mirror of
https://github.com/torvalds/linux.git
synced 2024-12-28 05:41:55 +00:00
2d6bb6adb7
- Introduces the stackleak gcc plugin ported from grsecurity by Alexander Popov, with x86 and arm64 support. -----BEGIN PGP SIGNATURE----- Comment: Kees Cook <kees@outflux.net> iQJKBAABCgA0FiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAlvQvn4WHGtlZXNjb29r QGNocm9taXVtLm9yZwAKCRCJcvTf3G3AJpSfD/sErFreuPT1beSw994Lr9Zx4k9v ERsuXxWBENaJOJXbOOHMfVEcEeG/1uhPSp7hlw/dpHfh0anATTrcYqm8RNKbfK+k o06+JK14OJfpm5Ghq/7OizhdNLCMT8wMU3XZtWfy65VSJGjEFx8Y48vMeQtpWtUK ylSzi9JV6j2iUBF9oibtiT53+yqsqAtX80X1G7HRCgv9kxuKMhZr+Q5oGV6+ViyQ Azj8mNn06iRnhHKd17WxDJr0GjSibzz4weS/9XgP3t3EcNWJo1EgBlD2KV3tOfP5 nzmqfqTqrcjxs/tyjdh6vVCSlYucNtyCQGn63qyShQYSg6mZwclR2fY8YSTw6PWw GfYWFOWru9z+qyQmwFkQ9bSQS2R+JIT0oBCj9VmtF9XmPCy7K2neJsQclzSPBiCW wPgXVQS4IA4684O5CmDOVMwmDpGvhdBNUR6cqSzGLxQOHY1csyXubMNUsqU3g9xk Ob4pEy/xrrIw4WpwHcLHSEW5gV1/OLhsT0fGRJJiC947L3cN5s9EZp7FLbIS0zlk qzaXUcLmn6AgcfkYwg5cI3RMLaN2V0eDCMVTWZJ1wbrmUV9chAaOnTPTjNqLOTht v3b1TTxXG4iCpMmOFf59F8pqgAwbBDlfyNSbySZ/Pq5QH69udz3Z9pIUlYQnSJHk u6q++2ReDpJXF81rBw== =Ks6B -----END PGP SIGNATURE----- Merge tag 'stackleak-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull stackleak gcc plugin from Kees Cook: "Please pull this new GCC plugin, stackleak, for v4.20-rc1. This plugin was ported from grsecurity by Alexander Popov. It provides efficient stack content poisoning at syscall exit. This creates a defense against at least two classes of flaws: - Uninitialized stack usage. (We continue to work on improving the compiler to do this in other ways: e.g. unconditional zero init was proposed to GCC and Clang, and more plugin work has started too). - Stack content exposure. By greatly reducing the lifetime of valid stack contents, exposures via either direct read bugs or unknown cache side-channels become much more difficult to exploit. This complements the existing buddy and heap poisoning options, but provides the coverage for stacks. The x86 hooks are included in this series (which have been reviewed by Ingo, Dave Hansen, and Thomas Gleixner). The arm64 hooks have already been merged through the arm64 tree (written by Laura Abbott and reviewed by Mark Rutland and Will Deacon). With VLAs having been removed this release, there is no need for alloca() protection, so it has been removed from the plugin" * tag 'stackleak-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: arm64: Drop unneeded stackleak_check_alloca() stackleak: Allow runtime disabling of kernel stack erasing doc: self-protection: Add information about STACKLEAK feature fs/proc: Show STACKLEAK metrics in the /proc file system lkdtm: Add a test for STACKLEAK gcc-plugins: Add STACKLEAK plugin for tracking the kernel stack x86/entry: Add STACKLEAK erasing the kernel stack at the end of syscalls
500 lines
12 KiB
C
500 lines
12 KiB
C
/*
|
|
* Based on arch/arm/kernel/process.c
|
|
*
|
|
* Original Copyright (C) 1995 Linus Torvalds
|
|
* Copyright (C) 1996-2000 Russell King - Converted to ARM.
