stackleak.c 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * This code fills the used part of the kernel stack with a poison value
  4. * before returning to userspace. It's part of the STACKLEAK feature
  5. * ported from grsecurity/PaX.
  6. *
  7. * Author: Alexander Popov <alex.popov@linux.com>
  8. *
  9. * STACKLEAK reduces the information which kernel stack leak bugs can
  10. * reveal and blocks some uninitialized stack variable attacks.
  11. */
  12. #include <linux/stackleak.h>
  13. #include <linux/kprobes.h>
  14. #ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE
  15. #include <linux/jump_label.h>
  16. #include <linux/sysctl.h>
  17. static DEFINE_STATIC_KEY_FALSE(stack_erasing_bypass);
  18. int stack_erasing_sysctl(struct ctl_table *table, int write,
  19. void *buffer, size_t *lenp, loff_t *ppos)
  20. {
  21. int ret = 0;
  22. int state = !static_branch_unlikely(&stack_erasing_bypass);
  23. int prev_state = state;
  24. table->data = &state;
  25. table->maxlen = sizeof(int);
  26. ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
  27. state = !!state;
  28. if (ret || !write || state == prev_state)
  29. return ret;
  30. if (state)
  31. static_branch_disable(&stack_erasing_bypass);
  32. else
  33. static_branch_enable(&stack_erasing_bypass);
  34. pr_warn("stackleak: kernel stack erasing is %s\n",
  35. state ? "enabled" : "disabled");
  36. return ret;
  37. }
  38. #define skip_erasing() static_branch_unlikely(&stack_erasing_bypass)
  39. #else
  40. #define skip_erasing() false
  41. #endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */
  42. asmlinkage void noinstr stackleak_erase(void)
  43. {
  44. /* It would be nice not to have 'kstack_ptr' and 'boundary' on stack */
  45. unsigned long kstack_ptr = current->lowest_stack;
  46. unsigned long boundary = (unsigned long)end_of_stack(current);
  47. unsigned int poison_count = 0;
  48. const unsigned int depth = STACKLEAK_SEARCH_DEPTH / sizeof(unsigned long);
  49. if (skip_erasing())
  50. return;
  51. /* Check that 'lowest_stack' value is sane */
  52. if (unlikely(kstack_ptr - boundary >= THREAD_SIZE))
  53. kstack_ptr = boundary;
  54. /* Search for the poison value in the kernel stack */
  55. while (kstack_ptr > boundary && poison_count <= depth) {
  56. if (*(unsigned long *)kstack_ptr == STACKLEAK_POISON)
  57. poison_count++;
  58. else
  59. poison_count = 0;
  60. kstack_ptr -= sizeof(unsigned long);
  61. }
  62. /*
  63. * One 'long int' at the bottom of the thread stack is reserved and
  64. * should not be poisoned (see CONFIG_SCHED_STACK_END_CHECK=y).
  65. */
  66. if (kstack_ptr == boundary)
  67. kstack_ptr += sizeof(unsigned long);
  68. #ifdef CONFIG_STACKLEAK_METRICS
  69. current->prev_lowest_stack = kstack_ptr;
  70. #endif
  71. /*
  72. * Now write the poison value to the kernel stack. Start from
  73. * 'kstack_ptr' and move up till the new 'boundary'. We assume that
  74. * the stack pointer doesn't change when we write poison.
  75. */
  76. if (on_thread_stack())
  77. boundary = current_stack_pointer;
  78. else
  79. boundary = current_top_of_stack();
  80. while (kstack_ptr < boundary) {
  81. *(unsigned long *)kstack_ptr = STACKLEAK_POISON;
  82. kstack_ptr += sizeof(unsigned long);
  83. }
  84. /* Reset the 'lowest_stack' value for the next syscall */
  85. current->lowest_stack = current_top_of_stack() - THREAD_SIZE/64;
  86. }
  87. void __used __no_caller_saved_registers noinstr stackleak_track_stack(void)
  88. {
  89. unsigned long sp = current_stack_pointer;
  90. /*
  91. * Having CONFIG_STACKLEAK_TRACK_MIN_SIZE larger than
  92. * STACKLEAK_SEARCH_DEPTH makes the poison search in
  93. * stackleak_erase() unreliable. Let's prevent that.
  94. */
  95. BUILD_BUG_ON(CONFIG_STACKLEAK_TRACK_MIN_SIZE > STACKLEAK_SEARCH_DEPTH);
  96. /* 'lowest_stack' should be aligned on the register width boundary */
  97. sp = ALIGN(sp, sizeof(unsigned long));
  98. if (sp < current->lowest_stack &&
  99. sp >= (unsigned long)task_stack_page(current) +
  100. sizeof(unsigned long)) {
  101. current->lowest_stack = sp;
  102. }
  103. }
  104. EXPORT_SYMBOL(stackleak_track_stack);