Commit | Line | Data |
---|---|---|
afaef01c AP |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* | |
3 | * This code fills the used part of the kernel stack with a poison value | |
4 | * before returning to userspace. It's part of the STACKLEAK feature | |
5 | * ported from grsecurity/PaX. | |
6 | * | |
7 | * Author: Alexander Popov <alex.popov@linux.com> | |
8 | * | |
9 | * STACKLEAK reduces the information which kernel stack leak bugs can | |
10 | * reveal and blocks some uninitialized stack variable attacks. | |
11 | */ | |
12 | ||
13 | #include <linux/stackleak.h> | |
ef1a8409 | 14 | #include <linux/kprobes.h> |
afaef01c | 15 | |
964c9dff AP |
16 | #ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE |
17 | #include <linux/jump_label.h> | |
18 | #include <linux/sysctl.h> | |
0df8bdd5 | 19 | #include <linux/init.h> |
964c9dff AP |
20 | |
21 | static DEFINE_STATIC_KEY_FALSE(stack_erasing_bypass); | |
22 | ||
0df8bdd5 XN |
23 | #ifdef CONFIG_SYSCTL |
24 | static int stack_erasing_sysctl(struct ctl_table *table, int write, | |
25 | void __user *buffer, size_t *lenp, loff_t *ppos) | |
964c9dff AP |
26 | { |
27 | int ret = 0; | |
28 | int state = !static_branch_unlikely(&stack_erasing_bypass); | |
29 | int prev_state = state; | |
30 | ||
31 | table->data = &state; | |
32 | table->maxlen = sizeof(int); | |
33 | ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); | |
34 | state = !!state; | |
35 | if (ret || !write || state == prev_state) | |
36 | return ret; | |
37 | ||
38 | if (state) | |
39 | static_branch_disable(&stack_erasing_bypass); | |
40 | else | |
41 | static_branch_enable(&stack_erasing_bypass); | |
42 | ||
43 | pr_warn("stackleak: kernel stack erasing is %s\n", | |
44 | state ? "enabled" : "disabled"); | |
45 | return ret; | |
46 | } | |
0df8bdd5 XN |
47 | static struct ctl_table stackleak_sysctls[] = { |
48 | { | |
49 | .procname = "stack_erasing", | |
50 | .data = NULL, | |
51 | .maxlen = sizeof(int), | |
52 | .mode = 0600, | |
53 | .proc_handler = stack_erasing_sysctl, | |
54 | .extra1 = SYSCTL_ZERO, | |
55 | .extra2 = SYSCTL_ONE, | |
56 | }, | |
57 | {} | |
58 | }; | |
59 | ||
60 | static int __init stackleak_sysctls_init(void) | |
61 | { | |
62 | register_sysctl_init("kernel", stackleak_sysctls); | |
63 | return 0; | |
64 | } | |
65 | late_initcall(stackleak_sysctls_init); | |
66 | #endif /* CONFIG_SYSCTL */ | |
964c9dff AP |
67 | |
68 | #define skip_erasing() static_branch_unlikely(&stack_erasing_bypass) | |
69 | #else | |
70 | #define skip_erasing() false | |
71 | #endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */ | |
72 | ||
a12685e2 | 73 | static __always_inline void __stackleak_erase(void) |
afaef01c | 74 | { |
9ec79840 | 75 | const unsigned long task_stack_low = stackleak_task_low_bound(current); |
1723d39d MR |
76 | unsigned long erase_low = current->lowest_stack; |
77 | unsigned long erase_high; | |
afaef01c AP |
78 | unsigned int poison_count = 0; |
79 | const unsigned int depth = STACKLEAK_SEARCH_DEPTH / sizeof(unsigned long); | |
80 | ||
afaef01c | 81 | /* Search for the poison value in the kernel stack */ |
1723d39d MR |
82 | while (erase_low > task_stack_low && poison_count <= depth) { |
83 | if (*(unsigned long *)erase_low == STACKLEAK_POISON) | |
afaef01c AP |
84 | poison_count++; |
85 | else | |
86 | poison_count = 0; | |
87 | ||
1723d39d | 88 | erase_low -= sizeof(unsigned long); |
afaef01c AP |
89 | } |
90 | ||
c8d12627 | 91 | #ifdef CONFIG_STACKLEAK_METRICS |
1723d39d | 92 | current->prev_lowest_stack = erase_low; |
c8d12627 AP |
93 | #endif |
94 | ||
afaef01c | 95 | /* |
1723d39d MR |
96 | * Now write the poison value to the kernel stack between 'erase_low' |
97 | * and 'erase_high'. We assume that the stack pointer doesn't change | |
98 | * when we write poison. | |
afaef01c AP |
99 | */ |
100 | if (on_thread_stack()) | |
1723d39d | 101 | erase_high = current_stack_pointer; |
afaef01c | 102 | else |
1723d39d | 103 | erase_high = current_top_of_stack(); |
afaef01c | 104 | |
1723d39d MR |
105 | while (erase_low < erase_high) { |
106 | *(unsigned long *)erase_low = STACKLEAK_POISON; | |
107 | erase_low += sizeof(unsigned long); | |
afaef01c AP |
108 | } |
109 | ||
110 | /* Reset the 'lowest_stack' value for the next syscall */ | |
111 | current->lowest_stack = current_top_of_stack() - THREAD_SIZE/64; | |
112 | } | |
113 | ||
a12685e2 MR |
114 | asmlinkage void noinstr stackleak_erase(void) |
115 | { | |
116 | if (skip_erasing()) | |
117 | return; | |
118 | ||
119 | __stackleak_erase(); | |
120 | } | |
121 | ||
dcb85f85 | 122 | void __used __no_caller_saved_registers noinstr stackleak_track_stack(void) |
10e9ae9f | 123 | { |
feee1b8c | 124 | unsigned long sp = current_stack_pointer; |
10e9ae9f AP |
125 | |
126 | /* | |
127 | * Having CONFIG_STACKLEAK_TRACK_MIN_SIZE larger than | |
128 | * STACKLEAK_SEARCH_DEPTH makes the poison search in | |
129 | * stackleak_erase() unreliable. Let's prevent that. | |
130 | */ | |
131 | BUILD_BUG_ON(CONFIG_STACKLEAK_TRACK_MIN_SIZE > STACKLEAK_SEARCH_DEPTH); | |
132 | ||
feee1b8c AP |
133 | /* 'lowest_stack' should be aligned on the register width boundary */ |
134 | sp = ALIGN(sp, sizeof(unsigned long)); | |
10e9ae9f | 135 | if (sp < current->lowest_stack && |
9ec79840 | 136 | sp >= stackleak_task_low_bound(current)) { |
10e9ae9f AP |
137 | current->lowest_stack = sp; |
138 | } | |
139 | } | |
140 | EXPORT_SYMBOL(stackleak_track_stack); |