Received: by 10.213.65.68 with SMTP id h4csp2529184imn; Mon, 9 Apr 2018 05:07:49 -0700 (PDT) X-Google-Smtp-Source: AIpwx48027UQwl94pUA2VH6KeUv/Mgq5ttawha9fKC2pfcpK6JpK8WgcGVFOkEqUujk6par1Rlu1 X-Received: by 2002:a17:902:b40d:: with SMTP id x13-v6mr23004667plr.167.1523275668958; Mon, 09 Apr 2018 05:07:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523275668; cv=none; d=google.com; s=arc-20160816; b=RGYusB4kvUBlMUbI72Cve39HUdkYZ2g11zDWEC9WPZrup+VgVg1Fdu1e59ZTtc3Kvh PSSaHtbv3wvSKdKPPnhwb9m0703F3+mLhHBY9r+TxmeMR/+sMOzUAMco4ag879o7vins uW/SFpYqfBw0E3t9M/QEswihrTJIK5gbYdTfV/UMNKLQQ+bd19e4mmKzVW9AWJ629xMk 6cwfRWIXLD34tn/efmsieMEk5uRtObgL6HWAw75OOp4QNohibdiuA8xVLhlprDmxB7/f 3HRi6XFZNAJgp3zNx3K/+iiHuDoeVDDu9C9VK6CBEIIvbjLKnwHEg7rYRUXwVxStvI4j pqDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=zqw89oX0VDYEFbNnHUf8KMoRxXhoyIJsc7kMYSn54rA=; b=SXdSFwFTbFr+Fo7RYBZLnAS3MzDz+oC3P/7i0jYQu/shnNIKEEvkEDYsDTql+SGBAZ sjtYrXxYAbmFgQBK31thnLMrQLW69BbaaXIjgj27dOq6Efd9Uk4oyjqpItU9M9Of5T04 +kwLGoMSyFtYWYjANxKrB41wn+hAD5W+Ik+soA4nhUVkxQ1010IqrLPKZkXvB9qJT8Oc cy/DQFO+Y34iLUlk+9zJdw4yKuwy54zcToN0kJQice9AhNnhW8sfX9z9ABZGX1pL3xeo LxJENx8MzCJPcw3v5Ut6vs9144FdQZ4Tvg7X4WlAenzXdaKQ2QKTb8duLGMqvdjYNrsp yWbA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=YxooVLzS; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 196si130590pgb.674.2018.04.09.05.07.11; Mon, 09 Apr 2018 05:07:48 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=YxooVLzS; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752454AbeDIMDy (ORCPT + 99 others); Mon, 9 Apr 2018 08:03:54 -0400 Received: from mail-wm0-f68.google.com ([74.125.82.68]:34373 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752397AbeDIMDw (ORCPT ); Mon, 9 Apr 2018 08:03:52 -0400 Received: by mail-wm0-f68.google.com with SMTP id w2so17437885wmw.1 for ; Mon, 09 Apr 2018 05:03:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=zqw89oX0VDYEFbNnHUf8KMoRxXhoyIJsc7kMYSn54rA=; b=YxooVLzSWU7h7Zh4iFKXBe8ZkG7GbQ6WwEatl7f58wF0ssespeCi/oigO2YgRf7HgS SSHKyDo/qXTWHAspjpzmQZN7gJDRutiKu1jdVqZaEh9KvmpLii5VK84VM/QEQIFUWpzN E4x+/pVOU8ZMUCgjXeU/GNkkmeqimoHXUfYk0EkdEcYe4NNebzTmX4bqdciusFnV0Ek+ mr7lw7CB5tPonL6JinAbH4LX1gMs7VVJ4CMEUKHKeR4EsaZYlBtINgP1EMD2nARTZWw8 McRTq2VvKxBjZp+y2lD2xUrk04jBY7dMwglfkmKhwUREIf4JMLiP/qAo3pbWmgiwr9J/ q5YQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=zqw89oX0VDYEFbNnHUf8KMoRxXhoyIJsc7kMYSn54rA=; b=TrIHi9qhpEA41j4EKLVl1cNn7OJ7KInBJd+N3x6h2HPfDJFvjVKpNA11yozKU7WU+A 5F2gLPM1HzJ25VFD1f7HlildqnZW0+SWHsUP/aDd28oTWmMvNPB0ndkCb2ykqbdpMDf0 PU4k26WKgeJWrUfekUzE986keYBen4enHAENYZHHIht1Co7xUNPpjt/cWeHPmbutgsQi 1OqovIxJQB2ecMODar05UOynsIG4aB9QazhNoo10/OnZ2or3+xLPett5b5fki+81Ml7I 5y5KuLhWj9MC5AUrbhdWMKGCRJUs/2Q+XITNLwJMjFETnicvOh3LQNXlkwRbKz1W4PKf l9Rw== X-Gm-Message-State: ALQs6tCFnQWRyHxnnOKOxJ5EUoWUcWotlJybyxMv7/i2dZuTqefZ31A3 mTpsNC8SlVLt9Mfmedhvaz0= X-Received: by 10.28.192.7 with SMTP id q7mr19651016wmf.44.1523275431330; Mon, 09 Apr 2018 05:03:51 -0700 (PDT) Received: from sahara-ad.darkmatter.uae (bba421079.alshamil.net.ae. [83.110.21.201]) by smtp.gmail.com with ESMTPSA id 59sm280435wro.35.2018.04.09.05.03.48 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 09 Apr 2018 05:03:50 -0700 (PDT) From: kpark3469@gmail.com To: kernel-hardening@lists.openwall.com Cc: catalin.marinas@arm.com, keescook@chromium.org, will.deacon@arm.com, mark.rutland@arm.com, james.morse@arm.com, panand@redhat.com, keun-o.park@darkmatter.ae, psodagud@codeaurora.org, jpoimboe@redhat.com, mingo@kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 2/3] arm64: usercopy: implement arch_within_stack_frames Date: Mon, 9 Apr 2018 15:59:15 +0400 Message-Id: <1523275156-29087-3-git-send-email-kpark3469@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1523275156-29087-2-git-send-email-kpark3469@gmail.com> References: <1523275156-29087-1-git-send-email-kpark3469@gmail.com> <1523275156-29087-2-git-send-email-kpark3469@gmail.