|
|
* Copyright (C) 2012 ARM Ltd.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include <stdarg.h>
|
|
|
|
#include <linux/compat.h>
|
|
#include <linux/efi.h>
|
|
#include <linux/export.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/sched/debug.h>
|
|
#include <linux/sched/task.h>
|
|
#include <linux/sched/task_stack.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/stddef.h>
|
|
#include <linux/unistd.h>
|
|
#include <linux/user.h>
|
|
#include <linux/delay.h>
|
|
#include <linux/reboot.h>
|
|
#include <linux/interrupt.h>
|
|
#include <linux/init.h>
|
|
#include <linux/cpu.h>
|
|
#include <linux/elfcore.h>
|
|
#include <linux/pm.h>
|
|
#include <linux/tick.h>
|
|
#include <linux/utsname.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/random.h>
|
|
#include <linux/hw_breakpoint.h>
|
|
#include <linux/personality.h>
|
|
#include <linux/notifier.h>
|
|
#include <trace/events/power.h>
|
|
#include <linux/percpu.h>
|
|
#include <linux/thread_info.h>
|
|
|
|
#include <asm/alternative.h>
|
|
#include <asm/compat.h>
|
|
#include <asm/cacheflush.h>
|
|
#include <asm/exec.h>
|
|
#include <asm/fpsimd.h>
|
|
#include <asm/mmu_context.h>
|
|
#include <asm/processor.h>
|
|
#include <asm/stacktrace.h>
|
|
|
|
#ifdef CONFIG_STACKPROTECTOR
|
|
#include <linux/stackprotector.h>
|
|
unsigned long __stack_chk_guard __read_mostly;
|
|
EXPORT_SYMBOL(__stack_chk_guard);
|
|
#endif
|
|
|
|
/*
|
|
* Function pointers to optional machine specific functions
|
|
*/
|
|
void (*pm_power_off)(void);
|
|
EXPORT_SYMBOL_GPL(pm_power_off);
|
|
|
|
void (*arm_pm_restart)(enum reboot_mode reboot_mode, const char *cmd);
|
|
|
|
/*
|
|
* This is our default idle handler.
|
|
*/
|
|
void arch_cpu_idle(void)
|
|
{
|
|
/*
|
|
* This should do all the clock switching and wait for interrupt
|
|
* tricks
|
|
*/
|
|
trace_cpu_idle_rcuidle(1, smp_processor_id());
|
|
cpu_do_idle();
|
|
local_irq_enable();
|
|
trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
|
|
}
|
|
|
|
#ifdef CONFIG_HOTPLUG_CPU
|
|
void arch_cpu_idle_dead(void)
|
|
{
|
|
cpu_die();
|
|
}
|
|
#endif
|
|
|
|
/*
|
|
* Called by kexec, immediately prior to machine_kexec().
|
|
*
|
|
* This must completely disable all secondary CPUs; simply causing those CPUs
|
|
* to execute e.g. a RAM-based pin loop is not sufficient. This allows the
|
|
* kexec'd kernel to use any and all RAM as it sees fit, without having to
|
|
* avoid any code or data used by any SW CPU pin loop. The CPU hotplug
|
|
* functionality embodied in disable_nonboot_cpus() to achieve this.
|
|
*/
|
|
void machine_shutdown(void)
|
|
{
|
|
disable_nonboot_cpus();
|
|
}
|
|
|
|
/*
|
|
* Halting simply requires that the secondary CPUs stop performing any
|
|
* activity (executing tasks, handling interrupts). smp_send_stop()
|
|
* achieves this.
|
|
*/
|
|
void machine_halt(void)
|
|
{
|
|
local_irq_disable();
|
|
smp_send_stop();
|
|
while (1);
|
|
}
|
|
|
|
/*
|
|
* Power-off simply requires that the secondary CPUs stop performing any
|
|
* activity (executing tasks, handling interrupts). smp_send_stop()
|
|
* achieves this. When the system power is turned off, it will take all CPUs
|
|
* with it.
|
|
*/
|
|
void machine_power_off(void)
|
|
{
|
|
local_irq_disable();
|
|
smp_send_stop();
|
|
if (pm_power_off)
|
|
pm_power_off();
|
|
}
|
|
|
|
/*
|
|
* Restart requires that the secondary CPUs stop performing any activity
|
|
* while the primary CPU resets the system. Systems with multiple CPUs must
|
|
* provide a HW restart implementation, to ensure that all CPUs reset at once.
|
|
* This is required so that any code running after reset on the primary CPU
|
|
* doesn't have to co-ordinate with other CPUs to ensure they aren't still
|
|
* executing pre-reset code, and using RAM that the primary CPU's code wishes
|
|
* to use. Implementing such co-ordination would be essentially impossible.
|
|
*/
|
|
void machine_restart(char *cmd)
|
|
{
|
|
/* Disable interrupts first */
|
|
local_irq_disable();
|
|
smp_send_stop();
|
|
|
|
/*
|
|
* UpdateCapsule() depends on the system being reset via
|
|
* ResetSystem().
|
|
*/
|
|
if (efi_enabled(EFI_RUNTIME_SERVICES))
|
|
efi_reboot(reboot_mode, NULL);
|
|
|
|
/* Now call the architecture specific reboot code. */
|
|
if (arm_pm_restart)
|
|
arm_pm_restart(reboot_mode, cmd);
|
|
else
|
|
do_kernel_restart(cmd);
|
|
|
|
/*
|
|
* Whoops - the architecture was unable to reboot.
|
|
*/
|
|
printk("Reboot failed -- System halted\n");
|
|
while (1);
|
|
}
|
|
|
|
static void print_pstate(struct pt_regs *regs)
|
|
{
|
|
u64 pstate = regs->pstate;
|
|
|
|
if (compat_user_mode(regs)) {
|
|
printk("pstate: %08llx (%c%c%c%c %c %s %s %c%c%c)\n",
|
|
pstate,
|
|
pstate & PSR_AA32_N_BIT ? 'N' : 'n',
|
|
pstate & PSR_AA32_Z_BIT ? 'Z' : 'z',
|
|
pstate & PSR_AA32_C_BIT ? 'C' : 'c',
|
|
pstate & PSR_AA32_V_BIT ? 'V' : 'v',
|
|
pstate & PSR_AA32_Q_BIT ? 'Q' : 'q',
|
|
pstate & PSR_AA32_T_BIT ? "T32" : "A32",
|
|
pstate & PSR_AA32_E_BIT ? "BE" : "LE",
|
|
pstate & PSR_AA32_A_BIT ? 'A' : 'a',
|
|
pstate & PSR_AA32_I_BIT ? 'I' : 'i',
|
|
pstate & PSR_AA32_F_BIT ? 'F' : 'f');
|
|
} else {
|
|
printk("pstate: %08llx (%c%c%c%c %c%c%c%c %cPAN %cUAO)\n",
|
|
pstate,
|
|
pstate & PSR_N_BIT ? 'N' : 'n',
|
|
pstate & PSR_Z_BIT ? 'Z' : 'z',
|
|
pstate & PSR_C_BIT ? 'C' : 'c',
|
|
pstate & PSR_V_BIT ? 'V' : 'v',
|
|
pstate & PSR_D_BIT ? 'D' : 'd',
|
|
pstate & PSR_A_BIT ? 'A' : 'a',
|
|
pstate & PSR_I_BIT ? 'I' : 'i',
|
|
pstate & PSR_F_BIT ? 'F' : 'f',
|
|
pstate & PSR_PAN_BIT ? '+' : '-',
|
|
pstate & PSR_UAO_BIT ? '+' : '-');
|
|
}
|
|
}
|
|
|
|
void __show_regs(struct pt_regs *regs)
|
|
{
|
|
int i, top_reg;
|
|
u64 lr, sp;
|
|
|
|
if (compat_user_mode(regs)) {
|
|
lr = regs->compat_lr;
|
|
sp = regs->compat_sp;
|
|
top_reg = 12;
|
|
} else {
|
|
lr = regs->regs[30];
|
|
sp = regs->sp;
|
|
top_reg = 29;
|
|
}
|
|
|
|
show_regs_print_info(KERN_DEFAULT);
|
|
print_pstate(regs);
|
|
|
|
if (!user_mode(regs)) {
|
|
printk("pc : %pS\n", (void *)regs->pc);
|
|
printk("lr : %pS\n", (void *)lr);
|
|
} else {
|
|
printk("pc : %016llx\n", regs->pc);
|
|
printk("lr : %016llx\n", lr);
|
|
}
|
|
|
|
printk("sp : %016llx\n", sp);
|
|
|
|
i = top_reg;
|
|
|
|
while (i >= 0) {
|
|
printk("x%-2d: %016llx ", i, regs->regs[i]);
|
|
i--;
|
|
|
|
if (i % 2 == 0) {
|
|
pr_cont("x%-2d: %016llx ", i, regs->regs[i]);
|
|
i--;
|
|
}
|
|
|
|
pr_cont("\n");
|
|
}
|
|
}
|
|
|
|
void show_regs(struct pt_regs * regs)
|
|
{
|
|
__show_regs(regs);
|
|
dump_backtrace(regs, NULL);
|
|
}
|
|
|
|
static void tls_thread_flush(void)
|
|
{
|
|
write_sysreg(0, tpidr_el0);
|
|
|
|
if (is_compat_task()) {
|
|
current->thread.uw.tp_value = 0;
|
|
|
|
/*
|
|
* We need to ensure ordering between the shadow state and the
|
|
* hardware state, so that we don't corrupt the hardware state
|
|
* with a stale shadow state during context switch.
|
|
*/
|
|
barrier();
|
|
write_sysreg(0, tpidrro_el0);
|
|
}
|
|
}
|
|
|
|
void flush_thread(void)
|
|
{
|
|
fpsimd_flush_thread();
|
|
tls_thread_flush();
|
|
flush_ptrace_hw_breakpoint(current);
|
|
}
|
|
|
|
void release_thread(struct task_struct *dead_task)
|
|
{
|
|
}
|
|
|
|
void arch_release_task_struct(struct task_struct *tsk)
|
|
{
|
|
fpsimd_release_task(tsk);
|
|
}
|
|
|
|
/*
|
|
* src and dst may temporarily have aliased sve_state after task_struct
|
|
* is copied. We cannot fix this properly here, because src may have
|
|
* live SVE state and dst's thread_info may not exist yet, so tweaking
|
|
* either src's or dst's TIF_SVE is not safe.
|
|
*
|
|
* The unaliasing is done in copy_thread() instead. This works because
|
|
* dst is not schedulable or traceable until both of these functions
|
|
* have been called.
|
|
*/
|
|
int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
|
|
{
|
|
if (current->mm)
|
|
fpsimd_preserve_current_state();
|
|
*dst = *src;
|
|
|
|
return 0;
|
|
}
|
|
|
|
asmlinkage void ret_from_fork(void) asm("ret_from_fork");
|
|
|
|
int copy_thread(unsigned long clone_flags, unsigned long stack_start,
|
|
unsigned long stk_sz, struct task_struct *p)
|
|
{
|
|
struct pt_regs *childregs = task_pt_regs(p);
|
|
|
|
memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context));
|
|
|
|
/*
|
|
* Unalias p->thread.sve_state (if any) from the parent task
|
|
* and disable discard SVE state for p:
|
|
*/
|
|
clear_tsk_thread_flag(p, TIF_SVE);
|
|
p->thread.sve_state = NULL;
|
|
|
|
/*
|
|
* In case p was allocated the same task_struct pointer as some
|
|
* other recently-exited task, make sure p is disassociated from
|
|
* any cpu that may have run that now-exited task recently.
|
|
* Otherwise we could erroneously skip reloading the FPSIMD
|
|
* registers for p.
|
|
*/
|
|
fpsimd_flush_task_state(p);
|
|
|
|
if (likely(!(p->flags & PF_KTHREAD))) {
|
|
*childregs = *current_pt_regs();
|
|
childregs->regs[0] = 0;
|
|
|
|
/*
|
|
* Read the current TLS pointer from tpidr_el0 as it may be
|
|
* out-of-sync with the saved value.
|
|
*/
|
|
*task_user_tls(p) = read_sysreg(tpidr_el0);
|
|
|
|
if (stack_start) {
|
|
if (is_compat_thread(task_thread_info(p)))
|
|
childregs->compat_sp = stack_start;
|
|
else
|
|
childregs->sp = stack_start;
|
|
}
|
|
|
|
/*
|
|
* If a TLS pointer was passed to clone (4th argument), use it
|
|
* for the new thread.
|
|
*/
|
|
if (clone_flags & CLONE_SETTLS)
|
|
p->thread.uw.tp_value = childregs->regs[3];
|
|
} else {
|
|
memset(childregs, 0, sizeof(struct pt_regs));
|
|
childregs->pstate = PSR_MODE_EL1h;
|
|
if (IS_ENABLED(CONFIG_ARM64_UAO) &&
|
|
cpus_have_const_cap(ARM64_HAS_UAO))
|
|
childregs->pstate |= PSR_UAO_BIT;
|
|
|
|
if (arm64_get_ssbd_state() == ARM64_SSBD_FORCE_DISABLE)
|
|
childregs->pstate |= PSR_SSBS_BIT;
|
|
|
|
p->thread.cpu_context.x19 = stack_start;
|
|
p->thread.cpu_context.x20 = stk_sz;
|
|
}
|
|
p->thread.cpu_context.pc = (unsigned long)ret_from_fork;
|
|
p->thread.cpu_context.sp = (unsigned long)childregs;
|
|
|
|
ptrace_hw_copy_thread(p);
|
|
|
|
return 0;
|
|
}
|
|
|
|
void tls_preserve_current_state(void)
|
|
{
|
|
*task_user_tls(current) = read_sysreg(tpidr_el0);
|
|
}
|
|
|
|
static void tls_thread_switch(struct task_struct *next)
|
|
{
|
|
tls_preserve_current_state();
|
|
|
|
if (is_compat_thread(task_thread_info(next)))
|
|
write_sysreg(next->thread.uw.tp_value, tpidrro_el0);
|
|
else if (!arm64_kernel_unmapped_at_el0())
|
|
write_sysreg(0, tpidrro_el0);
|
|
|
|
write_sysreg(*task_user_tls(next), tpidr_el0);
|
|
}
|
|
|
|
/* Restore the UAO state depending on next's addr_limit */
|
|
void uao_thread_switch(struct task_struct *next)
|
|
{
|
|
if (IS_ENABLED(CONFIG_ARM64_UAO)) {
|
|
if (task_thread_info(next)->addr_limit == KERNEL_DS)
|
|
asm(ALTERNATIVE("nop", SET_PSTATE_UAO(1), ARM64_HAS_UAO));
|
|
else
|
|
asm(ALTERNATIVE("nop", SET_PSTATE_UAO(0), ARM64_HAS_UAO));
|
|
}
|
|
}
|
|
|
|
/*
|
|
* We store our current task in sp_el0, which is clobbered by userspace. Keep a
|
|
* shadow copy so that we can restore this upon entry from userspace.
|
|
*
|
|
* This is *only* for exception entry from EL0, and is not valid until we
|
|
* __switch_to() a user task.
|
|
*/
|
|
DEFINE_PER_CPU(struct task_struct *, __entry_task);
|
|
|
|
static void entry_task_switch(struct task_struct *next)
|
|
{
|
|
__this_cpu_write(__entry_task, next);
|
|
}
|
|
|
|
/*
|
|
* Thread switching.
|
|
*/
|
|
__notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev,
|
|
struct task_struct *next)
|
|
{
|
|
struct task_struct *last;
|
|
|
|
fpsimd_thread_switch(next);
|
|
tls_thread_switch(next);
|
|
hw_breakpoint_thread_switch(next);
|
|
contextidr_thread_switch(next);
|
|
entry_task_switch(next);
|
|
uao_thread_switch(next);
|
|
|
|
/*
|
|
* Complete any pending TLB or cache maintenance on this CPU in case
|
|
* the thread migrates to a different CPU.
|
|
* This full barrier is also required by the membarrier system
|
|
* call.
|
|
*/
|
|
dsb(ish);
|
|
|
|
/* the actual thread switch */
|
|
last = cpu_switch_to(prev, next);
|
|
|
|
return last;
|
|
}
|
|
|
|
unsigned long get_wchan(struct task_struct *p)
|
|
{
|
|
struct stackframe frame;
|
|
unsigned long stack_page, ret = 0;
|
|
int count = 0;
|
|
if (!p || p == current || p->state == TASK_RUNNING)
|
|
return 0;
|
|
|
|
stack_page = (unsigned long)try_get_task_stack(p);
|
|
if (!stack_page)
|
|
return 0;
|
|
|
|
frame.fp = thread_saved_fp(p);
|
|
frame.pc = thread_saved_pc(p);
|
|
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
|
|
frame.graph = p->curr_ret_stack;
|
|
#endif
|
|
do {
|
|
if (unwind_frame(p, &frame))
|
|
goto out;
|
|
if (!in_sched_functions(frame.pc)) {
|
|
ret = frame.pc;
|
|
goto out;
|
|
}
|
|
} while (count ++ < 16);
|
|
|
|
out:
|
|
put_task_stack(p);
|
|
return ret;
|
|
}
|
|
|
|
unsigned long arch_align_stack(unsigned long sp)
|
|
{
|
|
if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
|
|
sp -= get_random_int() & ~PAGE_MASK;
|
|
return sp & ~0xf;
|
|
}
|
|
|
|
unsigned long arch_randomize_brk(struct mm_struct *mm)
|
|
{
|
|
if (is_compat_task())
|
|
return randomize_page(mm->brk, SZ_32M);
|
|
else
|
|
return randomize_page(mm->brk, SZ_1G);
|
|
}
|
|
|
|
/*
|
|
* Called from setup_new_exec() after (COMPAT_)SET_PERSONALITY.
|
|
*/
|
|
void arch_setup_new_exec(void)
|
|
{
|
|
current->mm->context.flags = is_compat_task() ? MMCF_AARCH32 : 0;
|
|
}
|