. They have done so, continuing to rely on the kernel's stack
determinism, in situations where VMAP_STACK and THREAD_INFO_IN_TASK_STRUCT
were not relevant. For example, the following recent attacks would have
been hampered if the stack offset was non-deterministic between syscalls:
https://repositorio-aberto.up.pt/bitstream/10216/125357/2/374717.pdf
(page 70: targeting the pt_regs copy with linear stack overflow)
https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html
(leaked stack address from one syscall as a target during next syscall)
The main idea is that since the stack offset is randomized on each system
call, it is harder for an attack to reliably land in any particular place
on the thread stack, even with address exposures, as the stack base will
change on the next syscall. Also, since randomization is performed after
placing pt_regs, the ptrace-based approach[1] to discover the randomized
offset during a long-running syscall should not be possible.
Design description:
During most of the kernel's execution, it runs on the "thread stack",
which is pretty deterministic in its structure: it is fixed in size,
and on every entry from userspace to kernel on a syscall the thread
stack starts construction from an address fetched from the per-cpu
cpu_current_top_of_stack variable. The first element to be pushed to the
thread stack is the pt_regs struct that stores all required CPU registers
and syscall parameters. Finally the specific syscall function is called,
with the stack being used as the kernel executes the resulting request.
The goal of randomize_kstack_offset feature is to add a random offset
after the pt_regs has been pushed to the stack and before the rest of the
thread stack is used during the syscall processing, and to change it every
time a process issues a syscall. The source of randomness is currently
architecture-defined (but x86 is using the low byte of rdtsc()). Future
improvements for different entropy sources is possible, but out of scope
for this patch. As suggested by Andy Lutomirski, the offset is added
using alloca() and an empty asm() statement with an output constraint,
since it avoid changes to assembly syscall entry code, to the unwinder,
and provides correct stack alignment as defined by the compiler.
In order to make this available by default with zero performance impact
for those that don't want it, it is boot-time selectable with static
branches. This way, if the overhead is not wanted, it can just be
left turned off with no performance impact.
The generated assembly for x86_64 with GCC looks like this:
...
ffffffff81003977: 65 8b 05 02 ea 00 7f mov %gs:0x7f00ea02(%rip),%eax
# 12380 <kstack_offset>
ffffffff8100397e: 25 ff 03 00 00 and $0x3ff,%eax
ffffffff81003983: 48 83 c0 0f add $0xf,%rax
ffffffff81003987: 25 f8 07 00 00 and $0x7f8,%eax
ffffffff8100398c: 48 29 c4 sub %rax,%rsp
ffffffff8100398f: 48 8d 44 24 0f lea 0xf(%rsp),%rax
ffffffff81003994: 48 83 e0 f0 and $0xfffffffffffffff0,%rax
...
As a result of the above stack alignment, this patch introduces about
5 bits of randomness after pt_regs is spilled to the thread stack on
x86_64, and 6 bits on x86_32 (since its has 1 fewer bit required for
stack alignment). The amount of entropy could be adjusted based on how
much of the stack space we wish to trade for security.
My measure of syscall performance overhead (on x86_64):
lmbench: /usr/lib/lmbench/bin/x86_64-linux-gnu/lat_syscall -N 10000 null
randomize_kstack_offset=y Simple syscall: 0.7082 microseconds
randomize_kstack_offset=n Simple syscall: 0.7016 microseconds
So, roughly 0.9% overhead growth for a no-op syscall, which is very
manageable. And for people that don't want this, it's off by default.
There are two gotchas with using the alloca() trick. First,
compilers that have Stack Clash protection (-fstack-clash-protection)
enabled by default (e.g. Ubuntu[3]) add pagesize stack probes to
any dynamic stack allocations. While the randomization offset is
always less than a page, the resulting assembly would still contain
(unreachable!) probing routines, bloating the resulting assembly. To
avoid this, -fno-stack-clash-protection is unconditionally added to
the kernel Makefile since this is the only dynamic stack allocation in
the kernel (now that VLAs have been removed) and it is provably safe
from Stack Clash style attacks.
