From patchwork Tue Mar 30 20:57:45 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12173735 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-21.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 634B6C433DB for ; Tue, 30 Mar 2021 20:57:59 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id EE91C619D1 for ; Tue, 30 Mar 2021 20:57:58 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EE91C619D1 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E892B6B0080; Tue, 30 Mar 2021 16:57:55 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id DDE0D6B0085; Tue, 30 Mar 2021 16:57:55 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C0AA66B0080; Tue, 30 Mar 2021 16:57:55 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0247.hostedemail.com [216.40.44.247]) by kanga.kvack.org (Postfix) with ESMTP id 94B786B0085 for ; Tue, 30 Mar 2021 16:57:55 -0400 (EDT) Received: from smtpin36.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 5945B181AEF31 for ; Tue, 30 Mar 2021 20:57:55 +0000 (UTC) X-FDA: 77977752510.36.0731679 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by imf27.hostedemail.com (Postfix) with ESMTP id BB7A680192D9 for ; Tue, 30 Mar 2021 20:57:54 +0000 (UTC) Received: by mail-pj1-f44.google.com with SMTP id f2-20020a17090a4a82b02900c67bf8dc69so61170pjh.1 for ; Tue, 30 Mar 2021 13:57:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=9ijlYcKqhmRnIjh3GfaZu6VzSGgGwccaBk76YZfh88U=; b=FE7kn9uccaNwZUZ65DKIqMMeCF4L8T5uHj+6rAX1M16+hIAiROMPCoW0ANbpyvkauA zNm2OopXkQ6LAOsRPbIK640iKsOLSDOOggNsbZdq6eYIsT34pwdagUeVUvG7xjxhyCBj zo84r5YxnuOMKbimr0OM8w19pz/qkGBGzGeOI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9ijlYcKqhmRnIjh3GfaZu6VzSGgGwccaBk76YZfh88U=; b=S0S/XHsHLG63L4G288ycmbBKjq21TsEB5Br023d0IiYsew/KTlJL5I+OXMhlzVCLG9 3Xk9aCXPjViC8p1a9ugAyir0Ju8/NrDDLqmABUoZpwKgY3rkHHvNDCFm/Z13tis8Saiz ycfoJy1cuNWVzw7Y2r8LTFIP81/gxxJF/KcMI8nALWrsIjPldj876RYbd8pE0sL/Xgqz w/xYRoymhtBIuSiLNmQ/KrE7dGi0z5u+zN9Hsnk11nfzf6RXVIu5Tp6ZVf/FRrDxbl3/ zFdftcCOUWzXIhE8k7Pd3d3T2vhvPU1SfXScpKkqful4QH0TLDeQ9sfjslomB0Wci3HN PQZg== X-Gm-Message-State: AOAM532KGNOewbxm3xFXG/6akh/lxpkfF/lWBWyhY8rGlDNFmKT/oU9f QfOAOrpm8h3kZM18nMqsVZFuMQ== X-Google-Smtp-Source: ABdhPJxKiSYrHQGcEilxb2Xm7psWt7RDOXuAoFkC/UflndAY9YjgBstIUNwwje4/jGjMrGhbk14LkA== X-Received: by 2002:a17:90b:38f:: with SMTP id ga15mr170436pjb.149.1617137874107; Tue, 30 Mar 2021 13:57:54 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id w23sm106967pgi.63.2021.03.30.13.57.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 Mar 2021 13:57:53 -0700 (PDT) From: Kees Cook To: Thomas Gleixner Cc: Kees Cook , Peter Zijlstra , Elena Reshetova , x86@kernel.org, Andy Lutomirski , Catalin Marinas , Will Deacon , Mark Rutland , Alexander Potapenko , Alexander Popov , Ard Biesheuvel , Jann Horn , Vlastimil Babka , David Hildenbrand , Mike Rapoport , Andrew Morton , Jonathan Corbet , Randy Dunlap , kernel-hardening@lists.openwall.com, linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v8 1/6] jump_label: Provide CONFIG-driven build state defaults Date: Tue, 30 Mar 2021 13:57:45 -0700 Message-Id: <20210330205750.428816-2-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210330205750.428816-1-keescook@chromium.org> References: <20210330205750.428816-1-keescook@chromium.org> MIME-Version: 1.0 X-Patch-Hashes: v=1; h=sha256; g=aa54c44d1d71b9550d6015efc734f667917094a1; i=Vishx6UyAXwYzcnoSyP+eBB3iQyx+/i5smsbQfc0cnA=; m=vc4sSYlf+uaSlLSFP5TpbQv56VaSRpBLpRuMltXaB4Q=; p=mNH2Bo/K9vrGz9sBtTDV8UFO0eJ8yv8BbR/DeIaO1es= X-Patch-Sig: m=pgp; i=keescook@chromium.org; s=0x0x8972F4DFDC6DC026; b=iQIzBAABCgAdFiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAmBjkMwACgkQiXL039xtwCaWexAAp34 ok/GqKys22n/+Xt+9QrE/sBFj+uvgYjI14mqH/xkZoouYd5+myYJn0h/B8R83n48nwB7KdYtukzVv nSela//6I+ohCNhjgEt1TmUc81qTISl5q5mxbq/+IAPNVqlXEYCpTcSFkBbr5tbXOoOrbkI87vrja az8w6YyJGWbCBm/PpNK/FqvgxnWKMmJbomwDiBeWSgEfJUSD/M/r6PV1RhbK2mt7AniDqOPJ/oRG0 VB6GcbfW106hXfwKjmeqoce8yTv7YrC4mYL5sKA0yV/H62mmU9vkUtd+/0x07Cg1iXFAbg3bkDu/i hQkdH1ZBkjnjcWQJ6pvYBfHR+5Fblp8ibFwpPJc/hJmGkzxTde5pAlM3s4FMdtv++qD7bvL2tdXIS kzkw4HJRrjKMET9L3sAWvlSZgUTAip8wslmfIZUVea7HUy5ypoFIvSxHL5BNOGiTBp0zWwvXAzNt1 PTrOAP9fZKIsGI0Nj6laG2wpUdzjTpYcjfNxIPtygIIqheWGFwHwPYpWV0g8700cR/heR7qoBa0zt nrQX1WU7AUkaYROLg1QVWr13bMVlZZuDsSPfvsu3yo8alzHhY8xaryuKCwuTzY8ResHzU6XIqkmJb J1b8qCZ973eAn1T3KbVOk18YcqsShZ8C4SwIbyGOuesFrhes7bPZf/GqTx2MNcoU= X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: BB7A680192D9 X-Stat-Signature: ife7zacp1z5x9gg9jnunu8d3pehpher7 Received-SPF: none (chromium.org>: No applicable sender policy available) receiver=imf27; identity=mailfrom; envelope-from=""; helo=mail-pj1-f44.google.com; client-ip=209.85.216.44 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1617137874-145995 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: As shown in jump_label.h[1], choosing the initial state of static branches changes the assembly layout. If the condition is expected to be likely it's inline, and if unlikely it is out of line via a jump. A few places in the kernel use (or could be using) a CONFIG to choose the default state, which would give a small performance benefit to their compile-time declared default. Provide the infrastructure to do this. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/jump_label.h?h=v5.11#n398 Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/lkml/20200324220641.GT2452@worktop.programming.kicks-ass.net/ Signed-off-by: Kees Cook --- include/linux/jump_label.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h index d92691262f51..05f5554d860f 100644 --- a/include/linux/jump_label.h +++ b/include/linux/jump_label.h @@ -382,6 +382,21 @@ struct static_key_false { [0 ... (count) - 1] = STATIC_KEY_FALSE_INIT, \ } +#define _DEFINE_STATIC_KEY_1(name) DEFINE_STATIC_KEY_TRUE(name) +#define _DEFINE_STATIC_KEY_0(name) DEFINE_STATIC_KEY_FALSE(name) +#define DEFINE_STATIC_KEY_MAYBE(cfg, name) \ + __PASTE(_DEFINE_STATIC_KEY_, IS_ENABLED(cfg))(name) + +#define _DEFINE_STATIC_KEY_RO_1(name) DEFINE_STATIC_KEY_TRUE_RO(name) +#define _DEFINE_STATIC_KEY_RO_0(name) DEFINE_STATIC_KEY_FALSE_RO(name) +#define DEFINE_STATIC_KEY_MAYBE_RO(cfg, name) \ + __PASTE(_DEFINE_STATIC_KEY_RO_, IS_ENABLED(cfg))(name) + +#define _DECLARE_STATIC_KEY_1(name) DECLARE_STATIC_KEY_TRUE(name) +#define _DECLARE_STATIC_KEY_0(name) DECLARE_STATIC_KEY_FALSE(name) +#define DECLARE_STATIC_KEY_MAYBE(cfg, name) \ + __PASTE(_DECLARE_STATIC_KEY_, IS_ENABLED(cfg))(name) + extern bool ____wrong_branch_error(void); #define static_key_enabled(x) \ @@ -482,6 +497,10 @@ extern bool ____wrong_branch_error(void); #endif /* CONFIG_JUMP_LABEL */ +#define static_branch_maybe(config, x) \ + (IS_ENABLED(config) ? static_branch_likely(x) \ + : static_branch_unlikely(x)) + /* * Advanced usage; refcount, branch is enabled when: count != 0 */ From patchwork Tue Mar 30 20:57:46 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12173731 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A41C1C433C1 for ; Tue, 30 Mar 2021 20:57:56 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 279E7619CA for ; Tue, 30 Mar 2021 20:57:56 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 279E7619CA Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 7D6D76B0081; Tue, 30 Mar 2021 16:57:55 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7C3AF6B0083; Tue, 30 Mar 2021 16:57:55 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5EE236B0082; Tue, 30 Mar 2021 16:57:55 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0170.hostedemail.com [216.40.44.170]) by kanga.kvack.org (Postfix) with ESMTP id 3DF9A6B0080 for ; Tue, 30 Mar 2021 16:57:55 -0400 (EDT) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 03B028249980 for ; Tue, 30 Mar 2021 20:57:55 +0000 (UTC) X-FDA: 77977752510.24.D198997 Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by imf20.hostedemail.com (Postfix) with ESMTP id 8288CD6 for ; Tue, 30 Mar 2021 20:57:54 +0000 (UTC) Received: by mail-pg1-f172.google.com with SMTP id y32so11451122pga.11 for ; Tue, 30 Mar 2021 13:57:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=UG6lpZSAG8t+NfdJici9YkMGF34rxaYTMGPEmVDXXFs=; b=nAtL0yLEpjO2guyFAnk1UK8RCNVE817hSH2Q172t9upN0Y9DcHi4VPdazL0wXZjLfd xlHHSMBZWyFEw7jxyLinGl0JaLbvCqzWK4kVm5P+6y5xzoKJRTbfmuOnH8+1yQshwVQ8 emm1ECwHM5YtpWRAoVYZwoNNTFLms6VvWOqLU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=UG6lpZSAG8t+NfdJici9YkMGF34rxaYTMGPEmVDXXFs=; b=lub0g9iEu4VcaLtlHMrNOy8z0wrA/yyGE+/9QxF8OPjRaeHviNm1fpN5/44fzEOm8w 8RHqlLsV7lvvj/8bFPdTE+tU6hSxUfKRthsd7cdckU28i0neT36yP7CmBv9kf5vsDCxS KS5FZbcWJldnU3kapmfrw2SlMCRWKqwNA+l66IKvEAUAQ0kQ4TclT+w4LeRDRH1bMn1V 2qQ1S07LZin27bprdx2GHXP2mEJKfZV5fhbJlheU7JX/OZ6tlf5/uj3lneWXt5M3agQn nHNgLzmS44sO82/NyM1KdqS3X5+sRHtcn7RDK+0rnIwuhO0AwR3swpSBVc+YQBM26x40 G0NA== X-Gm-Message-State: AOAM530zt3zykxfPI6+0PSqM1SKMi5+hOFtxOy/0OAJZy8FM4sU8/qpd L5XknVxi2kZHMWUcpaU14ZA3ig== X-Google-Smtp-Source: ABdhPJz3LXv4eDOhFhF6lIjzHku5IEzcEABiR69AQC5cXMNAv6qJ/s1o3KIyukaQCofHm60NmmHgeA== X-Received: by 2002:a62:8fcd:0:b029:218:461:2279 with SMTP id n196-20020a628fcd0000b029021804612279mr31460592pfd.43.1617137873522; Tue, 30 Mar 2021 13:57:53 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id y12sm21247503pfq.118.2021.03.30.13.57.