Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 16e13c60 authored by Sami Tolvanen's avatar Sami Tolvanen Committed by Alistair Delva
Browse files

FROMLIST: add support for Clang's Shadow Call Stack (SCS) 

This change adds generic support for Clang's Shadow Call Stack,
which uses a shadow stack to protect return addresses from being
overwritten by an attacker. Details are available here:

  https://clang.llvm.org/docs/ShadowCallStack.html

Note that security guarantees in the kernel differ from the
ones documented for user space. The kernel must store addresses
of shadow stacks used by other tasks and interrupt handlers in
memory, which means an attacker capable reading and writing
arbitrary memory may be able to locate them and hijack control
flow by modifying shadow stacks that are not currently in use.

Bug: 145210207
Change-Id: Ia5f1650593fa95da4efcf86f84830a20989f161c
(am from https://lore.kernel.org/patchwork/patch/1149054/

)
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarMiguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Signed-off-by: default avatarSami Tolvanen <samitolvanen@google.com>
parent 54e1b51f

Makefile

+6 −0
Original line number Diff line number Diff line
@@ -860,6 +860,12 @@ DISABLE_LTO += $(DISABLE_CFI) 
export CFI_CFLAGS DISABLE_CFI

endif



ifdef CONFIG_SHADOW_CALL_STACK

CC_FLAGS_SCS	:= -fsanitize=shadow-call-stack

KBUILD_CFLAGS	+= $(CC_FLAGS_SCS)

export CC_FLAGS_SCS

endif



# arch Makefile may override CC so keep this after arch Makefile is included

NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)

arch/Kconfig

+33 −0
Original line number Diff line number Diff line
@@ -554,6 +554,39 @@ config CFI_CLANG_SHADOW 
	  If you select this option, the kernel builds a fast look-up table of

	  CFI check functions in loaded modules to reduce overhead.



config ARCH_SUPPORTS_SHADOW_CALL_STACK

	bool

	help

	  An architecture should select this if it supports Clang's Shadow

	  Call Stack, has asm/scs.h, and implements runtime support for shadow

	  stack switching.



config SHADOW_CALL_STACK

	bool "Clang Shadow Call Stack"

	depends on ARCH_SUPPORTS_SHADOW_CALL_STACK

	help

	  This option enables Clang's Shadow Call Stack, which uses a

	  shadow stack to protect function return addresses from being

	  overwritten by an attacker. More information can be found from

	  Clang's documentation:



	    https://clang.llvm.org/docs/ShadowCallStack.html



	  Note that security guarantees in the kernel differ from the ones

	  documented for user space. The kernel must store addresses of shadow

	  stacks used by other tasks and interrupt handlers in memory, which

	  means an attacker capable reading and writing arbitrary memory may

	  be able to locate them and hijack control flow by modifying shadow

	  stacks that are not currently in use.



config SHADOW_CALL_STACK_VMAP

	bool "Use virtually mapped shadow call stacks"

	depends on SHADOW_CALL_STACK

	help

	  Use virtually mapped shadow call stacks. Selecting this option

	  provides better stack exhaustion protection, but increases per-thread

	  memory consumption as a full page is allocated for each shadow stack.



config HAVE_ARCH_WITHIN_STACK_FRAMES

	bool

	help

include/linux/compiler-clang.h

+6 −0
Original line number Diff line number Diff line
@@ -57,3 +57,9 @@ 


#define __nocfi		__attribute__((no_sanitize("cfi")))

#endif



#if __has_feature(shadow_call_stack)

# define __noscs	__attribute__((__no_sanitize__("shadow-call-stack")))

#else

# define __noscs

#endif

include/linux/compiler_types.h

+4 −0
Original line number Diff line number Diff line
@@ -144,6 +144,10 @@ struct ftrace_likely_data { 
#define __visible

#endif



#ifndef __noscs

# define __noscs

#endif



/*

 * Assume alignment of return value.

 */

include/linux/scs.h

0 → 100644
+57 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * Shadow Call Stack support.

 *

 * Copyright (C) 2019 Google LLC

 */



#ifndef _LINUX_SCS_H

#define _LINUX_SCS_H



#include <linux/gfp.h>

#include <linux/sched.h>

#include <asm/page.h>



#ifdef CONFIG_SHADOW_CALL_STACK



/*

 * In testing, 1 KiB shadow stack size (i.e. 128 stack frames on a 64-bit

 * architecture) provided ~40% safety margin on stack usage while keeping

 * memory allocation overhead reasonable.

 */

#define SCS_SIZE	1024UL

#define GFP_SCS		(GFP_KERNEL | __GFP_ZERO)



/*

 * A random number outside the kernel's virtual address space to mark the

 * end of the shadow stack.

 */

#define SCS_END_MAGIC	0xaf0194819b1635f6UL



#define task_scs(tsk)	(task_thread_info(tsk)->shadow_call_stack)



static inline void task_set_scs(struct task_struct *tsk, void *s)

{

	task_scs(tsk) = s;

}



extern void scs_init(void);

extern void scs_task_reset(struct task_struct *tsk);

extern int scs_prepare(struct task_struct *tsk, int node);

extern bool scs_corrupted(struct task_struct *tsk);

extern void scs_release(struct task_struct *tsk);



#else /* CONFIG_SHADOW_CALL_STACK */



#define task_scs(tsk)	NULL



static inline void task_set_scs(struct task_struct *tsk, void *s) {}

static inline void scs_init(void) {}

static inline void scs_task_reset(struct task_struct *tsk) {}

static inline int scs_prepare(struct task_struct *tsk, int node) { return 0; }

static inline bool scs_corrupted(struct task_struct *tsk) { return false; }

static inline void scs_release(struct task_struct *tsk) {}



#endif /* CONFIG_SHADOW_CALL_STACK */



#endif /* _LINUX_SCS_H */