From: Kees Cook <keescook@chromium.org>
To: Linus Walleij <linus.walleij@linaro.org>
Cc: Russell King <linux@armlinux.org.uk>,
Sami Tolvanen <samitolvanen@google.com>,
Nathan Chancellor <nathan@kernel.org>,
Nick Desaulniers <ndesaulniers@google.com>,
Ard Biesheuvel <ardb@kernel.org>, Arnd Bergmann <arnd@arndb.de>,
linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev
Subject: Re: [PATCH v4 7/8] ARM: hw_breakpoint: Handle CFI breakpoints
Date: Thu, 4 Apr 2024 14:26:46 -0700 [thread overview]
Message-ID: <202404041426.F7AA8E92@keescook> (raw)
In-Reply-To: <20240328-arm32-cfi-v4-7-a11046139125@linaro.org>
On Thu, Mar 28, 2024 at 09:19:30AM +0100, Linus Walleij wrote:
> This registers a breakpoint handler for the new breakpoint type
> (0x03) inserted by LLVM CLANG for CFI breakpoints.
>
> If we are in permissive mode, just print a backtrace and continue.
>
> Example with CONFIG_CFI_PERMISSIVE enabled:
>
> > echo CFI_FORWARD_PROTO > /sys/kernel/debug/provoke-crash/DIRECT
> lkdtm: Performing direct entry CFI_FORWARD_PROTO
> lkdtm: Calling matched prototype ...
> lkdtm: Calling mismatched prototype ...
> CFI failure at lkdtm_indirect_call+0x40/0x4c (target: 0x0; expected type: 0x00000000)
> WARNING: CPU: 1 PID: 112 at lkdtm_indirect_call+0x40/0x4c
> CPU: 1 PID: 112 Comm: sh Not tainted 6.8.0-rc1+ #150
> Hardware name: ARM-Versatile Express
> (...)
> lkdtm: FAIL: survived mismatched prototype function call!
> lkdtm: Unexpected! This kernel (6.8.0-rc1+ armv7l) was built with CONFIG_CFI_CLANG=y
>
> As you can see the LKDTM test fails, but I expect that this would be
> expected behaviour in the permissive mode.
>
> We are currently not implementing target and type for the CFI
> breakpoint as this requires additional operand bundling compiler
> extensions.
>
> CPUs without breakpoint support cannot handle breakpoints naturally,
> in these cases the permissive mode will not work, CFI will fall over
> on an undefined instruction:
>
> Internal error: Oops - undefined instruction: 0 [#1] PREEMPT ARM
> CPU: 0 PID: 186 Comm: ash Tainted: G W 6.9.0-rc1+ #7
> Hardware name: Gemini (Device Tree)
> PC is at lkdtm_indirect_call+0x38/0x4c
> LR is at lkdtm_CFI_FORWARD_PROTO+0x30/0x6c
>
> This is reasonable I think: it's the best CFI can do to ascertain
> the the control flow is not broken on these CPUs.
>
> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Thanks for making this "fail closed". Looks good!
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2024-04-04 21:27 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-28 8:19 [PATCH v4 0/8] CFI for ARM32 using LLVM Linus Walleij
2024-03-28 8:19 ` [PATCH v4 1/8] ARM: bugs: Check in the vtable instead of defined aliases Linus Walleij
2024-03-28 8:19 ` [PATCH v4 2/8] ARM: ftrace: Define ftrace_stub_graph Linus Walleij
2024-03-28 8:19 ` [PATCH v4 3/8] ARM: mm: Make tlbflush routines CFI safe Linus Walleij
2024-03-28 8:19 ` [PATCH v4 5/8] ARM: mm: Define prototypes for all per-processor calls Linus Walleij
2024-03-28 8:19 ` [PATCH v4 6/8] ARM: lib: Annotate loop delay instructions for CFI Linus Walleij
2024-03-28 8:19 ` [PATCH v4 7/8] ARM: hw_breakpoint: Handle CFI breakpoints Linus Walleij
2024-04-04 21:26 ` Kees Cook [this message]
2024-03-28 8:19 ` [PATCH v4 8/8] ARM: Support CLANG CFI Linus Walleij
2024-04-04 21:27 ` [PATCH v4 0/8] CFI for ARM32 using LLVM Kees Cook
2024-04-12 7:38 ` Linus Walleij
2024-04-12 22:07 ` Nathan Chancellor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202404041426.F7AA8E92@keescook \
--to=keescook@chromium.org \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=linus.walleij@linaro.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux@armlinux.org.uk \
--cc=llvm@lists.linux.dev \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=samitolvanen@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).