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 Mar 2021 13:57:52 -0700 (PDT) From: Kees Cook To: Thomas Gleixner Cc: Kees Cook , Alexander Potapenko , Vlastimil Babka , Elena Reshetova , x86@kernel.org, Andy Lutomirski , Peter Zijlstra , Catalin Marinas , Will Deacon , Mark Rutland , Alexander Popov , Ard Biesheuvel , Jann Horn , David Hildenbrand , Mike Rapoport , Andrew Morton , Jonathan Corbet , Randy Dunlap , kernel-hardening@lists.openwall.com, linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v8 2/6] init_on_alloc: Optimize static branches Date: Tue, 30 Mar 2021 13:57:46 -0700 Message-Id: <20210330205750.428816-3-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210330205750.428816-1-keescook@chromium.org> References: <20210330205750.428816-1-keescook@chromium.org> MIME-Version: 1.0 X-Patch-Hashes: v=1; h=sha256; g=2f4b59272e09d0180c87e3d8378d95ea375990ec; i=7VrM8Pzr5MGi8vAaDOW4xeiDtVYbjHgJsdLlT/sxDXE=; m=OLLKLAHsfNT1d7+pflxMGJuAvSt8GZaetKIXzfk0ilc=; p=cKq4RSNZSRZ+ASTC07w37jURMQB1hxGsdgqU07adDH0= X-Patch-Sig: m=pgp; i=keescook@chromium.org; s=0x0x8972F4DFDC6DC026; b=iQIzBAABCgAdFiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAmBjkMwACgkQiXL039xtwCZc3RAAneZ W9nsrEVAJu/2EM9W3eP/wNa9JCKIEGXsfdWDWQPPeCbpGDVnJgSVyjiCWUFr4tej6kSR2JcjNkDtk RamMPpNcmIBTAEQZCMJvmrtcKW1IDd/OGeQba5IsPM2+nzcu7TIihfbnaOaO007hiw5q0lN0dy6Vz INq699xnV4EDdLtYeikcR+yHjgF9BrTpVkRdUUD05riIM5MKdp1bCEELMVGvRNofeTRfnTwGW+P08 L8DpSkB+4LmS285BqK0bLDrBFkIlT32vvQmNur8jFep9Yddh2uApO3GfmkatNKXr2pZhthk9ylXAt oLYfDTHsftsgfeBeeCgYWbz52VxjzKw2QlqYy98p2kmLbSWjhZs+mnMvjUfTsHk3tE8pULROEkkxQ EYBq2yGgZCxW/DplktGsnIw2+IuXr5ZVmszBhCU7fjdfnuUpGieeboPgZ3bsyFyLCg5COu0WaMU2k NqhLH42LJzP9w7bvvdccxuPX4DwZjsue4iDmmZgYnWCq20wHcbjVquMuhe5+Z4iMSYCe12rKUT8mh qYDodBX6u5xZgbfJp+x144gtPE89shG9i69yAXKWgC/kRl/en7wYjeg0utnlpYkc+Vg0Oe3I5Jkfs TmEtbMUzu1eA1785dXZn5CS1UZL6KK1W57w5r0f3u7y/IwvVYp1i1NAnZT/lq1BQ= X-Rspamd-Queue-Id: 8288CD6 X-Stat-Signature: 6afjprqagmc5z3tqctrwd9yxb3onn831 X-Rspamd-Server: rspam02 Received-SPF: none (chromium.org>: No applicable sender policy available) receiver=imf20; identity=mailfrom; envelope-from=""; helo=mail-pg1-f172.google.com; client-ip=209.85.215.172 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1617137874-378073 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The state of CONFIG_INIT_ON_ALLOC_DEFAULT_ON (and ...ON_FREE...) did not change the assembly ordering of the static branches: they were always out of line. Use the new jump_label macros to check the CONFIG settings to default to the "expected" state, which slightly optimizes the resulting assembly code. Reviewed-by: Alexander Potapenko Link: https://lore.kernel.org/lkml/CAG_fn=X0DVwqLaHJTO6Jw7TGcMSm77GKHinrd0m_6y0SzWOrFA@mail.gmail.com/ Acked-by: Vlastimil Babka Link: https://lore.kernel.org/lkml/5d626b9b-5355-be94-e8e2-1be47f880f30@suse.cz Signed-off-by: Kees Cook --- include/linux/mm.h | 10 ++++++---- mm/page_alloc.c | 4 ++-- mm/slab.h | 6 ++++-- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 77e64e3eac80..2ccd856ac0d1 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2871,18 +2871,20 @@ static inline void kernel_poison_pages(struct page *page, int numpages) { } static inline void kernel_unpoison_pages(struct page *page, int numpages) { } #endif -DECLARE_STATIC_KEY_FALSE(init_on_alloc); +DECLARE_STATIC_KEY_MAYBE(CONFIG_INIT_ON_ALLOC_DEFAULT_ON, init_on_alloc); static inline bool want_init_on_alloc(gfp_t flags) { - if (static_branch_unlikely(&init_on_alloc)) + if (static_branch_maybe(CONFIG_INIT_ON_ALLOC_DEFAULT_ON, + &init_on_alloc)) return true; return flags & __GFP_ZERO; } -DECLARE_STATIC_KEY_FALSE(init_on_free); +DECLARE_STATIC_KEY_MAYBE(CONFIG_INIT_ON_FREE_DEFAULT_ON, init_on_free); static inline bool want_init_on_free(void) { - return static_branch_unlikely(&init_on_free); + return static_branch_maybe(CONFIG_INIT_ON_FREE_DEFAULT_ON, + &init_on_free); } extern bool _debug_pagealloc_enabled_early; diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 3e4b29ee2b1e..267c04b8911d 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -167,10 +167,10 @@ unsigned long totalcma_pages __read_mostly; int percpu_pagelist_fraction; gfp_t gfp_allowed_mask __read_mostly = GFP_BOOT_MASK; -DEFINE_STATIC_KEY_FALSE(init_on_alloc); +DEFINE_STATIC_KEY_MAYBE(CONFIG_INIT_ON_ALLOC_DEFAULT_ON, init_on_alloc); EXPORT_SYMBOL(init_on_alloc); -DEFINE_STATIC_KEY_FALSE(init_on_free); +DEFINE_STATIC_KEY_MAYBE(CONFIG_INIT_ON_FREE_DEFAULT_ON, init_on_free); EXPORT_SYMBOL(init_on_free); static bool _init_on_alloc_enabled_early __read_mostly diff --git a/mm/slab.h b/mm/slab.h index 076582f58f68..774c7221efdc 100644 --- a/mm/slab.h +++ b/mm/slab.h @@ -601,7 +601,8 @@ static inline void cache_random_seq_destroy(struct kmem_cache *cachep) { } static inline bool slab_want_init_on_alloc(gfp_t flags, struct kmem_cache *c) { - if (static_branch_unlikely(&init_on_alloc)) { + if (static_branch_maybe(CONFIG_INIT_ON_ALLOC_DEFAULT_ON, + &init_on_alloc)) { if (c->ctor) return false; if (c->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)) @@ -613,7 +614,8 @@ static inline bool slab_want_init_on_alloc(gfp_t flags, struct kmem_cache *c) static inline bool slab_want_init_on_free(struct kmem_cache *c) { - if (static_branch_unlikely(&init_on_free)) + if (static_branch_maybe(CONFIG_INIT_ON_FREE_DEFAULT_ON, + &init_on_free)) return !