kevin/linux
1
Fork 0
Code

powerpc/ptrace: Expose HASHKEYR register to ptrace

Browse Source 
The HASHKEYR register contains a secret per-process key to enable unique
hashes per process. In general it should not be exposed to userspace
at all and a regular process has no need to know its key.

However, checkpoint restore in userspace (CRIU) functionality requires
that a process be able to set the HASHKEYR of another process, otherwise
existing hashes on the stack would be invalidated by a new random key.

Exposing HASHKEYR in this way also makes it appear in core dumps, which
is a security concern. Multiple threads may share a key, for example
just after a fork() call, where the kernel cannot know if the child is
going to return back along the parent's stack. If such a thread is
coerced into making a core dump, then the HASHKEYR value will be
readable and able to be used against all other threads sharing that key,
effectively undoing any protection offered by hashst/hashchk.

Therefore we expose HASHKEYR to ptrace when CONFIG_CHECKPOINT_RESTORE is
enabled, providing a choice of increased security or migratable ROP
protected processes. This is similar to how ARM exposes its PAC keys.

Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
Reviewed-by: Russell Currey <ruscur@russell.cc>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230616034846.311705-8-bgray@linux.ibm.com
This commit is contained in:
Benjamin Gray 2023-06-19 17:36:26 +10:00 committed by Michael Ellerman
parent 884ad5c52d
commit 97228ca375
4 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
arch/powerpc/include/uapi/asm/elf.h
View File

@ -99,6 +99,7 @@
#define ELF_NPMU 5 /* includes siar, sdar, sier, mmcr2, mmcr0 */ #define ELF_NPMU 5 /* includes siar, sdar, sier, mmcr2, mmcr0 */
#define ELF_NPKEY 3 /* includes amr, iamr, uamor */ #define ELF_NPKEY 3 /* includes amr, iamr, uamor */
#define ELF_NDEXCR 2 /* includes dexcr, hdexcr */ #define ELF_NDEXCR 2 /* includes dexcr, hdexcr */
#define ELF_NHASHKEYR 1 /* includes hashkeyr */
typedef unsigned long elf_greg_t64; typedef unsigned long elf_greg_t64;
typedef elf_greg_t64 elf_gregset_t64[ELF_NGREG]; typedef elf_greg_t64 elf_gregset_t64[ELF_NGREG];

3
arch/powerpc/kernel/ptrace/ptrace-decl.h
View File

@ -58,6 +58,9 @@ enum powerpc_regset {
REGSET_EBB, /* EBB registers */ REGSET_EBB, /* EBB registers */
REGSET_PMR, /* Performance Monitor Registers */ REGSET_PMR, /* Performance Monitor Registers */
REGSET_DEXCR, /* DEXCR registers */ REGSET_DEXCR, /* DEXCR registers */
#ifdef CONFIG_CHECKPOINT_RESTORE
REGSET_HASHKEYR, /* HASHKEYR register */
#endif
#endif #endif
#ifdef CONFIG_PPC_MEM_KEYS #ifdef CONFIG_PPC_MEM_KEYS
REGSET_PKEY, /* AMR register */ REGSET_PKEY, /* AMR register */

36
arch/powerpc/kernel/ptrace/ptrace-view.c
View File

@ -483,6 +483,35 @@ static int dexcr_get(struct task_struct *target, const struct user_regset *regse
return membuf_store(&to, (u64)lower_32_bits(mfspr(SPRN_HDEXCR_RO))); return membuf_store(&to, (u64)lower_32_bits(mfspr(SPRN_HDEXCR_RO)));
} }
#ifdef CONFIG_CHECKPOINT_RESTORE
static int hashkeyr_active(struct task_struct *target, const struct user_regset *regset)
{
if (!cpu_has_feature(CPU_FTR_ARCH_31))
return -ENODEV;
return regset->n;
}
static int hashkeyr_get(struct task_struct *target, const struct user_regset *regset,
struct membuf to)
{
if (!cpu_has_feature(CPU_FTR_ARCH_31))
return -ENODEV;
return membuf_store(&to, target->thread.hashkeyr);
}
static int hashkeyr_set(struct task_struct *target, const struct user_regset *regset,
unsigned int pos, unsigned int count, const void *kbuf,
const void __user *ubuf)
{
if (!cpu_has_feature(CPU_FTR_ARCH_31))
return -ENODEV;
return user_regset_copyin(&pos, &count, &kbuf, &ubuf, &target->thread.hashkeyr,
0, sizeof(unsigned long));
}
#endif /* CONFIG_CHECKPOINT_RESTORE */
#endif /* CONFIG_PPC_BOOK3S_64 */ #endif /* CONFIG_PPC_BOOK3S_64 */
#ifdef CONFIG_PPC_MEM_KEYS #ifdef CONFIG_PPC_MEM_KEYS
@ -649,6 +678,13 @@ static const struct user_regset native_regsets[] = {
.size = sizeof(u64), .align = sizeof(u64), .size = sizeof(u64), .align = sizeof(u64),
.active = dexcr_active, .regset_get = dexcr_get .active = dexcr_active, .regset_get = dexcr_get
}, },
#ifdef CONFIG_CHECKPOINT_RESTORE
[REGSET_HASHKEYR] = {
.core_note_type = NT_PPC_HASHKEYR, .n = ELF_NHASHKEYR,
.size = sizeof(u64), .align = sizeof(u64),
.active = hashkeyr_active, .regset_get = hashkeyr_get, .set = hashkeyr_set
},
#endif
#endif #endif
#ifdef CONFIG_PPC_MEM_KEYS #ifdef CONFIG_PPC_MEM_KEYS
[REGSET_PKEY] = { [REGSET_PKEY] = {

1
include/uapi/linux/elf.h
View File

@ -404,6 +404,7 @@ typedef struct elf64_shdr {
#define NT_PPC_TM_CDSCR 0x10f /* TM checkpointed Data Stream Control Register */ #define NT_PPC_TM_CDSCR 0x10f /* TM checkpointed Data Stream Control Register */
#define NT_PPC_PKEY 0x110 /* Memory Protection Keys registers */ #define NT_PPC_PKEY 0x110 /* Memory Protection Keys registers */
#define NT_PPC_DEXCR 0x111 /* PowerPC DEXCR registers */ #define NT_PPC_DEXCR 0x111 /* PowerPC DEXCR registers */
#define NT_PPC_HASHKEYR 0x112 /* PowerPC HASHKEYR register */
#define NT_386_TLS 0x200 /* i386 TLS slots (struct user_desc) */ #define NT_386_TLS 0x200 /* i386 TLS slots (struct user_desc) */
#define NT_386_IOPERM 0x201 /* x86 io permission bitmap (1=deny) */ #define NT_386_IOPERM 0x201 /* x86 io permission bitmap (1=deny) */
#define NT_X86_XSTATE 0x202 /* x86 extended state using xsave */ #define NT_X86_XSTATE 0x202 /* x86 extended state using xsave */