The second gotcha with alloca() is a negative interaction with
-fstack-protector*, in that it sees the alloca() as an array allocation,
which triggers the unconditional addition of the stack canary function
pre/post-amble which slows down syscalls regardless of the static
branch. In order to avoid adding this unneeded check and its associated
performance impact, architectures need to carefully remove uses of
-fstack-protector-strong (or -fstack-protector) in the compilation units
that use the add_random_kstack() macro and to audit the resulting stack
mitigation coverage (to make sure no desired coverage disappears). No
change is visible for this on x86 because the stack protector is already
unconditionally disabled for the compilation unit, but the change is
required on arm64. There is, unfortunately, no attribute that can be
used to disable stack protector for specific functions.
Comparison to PaX RANDKSTACK feature:
The RANDKSTACK feature randomizes the location of the stack start
(cpu_current_top_of_stack), i.e. including the location of pt_regs
structure itself on the stack. Initially this patch followed the same
approach, but during the recent discussions[2], it has been determined
to be of a little value since, if ptrace functionality is available for
an attacker, they can use PTRACE_PEEKUSR/PTRACE_POKEUSR to read/write
different offsets in the pt_regs struct, observe the cache behavior of
the pt_regs accesses, and figure out the random stack offset. Another
difference is that the random offset is stored in a per-cpu variable,
rather than having it be per-thread. As a result, these implementations
differ a fair bit in their implementation details and results, though
obviously the intent is similar.
[1] https://lore.kernel.org/kernel-hardening/2236FBA76BA1254E88B949DDB74E612BA4BC57C1@IRSMSX102.ger.corp.intel.com/
[2] https://lore.kernel.org/kernel-hardening/20190329081358.30497-1-elena.reshetova@intel.com/
[3] https://lists.ubuntu.com/archives/ubuntu-devel/2019-June/040741.html
Co-developed-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Link: https://lore.kernel.org/r/20190415060918.3766-1-elena.reshetova@intel.com
Signed-off-by: Kees Cook <redacted>
---
.../admin-guide/kernel-parameters.txt | 11 +++++
Makefile | 4 ++
arch/Kconfig | 23 ++++++++++
include/linux/randomize_kstack.h | 42 +++++++++++++++++++
init/main.c | 23 ++++++++++
5 files changed, 103 insertions(+)
create mode 100644 include/linux/randomize_kstack.h
@@ -4061,6 +4061,17 @@ fully seed the kernel's CRNG. Default is controlled by CONFIG_RANDOM_TRUST_CPU.+ randomize_kstack_offset=+ [KNL] Enable or disable kernel stack offset+ randomization, which provides roughly 5 bits of+ entropy, frustrating memory corruption attacks+ that depend on stack address determinism or+ cross-syscall address exposures. This is only+ available on architectures that have defined+ CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET.+ Format: <bool> (1/Y/y=enable, 0/N/n=disable)+ Default is CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT.+ ras=option[,option,...] [KNL] RAS-specific options cec_disable [X86]
@@ -811,6 +811,10 @@ KBUILD_CFLAGS += -ftrivial-auto-var-init=zeroKBUILD_CFLAGS+=-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clangendif+# While VLAs have been removed, GCC produces unreachable stack probes+# for the randomize_kstack_offset feature. Disable it for all compilers.+KBUILD_CFLAGS+=$(callcc-option,-fno-stack-clash-protection)+DEBUG_CFLAGS:=# Workaround for GCC versions < 5.0
From: Thomas Gleixner <hidden> Date: 2021-03-28 14:45:28
Kees,
On Fri, Mar 19 2021 at 14:28, Kees Cook wrote:
+/*
+ * Do not use this anywhere else in the kernel. This is used here because
+ * it provides an arch-agnostic way to grow the stack with correct
+ * alignment. Also, since this use is being explicitly masked to a max of
+ * 10 bits, stack-clash style attacks are unlikely. For more details see
+ * "VLAs" in Documentation/process/deprecated.rst
VLAs are bad, VLAs to the rescue! :)
+ * The asm statement is designed to convince the compiler to keep the
+ * allocation around even after "ptr" goes out of scope.
+ */
+void *__builtin_alloca(size_t size);
+
+#define add_random_kstack_offset() do { \
+ if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+ &randomize_kstack_offset)) { \
+ u32 offset = this_cpu_read(kstack_offset); \
Not that it matters on x86, but as this has to be called in the
interrupt disabled region of the syscall entry, shouldn't this be a
raw_cpu_read(). The asm-generic version has a preempt_disable/enable
pair around the raw read for native wordsize reads, otherwise a
irqsave/restore pair.
__this_cpu_read() is fine as well, but that has an sanity check before
the raw read when CONFIG_DEBUG_PREEMPT is on, which is harmless but
also pointless in this case.