(c->ctor || (c->flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON))); return false; From patchwork Tue Mar 30 20:57:48 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12173737 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86E4CC433C1 for ; Tue, 30 Mar 2021 20:58:01 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 148E3619CB for ; Tue, 30 Mar 2021 20:58:01 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 148E3619CB Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 4B98F6B0083; Tue, 30 Mar 2021 16:57:57 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 46A0C6B0085; Tue, 30 Mar 2021 16:57:57 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1D21F6B0087; Tue, 30 Mar 2021 16:57:57 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0205.hostedemail.com [216.40.44.205]) by kanga.kvack.org (Postfix) with ESMTP id E58CC6B0083 for ; Tue, 30 Mar 2021 16:57:56 -0400 (EDT) Received: from smtpin31.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 9F1DB181AEF31 for ; Tue, 30 Mar 2021 20:57:56 +0000 (UTC) X-FDA: 77977752552.31.4A810B1 Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) by imf01.hostedemail.com (Postfix) with ESMTP id D9DEC5001522 for ; Tue, 30 Mar 2021 20:57:55 +0000 (UTC) Received: by mail-pf1-f179.google.com with SMTP id v10so7627109pfn.5 for ; Tue, 30 Mar 2021 13:57:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=s7qD72PIIaKegCCfwDbGOQmh3vj9ZS1vEx5gz0J99Lg=; b=lGXEvcGvGErmybYZADN9M9vTPSUkuTyHObRGJdImdyjpniegEiRCqNXNuKcfv+NZFO N+oV9d2k2SnKMxRgXkmxzo8dDebK3nVnnQ5Q8P5TFtSSMDWaJcYW5IXBc8Cv2KnGqNUt 83luJIQTk8q/BV7nZGYGpNRlKsYobxW9FikB8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=s7qD72PIIaKegCCfwDbGOQmh3vj9ZS1vEx5gz0J99Lg=; b=YSEy5XG3NehItay9wYYGPhF8BYmq0JKh4K9poy3NNF3MlDv7Zq9UpSzDWm4a0vVou6 RrIpdd9GP8z3oGRuJD19LGma/L9RlSVVORUAljePj1OJYtRd+6zB8WMzoxXLLqJ7BwOO l757f4z7xze01f3sdebhLmII8BG/rOts9bachtY8ts6/ITtKA3ccYGom1+n92yGRu0ga 65c1LD37lU9apHzOQJ+Q3JtdkCRjBn10z89BmiikwsDH9fOK+ZrhoSZzqNVtvsXiRKM6 eOmlxrD8Pd1vb1stVGnlCjKfSa0Bt4MEhrk/r7koR1pOGlDUEsQ37cPGroUF7zs9fjtB MFdw== X-Gm-Message-State: AOAM533mcb9+wve4dO42wOvwiIGxERYZoihPgJT+qRI8FtKHcIcjjsgp vryCOGu1p8Odb/gvM2+mTPUQcw== X-Google-Smtp-Source: ABdhPJxIlv/t8e+htb3eFAk1lSzIuiuO94bDCDl9IP1whq6yq56Qms3/b5dJBu6a1Z6nXeAy/BZ/nA== X-Received: by 2002:a63:338b:: with SMTP id z133mr38473pgz.442.1617137875416; Tue, 30 Mar 2021 13:57:55 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id d17sm13938653pfn.60.2021.03.30.13.57.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 Mar 2021 13:57:53 -0700 (PDT) From: Kees Cook To: Thomas Gleixner Cc: Kees Cook , Elena Reshetova , x86@kernel.org, Andy Lutomirski , Peter Zijlstra , Catalin Marinas , Will Deacon , Mark Rutland , Alexander Potapenko , Alexander Popov , Ard Biesheuvel , Jann Horn , Vlastimil Babka , David Hildenbrand , Mike Rapoport , Andrew Morton , Jonathan Corbet , Randy Dunlap , kernel-hardening@lists.openwall.com, linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v8 4/6] x86/entry: Enable random_kstack_offset support Date: Tue, 30 Mar 2021 13:57:48 -0700 Message-Id: <20210330205750.428816-5-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210330205750.428816-1-keescook@chromium.org> References: <20210330205750.428816-1-keescook@chromium.org> MIME-Version: 1.0 X-Patch-Hashes: v=1; h=sha256; g=5ebd0a02df09ef237ee07421c9f73e94deeaf170; i=np7yed3mY+gWIWkexmB7CyDLgwsIh0xV2RGaksJc7tI=; m=cc9SLz8pm+mdXOKZLHtRjH7FITDzwHCOKmwFrX1p7io=; p=EuIQlileJ2PUD6W0Q1r2arSRAFiVT/zqDgDnM3BVsdE= X-Patch-Sig: m=pgp; i=keescook@chromium.org; s=0x0x8972F4DFDC6DC026; b=iQIzBAABCgAdFiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAmBjkMwACgkQiXL039xtwCam+BAAgyJ fgr3/nTqZn/eYQhhvKuViaCBZLo6l/+H4rxQlTvedji1wqc8cEH1sbGhPpbetwvdv1E5URzjuzmHj KdNMLLG9GNPC46Kj+wXSF6TYDAjM5cN5/gDYo4VtCaToL0CpKQ7ckFQaxaTmeU0fNlFfPSnuB7lkI CiMSuRjNVKM0shhpfIRhpcbrf4pKGtVEI6S2q/Gbf8E9b9CqMBuY6Emsp+RP+E5pIV3MWV+/lWBzW nvw3ooLNtPE4eIIi144Y2qrQIg6kLUEm6bQcJNJ3P5Sl8tPGjpGmC6Na5y+jkQhGtJa8xw8iigpd8 0U/JPVq7sNUY3cC2zuUxjCQndMGeEMC5pqmPYVD5r5EfzWdLjVpna6rY1uIHVjapxIqa47C0SRTR4 