Commit 80d47def authored by Brian Gerst's avatar Brian Gerst Committed by Ingo Molnar
Browse files

x86/stackprotector/64: Convert to normal per-CPU variable 



Older versions of GCC fixed the location of the stack protector canary
at %gs:40.  This constraint forced the percpu section to be linked at
absolute address 0 so that the canary could be the first data object in
the percpu section.  Supporting the zero-based percpu section requires
additional code to handle relocations for RIP-relative references to
percpu data, extra complexity to kallsyms, and workarounds for linker
bugs due to the use of absolute symbols.

GCC 8.1 supports redefining where the canary is located, allowing it to
become a normal percpu variable instead of at a fixed location.  This
removes the constraint that the percpu section must be zero-based.

Signed-off-by: default avatarBrian Gerst <brgerst@gmail.com>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Reviewed-by: default avatarArd Biesheuvel <ardb@kernel.org>
Reviewed-by: default avatarUros Bizjak <ubizjak@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://lore.kernel.org/r/20250123190747.745588-8-brgerst@gmail.com
parent 78c4374e

arch/x86/Makefile

+12 −8
Original line number Diff line number Diff line
@@ -140,14 +140,7 @@ ifeq ($(CONFIG_X86_32),y) 
        # temporary until string.h is fixed

        KBUILD_CFLAGS += -ffreestanding



    ifeq ($(CONFIG_STACKPROTECTOR),y)

        ifeq ($(CONFIG_SMP),y)

            KBUILD_CFLAGS += -mstack-protector-guard-reg=fs \

                             -mstack-protector-guard-symbol=__ref_stack_chk_guard

        else

            KBUILD_CFLAGS += -mstack-protector-guard=global

        endif

    endif

        percpu_seg := fs

else

        BITS := 64

        UTS_MACHINE := x86_64
@@ -197,6 +190,17 @@ else 
        KBUILD_CFLAGS += -mcmodel=kernel

        KBUILD_RUSTFLAGS += -Cno-redzone=y

        KBUILD_RUSTFLAGS += -Ccode-model=kernel



        percpu_seg := gs

endif



ifeq ($(CONFIG_STACKPROTECTOR),y)

    ifeq ($(CONFIG_SMP),y)

	KBUILD_CFLAGS += -mstack-protector-guard-reg=$(percpu_seg)

	KBUILD_CFLAGS += -mstack-protector-guard-symbol=__ref_stack_chk_guard

    else

	KBUILD_CFLAGS += -mstack-protector-guard=global

    endif

endif



#

arch/x86/entry/entry.S

+0 −2
Original line number Diff line number Diff line
@@ -52,7 +52,6 @@ EXPORT_SYMBOL_GPL(mds_verw_sel); 


THUNK warn_thunk_thunk, __warn_thunk



#ifndef CONFIG_X86_64

/*

 * Clang's implementation of TLS stack cookies requires the variable in

 * question to be a TLS variable. If the variable happens to be defined as an
@@ -66,4 +65,3 @@ THUNK warn_thunk_thunk, __warn_thunk 
#ifdef CONFIG_STACKPROTECTOR

EXPORT_SYMBOL(__ref_stack_chk_guard);

#endif
 
#endif

arch/x86/entry/entry_64.S

+1 −1
Original line number Diff line number Diff line
@@ -192,7 +192,7 @@ SYM_FUNC_START(__switch_to_asm) 


#ifdef CONFIG_STACKPROTECTOR

	movq	TASK_stack_canary(%rsi), %rbx

	movq	%rbx, PER_CPU_VAR(fixed_percpu_data + FIXED_stack_canary)

	movq	%rbx, PER_CPU_VAR(__stack_chk_guard)

#endif



	/*

arch/x86/include/asm/processor.h

+2 −14
Original line number Diff line number Diff line
@@ -422,16 +422,8 @@ struct irq_stack { 


#ifdef CONFIG_X86_64

struct fixed_percpu_data {

	/*

	 * GCC hardcodes the stack canary as %gs:40.  Since the

	 * irq_stack is the object at %gs:0, we reserve the bottom

	 * 48 bytes of the irq stack for the canary.

	 *

	 * Once we are willing to require -mstack-protector-guard-symbol=

	 * support for x86_64 stackprotector, we can get rid of this.

	 */

	char		gs_base[40];

	unsigned long	stack_canary;

	unsigned long	reserved;

};



DECLARE_PER_CPU_FIRST(struct fixed_percpu_data, fixed_percpu_data) __visible;
@@ -446,11 +438,7 @@ extern asmlinkage void entry_SYSCALL32_ignore(void); 


/* Save actual FS/GS selectors and bases to current->thread */

void current_save_fsgs(void);

#else	/* X86_64 */

#ifdef CONFIG_STACKPROTECTOR

DECLARE_PER_CPU(unsigned long, __stack_chk_guard);

#endif

#endif	/* !X86_64 */

#endif	/* X86_64 */



struct perf_event;

arch/x86/include/asm/stackprotector.h

+5 −31
Original line number Diff line number Diff line
@@ -2,26 +2,10 @@ 
/*

 * GCC stack protector support.

 *

 * Stack protector works by putting predefined pattern at the start of

 * Stack protector works by putting a predefined pattern at the start of

 * the stack frame and verifying that it hasn't been overwritten when

 * returning from the function.  The pattern is called stack canary

 * and unfortunately gcc historically required it to be at a fixed offset

 * from the percpu segment base.  On x86_64, the offset is 40 bytes.

 *

 * The same segment is shared by percpu area and stack canary.  On

 * x86_64, percpu symbols are zero based and %gs (64-bit) points to the

 * base of percpu area.  The first occupant of the percpu area is always

 * fixed_percpu_data which contains stack_canary at the appropriate

 * offset.  On x86_32, the stack canary is just a regular percpu

 * variable.

 *

 * Putting percpu data in %fs on 32-bit is a minor optimization compared to

 * using %gs.  Since 32-bit userspace normally has %fs == 0, we are likely

 * to load 0 into %fs on exit to usermode, whereas with percpu data in

 * %gs, we are likely to load a non-null %gs on return to user mode.

 *

 * Once we are willing to require GCC 8.1 or better for 64-bit stackprotector

 * support, we can remove some of this complexity.

 * returning from the function.  The pattern is called the stack canary

 * and is a unique value for each task.

 */



#ifndef _ASM_STACKPROTECTOR_H
@@ -36,6 +20,8 @@ 


#include <linux/sched.h>



DECLARE_PER_CPU(unsigned long, __stack_chk_guard);



/*

 * Initialize the stackprotector canary value.

 *
@@ -51,25 +37,13 @@ static __always_inline void boot_init_stack_canary(void) 
{

	unsigned long canary = get_random_canary();



#ifdef CONFIG_X86_64

	BUILD_BUG_ON(offsetof(struct fixed_percpu_data, stack_canary) != 40);

#endif



	current->stack_canary = canary;

#ifdef CONFIG_X86_64

	this_cpu_write(fixed_percpu_data.stack_canary, canary);

#else

	this_cpu_write(__stack_chk_guard, canary);

#endif

}



static inline void cpu_init_stack_canary(int cpu, struct task_struct *idle)

{

#ifdef CONFIG_X86_64

	per_cpu(fixed_percpu_data.stack_canary, cpu) = idle->stack_canary;

#else

	per_cpu(__stack_chk_guard, cpu) = idle->stack_canary;

#endif

}



#else	/* STACKPROTECTOR */