Commit 70918779 authored by Kees Cook's avatar Kees Cook Committed by Thomas Gleixner
Browse files

arm64: entry: Enable random_kstack_offset support 

Allow for a randomized stack offset on a per-syscall basis, with roughly
5 bits of entropy. (And include AAPCS rationale AAPCS thanks to Mark
Rutland.)

In order to avoid unconditional stack canaries on syscall entry (due to
the use of alloca()), also disable stack protector to avoid triggering
needless checks and slowing down the entry path. As there is no general
way to control stack protector coverage with a function attribute[1],
this must be disabled at the compilation unit level. This isn't a problem
here, though, since stack protector was not triggered before: examining
the resulting syscall.o, there are no changes in canary coverage (none
before, none now).

[1] a working __attribute__((no_stack_protector)) has been added to GCC
and Clang but has not been released in any version yet:
https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=346b302d09c1e6db56d9fe69048acb32fbb97845
https://reviews.llvm.org/rG4fbf84c1732fca596ad1d6e96015e19760eb8a9b



Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Acked-by: default avatarWill Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20210401232347.2791257-6-keescook@chromium.org
parent 68ef8735

arch/arm64/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -146,6 +146,7 @@ config ARM64 
	select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT

	select HAVE_ARCH_PFN_VALID

	select HAVE_ARCH_PREL32_RELOCATIONS

	select HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET

	select HAVE_ARCH_SECCOMP_FILTER

	select HAVE_ARCH_STACKLEAK

	select HAVE_ARCH_THREAD_STRUCT_WHITELIST

arch/arm64/kernel/Makefile

+5 −0
Original line number Diff line number Diff line
@@ -9,6 +9,11 @@ CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE) 
CFLAGS_REMOVE_insn.o = $(CC_FLAGS_FTRACE)

CFLAGS_REMOVE_return_address.o = $(CC_FLAGS_FTRACE)



# Remove stack protector to avoid triggering unneeded stack canary

# checks due to randomize_kstack_offset.

CFLAGS_REMOVE_syscall.o	 = -fstack-protector -fstack-protector-strong

CFLAGS_syscall.o	+= -fno-stack-protector



# Object file lists.

obj-y			:= debug-monitors.o entry.o irq.o fpsimd.o		\

			   entry-common.o entry-fpsimd.o process.o ptrace.o	\

arch/arm64/kernel/syscall.c

+16 −0
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ 
#include <linux/errno.h>

#include <linux/nospec.h>

#include <linux/ptrace.h>

#include <linux/randomize_kstack.h>

#include <linux/syscalls.h>



#include <asm/daifflags.h>
@@ -43,6 +44,8 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno, 
{

	long ret;



	add_random_kstack_offset();



	if (scno < sc_nr) {

		syscall_fn_t syscall_fn;

		syscall_fn = syscall_table[array_index_nospec(scno, sc_nr)];
@@ -55,6 +58,19 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno, 
		ret = lower_32_bits(ret);



	regs->regs[0] = ret;



	/*

	 * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(),

	 * but not enough for arm64 stack utilization comfort. To keep

	 * reasonable stack head room, reduce the maximum offset to 9 bits.

	 *

	 * The actual entropy will be further reduced by the compiler when

	 * applying stack alignment constraints: the AAPCS mandates a

	 * 16-byte (i.e. 4-bit) aligned SP at function boundaries.

	 *

	 * The resulting 5 bits of entropy is seen in SP[8:4].

	 */

	choose_random_kstack_offset(get_random_int() & 0x1FF);

}



static inline bool has_syscall_work(unsigned long flags)