5IVkd5ixH0ZqAvdCg7Kmse+MVEFltJ84/dvtt1jVcWTSD810k5uamerLnqHhOTMjxBl870hd23zNW hbNqvHuR9jfFcRe//CAXRojf+E0OfMXwE59pfcMCu+Bd2yJHWaVTzfom6Evz+EH+l/IKLU5TF+fEJ urdE7yT5Eyh8VgMnbExQG1evQIv9UuJeZaNZyqYOT3vycXyscwFxWh3hWDSlYRY7tyBdNfAqe+3U7 o/s2Y+ekI0WlMnWK52ZRX2sTdctKAo9wnnsvddL51SJw6DgLEPu9zjHET5nmRGG4= X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: D9DEC5001522 X-Stat-Signature: udx4hmsih7fstxcon6nz7qbox7oy673j Received-SPF: none (chromium.org>: No applicable sender policy available) receiver=imf01; identity=mailfrom; envelope-from=""; helo=mail-pf1-f179.google.com; client-ip=209.85.210.179 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1617137875-962642 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Allow for a randomized stack offset on a per-syscall basis, with roughly 5-6 bits of entropy, depending on compiler and word size. Since the method of offsetting uses macros, this cannot live in the common entry code (the stack offset needs to be retained for the life of the syscall, which means it needs to happen at the actual entry point). Signed-off-by: Kees Cook Reviewed-by: Thomas Gleixner --- arch/x86/Kconfig | 1 + arch/x86/entry/common.c | 3 +++ arch/x86/include/asm/entry-common.h | 16 ++++++++++++++++ 3 files changed, 20 insertions(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 2792879d398e..4b4ad8ec10d2 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -165,6 +165,7 @@ config X86 select HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD if X86_64 select HAVE_ARCH_USERFAULTFD_WP if X86_64 && USERFAULTFD select HAVE_ARCH_VMAP_STACK if X86_64 + select HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET select HAVE_ARCH_WITHIN_STACK_FRAMES select HAVE_ASM_MODVERSIONS select HAVE_CMPXCHG_DOUBLE diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c index a2433ae8a65e..810983d7c26f 100644 --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -38,6 +38,7 @@ #ifdef CONFIG_X86_64 __visible noinstr void do_syscall_64(unsigned long nr, struct pt_regs *regs) { + add_random_kstack_offset(); nr = syscall_enter_from_user_mode(regs, nr); instrumentation_begin(); @@ -83,6 +84,7 @@ __visible noinstr void do_int80_syscall_32(struct pt_regs *regs) { unsigned int nr = syscall_32_enter(regs); + add_random_kstack_offset(); /* * Subtlety here: if ptrace pokes something larger than 2^32-1 into * orig_ax, the unsigned int return value truncates it. This may @@ -102,6 +104,7 @@ static noinstr bool __do_fast_syscall_32(struct pt_regs *regs) unsigned int nr = syscall_32_enter(regs); int res; + add_random_kstack_offset(); /* * This cannot use syscall_enter_from_user_mode() as it has to * fetch EBP before invoking any of the syscall entry work diff --git a/arch/x86/include/asm/entry-common.h b/arch/x86/include/asm/entry-common.h index 2b87b191b3b8..14ebd2196569 100644 --- a/arch/x86/include/asm/entry-common.h +++ b/arch/x86/include/asm/entry-common.h @@ -2,6 +2,7 @@ #ifndef _ASM_X86_ENTRY_COMMON_H #define _ASM_X86_ENTRY_COMMON_H +#include #include #include @@ -70,6 +71,21 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs, */ current_thread_info()->status &= ~(TS_COMPAT | TS_I386_REGS_POKED); #endif + + /* + * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), + * but not enough for x86 stack utilization comfort. To keep + * reasonable stack head room, reduce the maximum offset to 8 bits. + * + * The actual entropy will be further reduced by the compiler when + * applying stack alignment constraints (see cc_stack_align4/8 in + * arch/x86/Makefile), which will remove the 3 (x86_64) or 2 (ia32) + * low bits from any entropy chosen here. + * + * Therefore, final stack offset entropy will be 5 (x86_64) or + * 6 (ia32) bits. + */ + choose_random_kstack_offset(rdtsc() & 0xFF); } #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare From patchwork Tue Mar 30 20:57:49 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12173741 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D822DC433E1 for ; Tue, 30 Mar 2021 20:58:05 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 736C3619CA for ; Tue, 30 Mar 2021 20:58:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 736C3619CA Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D93F06B0085; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CF52C6B0088; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A351E6B008A; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0251.hostedemail.com [216.40.44.251]) by kanga.kvack.org (Postfix) with ESMTP id 66AEA6B0085 for ; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 2EE788249980 for ; Tue, 30 Mar 2021 20:57:58 +0000 (UTC) X-FDA: 77977752636.06.F768BC5 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) by imf07.hostedemail.com (Postfix) with ESMTP id 8DBA0A0003A2 for ; Tue, 30 Mar 2021 20:57:57 +0000 (UTC) Received: by mail-pj1-f50.google.com with SMTP id q6-20020a17090a4306b02900c42a012202so83027pjg.5 for ; Tue, 30 Mar 2021 13:57:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dHwr6OVFfk7s7Yw8a90FyZmnLv02IEGSs6EhbG8UN8M=; b=hlWyqrrdivPvUsK2urCX5gbrxgHLV4EYIBS2FOfT0y3D/wpHPrKrvmLaAL5Yl6MNe7 s8xQY60zPWjczFajqojxMdNTb+YVRWOmxbrkyFleNzk2fZr+gpe5pyPWLdMQx1C0pFPg odydi07JBlH01reKlWGYNqcTIdZo3NMmPvWCE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dHwr6OVFfk7s7Yw8a90FyZmnLv02IEGSs6EhbG8UN8M=; b=stSYEdS1898d2XZGnG+nbgF8uBrdXFundLs3XfNTuZ9A2GrmMLcUCY3OKMlCrgnrZq E4GrALu8ZW3QlAiVfJIHFmc9t7LkL/0SdwTZt2y7M+SD4SYXkJyo+xZxZ1DdjrsoQsuK 44w4cG90V9NL3Y3aIvL6wd+BMbqEvHjWgWIa0SxDVDCtuSO/Q1PkycyKNrYhUkHg4GZX XLp67DPXxIinbA+SsPfQjb10+6wcBHqyTLVqSrC6Hzq4e/JfezyhAd85QGyYsmdadYv1 2VLdpVUVfx/3Y72ONOT0FCDaDZH32TapdG10rd/sknSr2VyQA648Kw7SNJ8XUUPzJZqM zRPA== X-Gm-Message-State: AOAM5312J6D9lVfbGjV+B52KID6XSxFi3Z2uEyB2dZharRCZKD8ImVdN MfdbdZcDibsUSoMKyGY+8U0ACQ== X-Google-Smtp-Source: ABdhPJylAI9yxAoBrtRs4JyfT9rDF2n0nHOzw2dYUFJTY/UD7TWKY70QYv/FPZ+e1PRlkr1nagTnQQ== X-Received: by 2002:a17:90a:f184:: with SMTP id bv4mr181607pjb.43.1617137876881; Tue, 30 Mar 2021 13:57:56 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id mp19sm7171048pjb.2.2021.03.30.13.57.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 Mar 2021 13:57:55 -0700 (PDT) From: Kees Cook To: Thomas Gleixner Cc: Kees Cook , Elena Reshetova , x86@kernel.org, Andy Lutomirski , Peter Zijlstra , Catalin Marinas , Will Deacon , Mark Rutland , Alexander Potapenko , Alexander Popov , Ard Biesheuvel , Jann Horn , Vlastimil Babka , David Hildenbrand , Mike Rapoport , Andrew Morton , Jonathan Corbet , Randy Dunlap , kernel-hardening@lists.openwall.com, linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v8 5/6] arm64: entry: Enable random_kstack_offset support Date: Tue, 30 Mar 2021 13:57:49 -0700 Message-Id: <20210330205750.428816-6-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210330205750.428816-1-keescook@chromium.org> References: <20210330205750.428816-1-keescook@chromium.org> MIME-Version: 1.0 X-Patch-Hashes: v=1; h=sha256; g=248270d6e87ad6ffcee20e448a3bbf6614f92c8d; i=6FjHrMJQ1a03WxuPiMt8aIK5MW/T0bayLG0SuUm7Wt4=; m=DW/OKOjAEidoxl6ODEV6zN0c7U/uCvK1t/uZsIkKPaM=; p=nb+ZCQAESoMtgqRKEEjn/wowCv7zZGeRTSUAEFbjSEQ= X-Patch-Sig: m=pgp; i=keescook@chromium.org; s=0x0x8972F4DFDC6DC026; b=iQIzBAABCgAdFiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAmBjkM0ACgkQiXL039xtwCaO6Q//aar 6eVN//dg/fHBNLu2Gxap4jQwEL4B/h8LTF1EJJl+k981UHFhnFIYt8oW893e2NxbM0D1e845pN6po JTH0/kJzFiX5epyMsOKxIez20UlQsvmuATkeG7Ps6g+nXIpo54Sh/isnkNMV+NlQ6FZKtmP2/CCXm gXQgeCZJbD5ospCgiwZ5S16NR8Z5x1lzFOh11lCBjULCcG/OSLleoyWdadpnTa0bPjxQ9gIHBDxZE 5ufEVIEM9MmBAoE/UjxYyuIHROQGSdkwQMjfFM64hKOBM0E2+f8uxt0aNwxTWrdl/hwJCKzRP7f/0 LLqb3h825YDdfUxRySjRg66bDXL9j210YtIT1LoXaNcYEC9YR/+KE8ojXkZfi0K9/T4bETedLdhy2 EMNyu7LBrGoghShBmB7+hgMZisZBQvi99S6yGrQx+ZewJlYFlOCfLDUSJle4Cq1d2yZzj0NF9xUDI o/7+0luGZgIrHjoa7jpd9ckdrEFzCjOMrwZ9E2TsOkEVeL/MQlFa2Bndcgl2DkmCmk/dI9VcS+to1 O5NsZSB+oYVwZpg4MWLlEzE+g781nqeZbke/Is3MfFGqn3hHgC39raKe1uUPIyzh7ae5YMSB/v0So COf7PQUrybaOrXlDmivGjp0mfAhxQ2fngtrT32UEvGeLivm3olP9QbeCfmRKzbtY= X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 8DBA0A0003A2 X-Stat-Signature: z3bz6fju3hzwxgp4nfwyhitca15regd9 Received-SPF: none (chromium.org>: No applicable sender policy available) receiver=imf07; identity=mailfrom; envelope-from=""; helo=mail-pj1-f50.google.com; client-ip=209.85.216.50 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1617137877-390849 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Allow for a randomized stack offset on a per-syscall basis, with roughly 5 bits of entropy. (And include AAPCS rationale AAPCS thanks to Mark Rutland.) In order to avoid unconditional stack canaries on syscall entry (due to the use of alloca()), also disable stack protector to avoid triggering needless checks and slowing down the entry path. As there is no general way to control stack protector coverage with a function attribute[1], this must be disabled at the compilation unit level. This isn't a problem here, though, since stack protector was not triggered before: examining the resulting syscall.o, there are no changes in canary coverage (none before, none now). [1] a working __attribute__((no_stack_protector)) has been added to GCC and Clang but has not been released in any version yet: https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=346b302d09c1e6db56d9fe69048acb32fbb97845 https://reviews.llvm.org/rG4fbf84c1732fca596ad1d6e96015e19760eb8a9b Signed-off-by: Kees Cook --- arch/arm64/Kconfig | 1 + arch/arm64/kernel/Makefile | 5 +++++ arch/arm64/kernel/syscall.c | 16 ++++++++++++++++ 3 files changed, 22 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 1f212b47a48a..2d0e5f544429 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -146,6 +146,7 @@ config ARM64 select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT select HAVE_ARCH_PFN_VALID select HAVE_ARCH_PREL32_RELOCATIONS + select HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET select HAVE_ARCH_SECCOMP_FILTER select HAVE_ARCH_STACKLEAK select HAVE_ARCH_THREAD_STRUCT_WHITELIST diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index ed65576ce710..6cc97730790e 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -9,6 +9,11 @@ CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_insn.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_return_address.o = $(CC_FLAGS_FTRACE) +# Remove stack protector to avoid triggering unneeded stack canary +# checks due to randomize_kstack_offset. +CFLAGS_REMOVE_syscall.o = -fstack-protector -fstack-protector-strong +CFLAGS_syscall.o += -fno-stack-protector + # Object file lists. obj-y := debug-monitors.o entry.o irq.o fpsimd.o \ entry-common.o entry-fpsimd.o process.o ptrace.o \ diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c index b9cf12b271d7..263d6c1a525f 100644 --- a/arch/arm64/kernel/syscall.c +++ b/arch/arm64/kernel/syscall.c @@ -5,6 +5,7 @@ #include #include #include +#include #include #include @@ -43,6 +44,8 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno, { long ret; + add_random_kstack_offset(); + if (scno < sc_nr) { syscall_fn_t syscall_fn; syscall_fn = syscall_table[array_index_nospec(scno, sc_nr)]; @@ -55,6 +58,19 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno, ret = lower_32_bits(ret); regs->regs[0] = ret; + + /* + * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), + * but not enough for arm64 stack utilization comfort. To keep + * reasonable stack head room, reduce the maximum offset to 9 bits. + * + * The actual entropy will be further reduced by the compiler when + * applying stack alignment constraints: the AAPCS mandates a + * 16-byte (i.e. 4-bit) aligned SP at function boundaries. + * + * The resulting 5 bits of entropy is seen in SP[8:4]. + */ + choose_random_kstack_offset(get_random_int() & 0x1FF); } static inline bool has_syscall_work(unsigned long flags) From patchwork Tue Mar 30 20:57:50 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12173739 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7EE8C433DB for ; Tue, 30 Mar 2021 20:58:03 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 772CD619CA for ; Tue, 30 Mar 2021 20:58:03 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 772CD619CA Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 818CD6B0087; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 701F46B0089; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 443776B0088; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0150.hostedemail.com [216.40.44.150]) by kanga.kvack.org (Postfix) with ESMTP id 19FE86B0085 for ; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id C0B905821 for ; Tue, 30 Mar 2021 20:57:57 +0000 (UTC) X-FDA: 77977752594.27.DD775CB Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) by imf25.hostedemail.com (Postfix) with ESMTP id 8FD936000106 for ; Tue, 30 Mar 2021 20:57:56 +0000 (UTC) Received: by mail-pf1-f176.google.com with SMTP id s11so6917834pfm.1 for ; Tue, 30 Mar 2021 13:57:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=uk0/1LocoDticB91SF6FsgWpOKPsEr1Pb6N+E6L28KI=; b=VEbugQSfiOADsXzibGQhy5NOUchekygaO5w+6aKv6mqyA4ZN905sZ3owmH5AiDEAWr y1WGVRmoaiaTXLZw321i7qk6pkHyhNFc2ebrQQ9viIxgTTISjvfl3iT2WLVNayRJuoPG sJuIKeFRY9nWrNFtLzOixlEPRhRvLB5pYBi6Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=uk0/1LocoDticB91SF6FsgWpOKPsEr1Pb6N+E6L28KI=; b=QGufS/gXbFbXIqzKzy92w+Qz+QYliVYhn6Nsr+jjpsbi4Y9/Ffjz8+oa+h5B6Ooxrs voz60X7AvZMmQwa+LIjrP142KYIp38lWTjZUAj3OTnfANRHKc6un5YpfYmYmBi1u5wod OfaqqL92UGeqelm07CuEet+eWUyd4zbFIpHSJNK/DUgHlKVknaHBsWe96mYWZxEzcjqD YW+HySfL53LzyDYo9HmbunNvtSLySxr6gls/lLdlr84+yoSoNztVqgjOS06U1Y86nlgq xBpyIMoo5ou92gmc/sul/O1ROOrVf0Rxe4KYy2XTtynsg3EWD5RTafXvsOlxfxHwX5MF wFxw== X-Gm-Message-State: AOAM532AGj19/cm+2itex9tZLTwshJCbnNynEP+gS1nw7xAPbLYpEtbe LMKinfhqdIYtm3RpbSor1K4BOg== X-Google-Smtp-Source: ABdhPJyU4QoLUAtSD+TbLRFmZhWwHD39ZMTbzgcT3JSLcSiG1GLO7ZUHccc4rKehrDRN8oWr8gFqDA== X-Received: by 2002:a63:5444:: with SMTP id e4mr38308pgm.426.1617137876539; Tue, 30 Mar 2021 13:57:56 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id 82sm21209086pfv.19.2021.03.30.13.57.