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: James Morse This implements arch_within_stack_frames() for arm64 that should validate if a given object is contained by a kernel stack frame. Signed-off-by: James Morse Reviewed-by: Sahara Reviewed-by: Kees Cook --- arch/arm64/Kconfig | 1 + arch/arm64/kernel/stacktrace.c | 76 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 77 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 177be0d..72d0747 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -128,6 +128,7 @@ config ARM64 select HAVE_SYSCALL_TRACEPOINTS select HAVE_KPROBES select HAVE_KRETPROBES + select HAVE_ARCH_WITHIN_STACK_FRAMES select IOMMU_DMA if IOMMU_SUPPORT select IRQ_DOMAIN select IRQ_FORCED_THREADING diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c index d5718a0..5eb3784 100644 --- a/arch/arm64/kernel/stacktrace.c +++ b/arch/arm64/kernel/stacktrace.c @@ -27,6 +27,11 @@ #include #include +#define FAKE_FRAME(frame, my_func) do { \ + frame.fp = (unsigned long)__builtin_frame_address(0); \ + frame.pc = (unsigned long)my_func; \ +} while (0) + /* * AArch64 PCS assigns the frame pointer to x29. * @@ -100,6 +105,77 @@ void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame, } } +struct check_frame_arg { + unsigned long obj_start; + unsigned long obj_end; + unsigned long frame_start; + int discard_frames; + int err; +}; + +static int check_frame(struct stackframe *frame, void *d) +{ + struct check_frame_arg *arg = d; + unsigned long frame_end = frame->fp; + + /* object overlaps multiple frames */ + if (arg->obj_start < frame->fp && frame->fp < arg->obj_end) { + arg->err = BAD_STACK; + return 1; + } + + /* + * Discard frames and check object is in a frame written early + * enough. + */ + if (arg->discard_frames) + arg->discard_frames--; + else if ((arg->frame_start <= arg->obj_start && + arg->obj_start < frame_end) && + (arg->frame_start < arg->obj_end && arg->obj_end <= frame_end)) + return 1; + + /* object exists in a previous frame */ + if (arg->obj_end < arg->frame_start) { + arg->err = BAD_STACK; + return 1; + } + + arg->frame_start = frame_end + 0x10; + + return 0; +} + +/* Check obj doesn't overlap a stack frame record */ +int arch_within_stack_frames(const void *stack, + const void *stack_end, + const void *obj, unsigned long obj_len) +{ + struct stackframe frame; + struct check_frame_arg arg; + + if (!IS_ENABLED(CONFIG_FRAME_POINTER)) + return NOT_STACK; + + arg.err = GOOD_FRAME; + arg.obj_start = (unsigned long)obj; + arg.obj_end = arg.obj_start + obj_len; + + FAKE_FRAME(frame, arch_within_stack_frames); + arg.frame_start = frame.fp; + + /* + * Skip 4 non-inlined frames: , + * arch_within_stack_frames(), check_stack_object() and + * __check_object_size(). + */ + arg.discard_frames = 4; + + walk_stackframe(current, &frame, check_frame, &arg); + + return arg.err; +} + #ifdef CONFIG_STACKTRACE struct stack_trace_data { struct stack_trace *trace; -- 2.7.4