From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B8EDAC27C79 for ; Thu, 20 Jun 2024 18:38:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:In-Reply-To:Content-Type: MIME-Version:References:Message-ID:Subject:Cc:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=gRdb0vjJReTKUazHPwAWYWukHHrMiCWHpfc/PBvr+Q8=; b=hMZNGZO75muEt0KR8UeccXCeFk kr+bOBYVcZX4qWzhPE6fKq3+A4bwV7mvPcALj4JOs35WOrjG6LR7aGHwTjQ1n2QmD7oPiyPK3/pjC /0VVT5MRX1LMcCcblPsNndFA5TqWJzfG/ruQikU7R4sVdJ21F2/WkoV9/MIiEbpgRzDKoD8OJ7FUY QPNfn9gnDlN5Z92tWa37Oy3URnkJ7yGQXGiE/clrX3Z1HApT+m+olJFx9dEOD+OHCgs/1F/Y1zVJh dgHeNzRsdgcQgUno6n+QlnKru/bUgJYWbTIBKPB8Rpw97xAhvnEi0TGmrsyArMk9IqwgDN5ROSqm8 hiFTMkWw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sKMgE-00000006KZI-0Vcn; Thu, 20 Jun 2024 18:38:42 +0000 Received: from sin.source.kernel.org ([2604:1380:40e1:4800::1]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sKMg9-00000006KYI-44yn for linux-arm-kernel@lists.infradead.org; Thu, 20 Jun 2024 18:38:40 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 159DDCE269E; Thu, 20 Jun 2024 18:38:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 46471C2BD10; Thu, 20 Jun 2024 18:38:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1718908715; bh=bt0gQE1+V2HRT08t/BZzlfDOsm+kbAKYPtp191A9SSc=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=W4mzUIphC+bsGyWWVINjJ+zyi2TYr+n1ojFGjsI8XWbK2zNhXlv1Nx8qG243WOG1j SP+qRwr/3cCBXWOZJyJ5jtDpC9RymL1zO+H8oGQZMTN9HwTMKzmWkG4Bdo7uwrN4fc Ksfxhz7OZtJi542XD73eeU5TCJha8pxUCpw8QzPr6BT6PGiDwvbYk6wGHaq88zc0Nu g2GYoUzzlpjTWzYWwandJUjit9KugI72A6XPga/pvfKAeZ9/4SKLgUNWuDuNmaGzzB rmi1hv1JFv1nNx9XhhT5Clg0dC4YMIwFit8yctnF0ZOnlBofbCqae/5n+6OKjM+Dq0 l+k19n0IFRmbw== Date: Thu, 20 Jun 2024 11:38:34 -0700 From: Kees Cook To: Jinjie Ruan Cc: linux@armlinux.org.uk, ardb@kernel.org, arnd@arndb.de, afd@ti.com, akpm@linux-foundation.org, rmk+kernel@armlinux.org.uk, linus.walleij@linaro.org, eric.devolder@oracle.com, robh@kernel.org, masahiroy@kernel.org, palmer@rivosinc.com, samitolvanen@google.com, xiao.w.wang@intel.com, alexghiti@rivosinc.com, nathan@kernel.org, jan.kiszka@siemens.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, Alexander Popov Subject: Re: [PATCH] ARM: Add support for STACKLEAK gcc plugin Message-ID: <202406201136.A441E0B7@keescook> References: <20240620131649.886995-1-ruanjinjie@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240620131649.886995-1-ruanjinjie@huawei.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240620_113838_398420_C2B7C142 X-CRM114-Status: GOOD ( 22.64 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Thu, Jun 20, 2024 at 09:16:49PM +0800, Jinjie Ruan wrote: > Add the STACKLEAK gcc plugin to arm32 by adding the helper used by > stackleak common code: on_thread_stack(). It initialize the stack with the > poison value before returning from system calls which improves the kernel > security. Additionally, this disables the plugin in EFI stub code and > decompress code, which are out of scope for the protection. Oh very cool! Thanks for sending this! > Before the test on Qemu versatilepb board: > # echo STACKLEAK_ERASING > /sys/kernel/debug/provoke-crash/DIRECT > lkdtm: Performing direct entry STACKLEAK_ERASING > lkdtm: XFAIL: stackleak is not supported on this arch (HAVE_ARCH_STACKLEAK=n) > > After: > # echo STACKLEAK_ERASING > /sys/kernel/debug/provoke-crash/DIRECT > lkdtm: Performing direct entry STACKLEAK_ERASING > lkdtm: stackleak stack usage: > high offset: 80 bytes > current: 280 bytes > lowest: 696 bytes > tracked: 696 bytes > untracked: 192 bytes > poisoned: 7220 bytes > low offset: 4 bytes > lkdtm: OK: the rest of the thread stack is properly erased > > Signed-off-by: Jinjie Ruan > --- > arch/arm/Kconfig | 1 + > arch/arm/boot/compressed/Makefile | 1 + > arch/arm/include/asm/stacktrace.h | 5 +++++ > arch/arm/kernel/entry-common.S | 3 +++ > drivers/firmware/efi/libstub/Makefile | 3 ++- > 5 files changed, 12 insertions(+), 1 deletion(-) > > diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig > index 036381c5d42f..b211b7f5a138 100644 > --- a/arch/arm/Kconfig > +++ b/arch/arm/Kconfig > @@ -86,6 +86,7 @@ config ARM > select HAVE_ARCH_PFN_VALID > select HAVE_ARCH_SECCOMP > select HAVE_ARCH_SECCOMP_FILTER if AEABI && !OABI_COMPAT > + select HAVE_ARCH_STACKLEAK > select HAVE_ARCH_THREAD_STRUCT_WHITELIST > select HAVE_ARCH_TRACEHOOK > select HAVE_ARCH_TRANSPARENT_HUGEPAGE if ARM_LPAE > diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile > index 6bca03c0c7f0..945b5975fce2 100644 > --- a/arch/arm/boot/compressed/Makefile > +++ b/arch/arm/boot/compressed/Makefile > @@ -9,6 +9,7 @@ OBJS = > > HEAD = head.o > OBJS += misc.o decompress.o > +CFLAGS_decompress.o += $(DISABLE_STACKLEAK_PLUGIN) > ifeq ($(CONFIG_DEBUG_UNCOMPRESS),y) > OBJS += debug.o > AFLAGS_head.o += -DDEBUG > diff --git a/arch/arm/include/asm/stacktrace.h b/arch/arm/include/asm/stacktrace.h > index 360f0d2406bf..a9b4b72ed241 100644 > --- a/arch/arm/include/asm/stacktrace.h > +++ b/arch/arm/include/asm/stacktrace.h > @@ -26,6 +26,11 @@ struct stackframe { > #endif > }; > > +static inline bool on_thread_stack(void) > +{ > + return !(((unsigned long)(current->stack) ^ current_stack_pointer) & ~(THREAD_SIZE - 1)); > +} > + > static __always_inline > void arm_get_current_stackframe(struct pt_regs *regs, struct stackframe *frame) > { > diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S > index 5c31e9de7a60..f379c852dcb7 100644 > --- a/arch/arm/kernel/entry-common.S > +++ b/arch/arm/kernel/entry-common.S > @@ -119,6 +119,9 @@ no_work_pending: > > ct_user_enter save = 0 > > +#ifdef CONFIG_GCC_PLUGIN_STACKLEAK > + bl stackleak_erase_on_task_stack > +#endif > restore_user_regs fast = 0, offset = 0 > ENDPROC(ret_to_user_from_irq) > ENDPROC(ret_to_user) > diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile > index 06f0428a723c..20d8a491f25f 100644 > --- a/drivers/firmware/efi/libstub/Makefile > +++ b/drivers/firmware/efi/libstub/Makefile > @@ -27,7 +27,8 @@ cflags-$(CONFIG_ARM64) += -fpie $(DISABLE_STACKLEAK_PLUGIN) \ > cflags-$(CONFIG_ARM) += -DEFI_HAVE_STRLEN -DEFI_HAVE_STRNLEN \ > -DEFI_HAVE_MEMCHR -DEFI_HAVE_STRRCHR \ > -DEFI_HAVE_STRCMP -fno-builtin -fpic \ > - $(call cc-option,-mno-single-pic-base) > + $(call cc-option,-mno-single-pic-base) \ > + $(DISABLE_STACKLEAK_PLUGIN) > cflags-$(CONFIG_RISCV) += -fpic -DNO_ALTERNATIVE -mno-relax > cflags-$(CONFIG_LOONGARCH) += -fpie This looks very straight forward! If an ARM person can Ack this, I could carry it via the hardening tree. Otherwise, it should probably go via rmk's patch tracker? -Kees -- Kees Cook