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 Mar 2021 13:57:55 -0700 (PDT) From: Kees Cook To: Thomas Gleixner Cc: Kees Cook , Elena Reshetova , x86@kernel.org, Andy Lutomirski , Peter Zijlstra , Catalin Marinas , Will Deacon , Mark Rutland , Alexander Potapenko , Alexander Popov , Ard Biesheuvel , Jann Horn , Vlastimil Babka , David Hildenbrand , Mike Rapoport , Andrew Morton , Jonathan Corbet , Randy Dunlap , kernel-hardening@lists.openwall.com, linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v8 6/6] lkdtm: Add REPORT_STACK for checking stack offsets Date: Tue, 30 Mar 2021 13:57:50 -0700 Message-Id: <20210330205750.428816-7-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210330205750.428816-1-keescook@chromium.org> References: <20210330205750.428816-1-keescook@chromium.org> MIME-Version: 1.0 X-Patch-Hashes: v=1; h=sha256; g=fb815901a1ccc1d9c4ca5c3e3cd3729b7f382fe2; i=b69wRsxT78r/3tM1mGa7N6ME6+rlXyFg15giRWRwPAQ=; m=aFqgiEE+nAZdug79A1F+fVTg9ZceUb0WPE8cbHqssVg=; p=ZQ32/kILkW5AD3nBZHO0VMTp4prIPkm7+DdhCHX8KdA= X-Patch-Sig: m=pgp; i=keescook@chromium.org; s=0x0x8972F4DFDC6DC026; b=iQIzBAABCgAdFiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAmBjkM0ACgkQiXL039xtwCYfLRAAs6I uoWwWDp21BaGNMZo2SuY7bzLTQ4wBsh1OJpZI9l3CnXGSdw3rjz7jQr547uKC02JBkmMzEZ8erZZc OXm9KVlfJUxNAf1Xj1ZCOTuB3x9+E+0QA7hUMrZqjcs42ZBPBNkSPjV9A25U9YqznQ5f+qpoKAWEj hxxEXcX+z7qRe6bJas/EC7OMxjIrCaX9Fzf9HOwub9cZbtwx0dPTxKVeITndj71Nd+oDj/2XxQI+X 9hTzBdUHech+9e7EsTReekwPnRwNq+MAzoYB3JZVfZwT7ewjdvO5Iv6CVMthHmHgut+PjTN00vPS4 OhUYWoQNcsKUhGXXhCoZZ2/MHnjMSsLG8Vpgrb3tQXhiSoeMFXtnamdiasKXt7Jc76LttUOUKyHJo ZHT6pvTFlA8E+uzixb92yFkxiRzqIEGMdMQ3OBJfI2tcnS1KMzsv+Jt1VxL3ySC4aMLFFmM2y1UeI n8OdvXvEabfQwKXEvpIfbAZ6Qm1p7zhujxc9Me7VDJ48cNcSHTtxsNzNXWsEe6PpclfeDU0SglY7l phqtiLzuKHVpdfej4wAJbkaGgOs57NUEso25NbDIc7ZM2syVxWrdxxlP4zgxViiuIq6Yr4W/79kHB 93gnDuL1EJ0D3ib6Nvf+fYfybxPTOR9bKJ+jfn7yAh++prlwwWMuNlPcPXQ0yLfA= X-Rspamd-Queue-Id: 8FD936000106 X-Stat-Signature: e4wo146maycukhstkwbijnju8ueb5s18 X-Rspamd-Server: rspam02 Received-SPF: none (chromium.org>: No applicable sender policy available) receiver=imf25; identity=mailfrom; envelope-from=""; helo=mail-pf1-f176.google.com; client-ip=209.85.210.176 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1617137876-431776 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: For validating the stack offset behavior, report the offset from a given process's first seen stack address. A quick way to measure the entropy: for i in $(seq 1 1000); do echo "REPORT_STACK" >/sys/kernel/debug/provoke-crash/DIRECT done offsets=$(dmesg | grep 'Stack offset' | cut -d: -f3 | sort | uniq -c | sort -n | wc -l) echo "$(uname -m) bits of stack entropy: $(echo "obase=2; $offsets" | bc | wc -L)" Signed-off-by: Kees Cook --- drivers/misc/lkdtm/bugs.c | 17 +++++++++++++++++ drivers/misc/lkdtm/core.c | 1 + drivers/misc/lkdtm/lkdtm.h | 1 + 3 files changed, 19 insertions(+) diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index 110f5a8538e9..0e8254d0cf0b 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -134,6 +134,23 @@ noinline void lkdtm_CORRUPT_STACK_STRONG(void) __lkdtm_CORRUPT_STACK((void *)&data); } +static pid_t stack_pid; +static unsigned long stack_addr; + +void lkdtm_REPORT_STACK(void) +{ + volatile uintptr_t magic; + pid_t pid = task_pid_nr(current); + + if (pid != stack_pid) { + pr_info("Starting stack offset tracking for pid %d\n", pid); + stack_pid = pid; + stack_addr = (uintptr_t)&magic; + } + + pr_info("Stack offset: %d\n", (int)(stack_addr - (uintptr_t)&magic)); +} + void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void) { static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5}; diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c index b2aff4d87c01..8024b6a5cc7f 100644 --- a/drivers/misc/lkdtm/core.c +++ b/drivers/misc/lkdtm/core.c @@ -110,6 +110,7 @@ static const struct crashtype crashtypes[] = { CRASHTYPE(EXHAUST_STACK), CRASHTYPE(CORRUPT_STACK), CRASHTYPE(CORRUPT_STACK_STRONG), + CRASHTYPE(REPORT_STACK), CRASHTYPE(CORRUPT_LIST_ADD), CRASHTYPE(CORRUPT_LIST_DEL), CRASHTYPE(STACK_GUARD_PAGE_LEADING), diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h index 5ae48c64df24..99f90d3e5e9c 100644 --- a/drivers/misc/lkdtm/lkdtm.h +++ b/drivers/misc/lkdtm/lkdtm.h @@ -17,6 +17,7 @@ void lkdtm_LOOP(void); void lkdtm_EXHAUST_STACK(void); void lkdtm_CORRUPT_STACK(void); void lkdtm_CORRUPT_STACK_STRONG(void); +void lkdtm_REPORT_STACK(void); void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void); void lkdtm_SOFTLOCKUP(void); void lkdtm_HARDLOCKUP(void);