Probably the same for the counterpart this_cpu_write().
Thanks,
tglx
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
On Sun, Mar 28, 2021 at 04:42:03PM +0200, Thomas Gleixner wrote:
On Fri, Mar 19 2021 at 14:28, Kees Cook wrote:
quoted
+/*
+ * Do not use this anywhere else in the kernel. This is used here because
+ * it provides an arch-agnostic way to grow the stack with correct
+ * alignment. Also, since this use is being explicitly masked to a max of
+ * 10 bits, stack-clash style attacks are unlikely. For more details see
+ * "VLAs" in Documentation/process/deprecated.rst
VLAs are bad, VLAs to the rescue! :)
I'm aware of the irony, but luto's idea really makes things easy. As
documented there, though, this has a hard-coded (low) upper bound, so
it's not like "regular" VLA use.
quoted
+ * The asm statement is designed to convince the compiler to keep the
+ * allocation around even after "ptr" goes out of scope.
+ */
+void *__builtin_alloca(size_t size);
+
+#define add_random_kstack_offset() do { \
+ if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+ &randomize_kstack_offset)) { \
+ u32 offset = this_cpu_read(kstack_offset); \
Not that it matters on x86, but as this has to be called in the
interrupt disabled region of the syscall entry, shouldn't this be a
raw_cpu_read(). The asm-generic version has a preempt_disable/enable
pair around the raw read for native wordsize reads, otherwise a
irqsave/restore pair.
__this_cpu_read() is fine as well, but that has an sanity check before
the raw read when CONFIG_DEBUG_PREEMPT is on, which is harmless but
also pointless in this case.
Probably the same for the counterpart this_cpu_write().
Oh! Excellent point. I think this will make a big difference on arm64. I
will adjust and test.
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Allow for a randomized stack offset on a per-syscall basis, with roughly
5 bits of entropy. (And include AAPCS rationale AAPCS thanks to Mark
Rutland.)
In order to avoid unconditional stack canaries on syscall entry (due to
the use of alloca()), also disable stack protector to avoid triggering
needless checks and slowing down the entry path. As there is no general
way to control stack protector coverage with a function attribute[1],
this must be disabled at the compilation unit level. This isn't a problem
here, though, since stack protector was not triggered before: examining
the resulting syscall.o, there are no changes in canary coverage (none
before, none now).
[1] a working __attribute__((no_stack_protector)) has been added to GCC
and Clang but has not been released in any version yet:
https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=346b302d09c1e6db56d9fe69048acb32fbb97845https://reviews.llvm.org/rG4fbf84c1732fca596ad1d6e96015e19760eb8a9b
Signed-off-by: Kees Cook <redacted>
---
arch/arm64/Kconfig | 1 +
arch/arm64/kernel/Makefile | 5 +++++
arch/arm64/kernel/syscall.c | 10 ++++++++++
3 files changed, 16 insertions(+)
From: Will Deacon <will@kernel.org> Date: 2021-04-01 08:35:44
On Fri, Mar 19, 2021 at 02:28:34PM -0700, Kees Cook wrote:
quoted hunk
Allow for a randomized stack offset on a per-syscall basis, with roughly
5 bits of entropy. (And include AAPCS rationale AAPCS thanks to Mark
Rutland.)
In order to avoid unconditional stack canaries on syscall entry (due to
the use of alloca()), also disable stack protector to avoid triggering
needless checks and slowing down the entry path. As there is no general
way to control stack protector coverage with a function attribute[1],
this must be disabled at the compilation unit level. This isn't a problem
here, though, since stack protector was not triggered before: examining
the resulting syscall.o, there are no changes in canary coverage (none
before, none now).
[1] a working __attribute__((no_stack_protector)) has been added to GCC
and Clang but has not been released in any version yet:
https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=346b302d09c1e6db56d9fe69048acb32fbb97845https://reviews.llvm.org/rG4fbf84c1732fca596ad1d6e96015e19760eb8a9b
Signed-off-by: Kees Cook <redacted>
---
arch/arm64/Kconfig | 1 +
arch/arm64/kernel/Makefile | 5 +++++
arch/arm64/kernel/syscall.c | 10 ++++++++++
3 files changed, 16 insertions(+)
Not sure about either of these new calls -- aren't we preemptible in
invoke_syscall()?
Will
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel