From patchwork Thu Jun 4 13:49:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Popov X-Patchwork-Id: 11588001 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 05DBF90 for ; Thu, 4 Jun 2020 13:50:45 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id CCEE620772 for ; Thu, 4 Jun 2020 13:50:44 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="T/oOdUVk" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CCEE620772 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=yX9V8DKf0BshFxahm8zzhiEGclTtggP/PLGaXNFhd3k=; b=T/oOdUVk41Jvrb +w+q4K1wjewCV1XWeu1pA0ahGv7vK1THIfV2q+2UUZB+gdqUSNIwrzDrwHHWAJqjbihVzrWCDNyfk pcuKQf2bvovENCkG6agMoD3YVhMdNy+ozyDUIY0Nlkv9/ESI8xQf24+Reu+H1blck7upesuHQz0Wz IF4ZIuE/IjEwsB4/n7dyjomYEJNul0hqzXH8LHu71wQkiNVNHOqQUIXIw0XxP746lO3Mxu+VUG/al QTOBNS8FS0lAkQTQyjM8EdY6Oo8JObfFIWlXplJ7IuapINgVRxYODJZ7ZsR+qW+Mkxpg0eMgy7ZUR Vqek9EWAer+CUllBUV6A==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jgqGZ-0006xH-Va; Thu, 04 Jun 2020 13:50:43 +0000 Received: from mail-lf1-f68.google.com ([209.85.167.68]) by bombadil.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1jgqGX-0006wW-3O for linux-arm-kernel@lists.infradead.org; Thu, 04 Jun 2020 13:50:42 +0000 Received: by mail-lf1-f68.google.com with SMTP id d7so3631827lfi.12 for ; Thu, 04 Jun 2020 06:50:39 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=9/mS/crSG/SbKgPicMind4lrkGlCDOUOSlUrNN+bfdo=; b=BWiK5F1W56JdGSx/3K/i4SzmHxwbEXbAJrpVoAnJjxhiDXYsk0uxUSnsfxhP0xO2NF wfl9+WvAqOEp5InZ0DNTV9IQctjUYVd17ms4utI3gbpErPFJR2FgeHS5ln0jcYXom6K2 4TWIlZeq3terbp9Pg8U7DNF8ueY3CUXuWGd/+n4K62rJhLhVOK6bXRoGbqhn+8z1lnGK reyhQUD60VGS4WNFlmOVbXPQM0zKWh4l+0tbFoVTmAkimVomqQ6OzmlHhQvAoz9Xa6LU jDTImzS9nNbxi9Tz/tGWyLzOXsrLgeMUJbWWFcjfEo8nawfTl4+/3CDz0owc7iuJ97ty g5EQ== X-Gm-Message-State: AOAM531oYXra+rW6VIeF+89sbuWhCiU07JglPR021I5XS7QjFbabPkEh kwr9VmMkA01wvBNUZr+ZU+M= X-Google-Smtp-Source: ABdhPJwrdWT6y2CL2LWAPgdgslvxxxcX+HXve/twLqm1KvVhxEovjWNPGDhPf/+ZcjY/tapJBcnulg== X-Received: by 2002:a05:6512:20d:: with SMTP id a13mr2649191lfo.36.1591278637579; Thu, 04 Jun 2020 06:50:37 -0700 (PDT) Received: from localhost.localdomain ([185.248.161.177]) by smtp.gmail.com with ESMTPSA id u16sm1202140lji.58.2020.06.04.06.50.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Jun 2020 06:50:36 -0700 (PDT) From: Alexander Popov To: Kees Cook , Emese Revfy , Miguel Ojeda , Masahiro Yamada , Michal Marek , Andrew Morton , Masahiro Yamada , Thiago Jung Bauermann , Luis Chamberlain , Jessica Yu , Sven Schnelle , Iurii Zaikin , Catalin Marinas , Will Deacon , Vincenzo Frascino , Thomas Gleixner , Peter Collingbourne , Naohiro Aota , Alexander Monakov , Mathias Krause , PaX Team , Brad Spengler , Laura Abbott , Florian Weimer , Alexander Popov , kernel-hardening@lists.openwall.com, linux-kbuild@vger.kernel.org, x86@kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, gcc@gcc.gnu.org Subject: [PATCH 0/5] Improvements of the stackleak gcc plugin Date: Thu, 4 Jun 2020 16:49:52 +0300 Message-Id: <20200604134957.505389-1-alex.popov@linux.com> X-Mailer: git-send-email 2.25.2 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200604_065041_139865_4B53A363 X-CRM114-Status: GOOD ( 11.24 ) X-Spam-Score: 0.7 (/) X-Spam-Report: SpamAssassin version 3.4.4 on bombadil.infradead.org summary: Content analysis details: (0.7 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [209.85.167.68 listed in list.dnswl.org] 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit [a13xp0p0v88[at]gmail.com] -0.0 SPF_PASS SPF: sender matches SPF record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [a13xp0p0v88[at]gmail.com] -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [209.85.167.68 listed in wl.mailspike.net] 0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom freemail headers are different X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: notify@kernel.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org In this patch series I collected various improvements of the stackleak gcc plugin. The first patch excludes alloca() from the stackleak instrumentation logic to make it simpler. The second patch is the main improvement. It eliminates an unwanted side-effect of kernel code instrumentation. This patch is a deep reengineering of the idea described on grsecurity blog: https://grsecurity.net/resolving_an_unfortunate_stackleak_interaction The third patch adds 'verbose' plugin parameter for printing additional info about the kernel code instrumentation. Two other patches disable unneeded stackleak instrumentation for some files. I would like to thank Alexander Monakov for his advisory on gcc internals. This patch series was tested for gcc version 4.8, 5, 6, 7, 8, 9, and 10 on x86_64, i386 and arm64. That was done using the project 'kernel-build-containers': https://github.com/a13xp0p0v/kernel-build-containers Alexander Popov (5): gcc-plugins/stackleak: Exclude alloca() from the instrumentation logic gcc-plugins/stackleak: Use asm instrumentation to avoid useless register saving gcc-plugins/stackleak: Add 'verbose' plugin parameter gcc-plugins/stackleak: Don't instrument itself gcc-plugins/stackleak: Don't instrument vgettimeofday.c in arm64 VDSO arch/arm64/kernel/vdso/Makefile | 3 +- include/linux/compiler_attributes.h | 13 ++ kernel/Makefile | 1 + kernel/stackleak.c | 16 +- scripts/Makefile.gcc-plugins | 2 + scripts/gcc-plugins/stackleak_plugin.c | 260 ++++++++++++++++++++----- 6 files changed, 232 insertions(+), 63 deletions(-)