Received-SPF: pass (google.com: domain of linux-kernel+bounces-185936-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Message-ID: <664dae5b.170a0220.5c997.3219SMTPIN_ADDED_BROKEN@mx.google.com>
From: Nicolai Stange <nstange@suse.de>
To: Kees Cook <keescook@chromium.org>
Cc: Jeremy Linton <jeremy.linton@arm.com>,  Arnd Bergmann <arnd@arndb.de>,
  "Gustavo A. R. Silva" <gustavoars@kernel.org>,
  linux-hardening@vger.kernel.org,  Elena Reshetova
 <elena.reshetova@intel.com>,  Thomas Gleixner <tglx@linutronix.de>,
  linux-kernel@vger.kernel.org
Subject: Re: [PATCH] randomize_kstack: Improve entropy diffusion
In-Reply-To: <20240309202445.work.165-kees@kernel.org> (Kees Cook's message of
	"Sat, 9 Mar 2024 12:24:48 -0800")
References: <20240309202445.work.165-kees@kernel.org>
Date: Wed, 22 May 2024 10:35:20 +0200
User-Agent: Gnus/5.13 (Gnus v5.13)
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Kees Cook <keescook@chromium.org> writes:

>
> diff --git a/include/linux/randomize_kstack.h b/include/linux/randomize_k=
stack.h
> index 5d868505a94e..6d92b68efbf6 100644
> --- a/include/linux/randomize_kstack.h
> +++ b/include/linux/randomize_kstack.h
> @@ -80,7 +80,7 @@ DECLARE_PER_CPU(u32, kstack_offset);
>  	if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT,	\
>  				&randomize_kstack_offset)) {		\
>  		u32 offset =3D raw_cpu_read(kstack_offset);		\
> -		offset ^=3D (rand);					\
> +		offset =3D ror32(offset, 5) ^ (rand);			\

Hi Kees,

I'm wondering whether this renders the per-arch mask applied to 'rand'
at the respective choose_random_kstack_offset() invocations ineffective?

Like e.g. on x86 there is

  choose_random_kstack_offset(rdtsc() & 0xFF);

I would argue that while before the patch kstack_offset had been
guaranteed to stay within the bounds of 0xFF, it's now effectively
unlimited (well, <=3D (u32)-1) and only capped to 0x3ff when subsequently
applying the KSTACK_OFFSET_MAX().

Or am I simply missing something?

Thanks!

Nicolai

>  		raw_cpu_write(kstack_offset, offset);			\
>  	}								\
>  } while (0)

--=20
SUSE Software Solutions Germany GmbH, Frankenstra=C3=9Fe 146, 90461 N=C3=BC=
rnberg, Germany
GF: Ivo Totev, Andrew McDonald, Werner Knoblich
(HRB 36809, AG N=C3=BCrnberg)