From: Ard Biesheuvel <ardb@kernel.org>
To: linux-arm-kernel@lists.infradead.org
Cc: Ard Biesheuvel <ardb@kernel.org>, Marc Zyngier <maz@kernel.org>,
Will Deacon <will@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Kees Cook <keescook@chromium.org>,
Catalin Marinas <catalin.marinas@arm.com>,
Mark Brown <broonie@kernel.org>
Subject: [PATCH 3/4] arm64: efi: Add return address protection to runtime wrapper
Date: Tue, 29 Nov 2022 15:18:02 +0100 [thread overview]
Message-ID: <20221129141803.1746898-4-ardb@kernel.org> (raw)
In-Reply-To: <20221129141803.1746898-1-ardb@kernel.org>
Add return address protection to the EFI runtime wrapper so that this
code is less likely to be taken advantage for ROP/JOP style attacks.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/kernel/efi-rt-wrapper.S | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/kernel/efi-rt-wrapper.S b/arch/arm64/kernel/efi-rt-wrapper.S
index afd3e81e1b627b87..874da02f3a1664c3 100644
--- a/arch/arm64/kernel/efi-rt-wrapper.S
+++ b/arch/arm64/kernel/efi-rt-wrapper.S
@@ -6,6 +6,7 @@
#include <linux/linkage.h>
SYM_FUNC_START(__efi_rt_asm_wrapper)
+ protect_return_address
stp x29, x30, [sp, #-112]!
mov x29, sp
@@ -46,9 +47,7 @@ SYM_FUNC_START(__efi_rt_asm_wrapper)
ldp x1, x2, [sp, #16]
cmp x2, x18
ldp x29, x30, [sp], #112
- b.ne 0f
- ret
-0:
+
/*
* With CONFIG_SHADOW_CALL_STACK, the kernel uses x18 to store a
* shadow stack pointer, which we need to restore before returning to
@@ -59,7 +58,10 @@ SYM_FUNC_START(__efi_rt_asm_wrapper)
#ifdef CONFIG_SHADOW_CALL_STACK
ldr_this_cpu x18, __efi_rt_asm_recover_sp + 8, x9
#endif
-
+ b.ne 0f
+ restore_return_address
+ ret
+0:
b efi_handle_corrupted_x18 // tail call
SYM_FUNC_END(__efi_rt_asm_wrapper)
@@ -74,5 +76,7 @@ SYM_CODE_START(__efi_rt_asm_recover)
ldp x27, x28, [sp, #96]
ldp x29, x30, [sp], #112
+ restore_return_address
+
b efi_handle_runtime_exception
SYM_CODE_END(__efi_rt_asm_recover)
--
2.35.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2022-11-29 14:20 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-29 14:17 [PATCH 0/4] arm64: Add return address protection to asm code Ard Biesheuvel
2022-11-29 14:18 ` [PATCH 1/4] arm64: assembler: Force error on misuse of .Lframe_local_offset Ard Biesheuvel
2022-11-29 14:18 ` [PATCH 2/4] arm64: assembler: Add macros for return address protection Ard Biesheuvel
2022-11-30 14:15 ` Mark Rutland
2022-11-30 14:33 ` Ard Biesheuvel
2022-11-29 14:18 ` Ard Biesheuvel [this message]
2022-11-29 14:18 ` [PATCH 4/4] arm64: ftrace: Add " Ard Biesheuvel
2022-11-30 14:04 ` Mark Rutland
2022-11-30 14:26 ` Ard Biesheuvel
2022-11-30 17:45 ` Mark Rutland
2022-12-01 13:09 ` Ard Biesheuvel
2022-12-01 14:40 ` Mark Rutland
2022-12-01 15:05 ` Ard Biesheuvel
2022-12-01 15:48 ` Mark Rutland
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221129141803.1746898-4-ardb@kernel.org \
--to=ardb@kernel.org \
--cc=broonie@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=keescook@chromium.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=mark.rutland@arm.com \
--cc=maz@kernel.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).