kevin/linux
1
Fork 0
Code

randomize_kstack: Remove non-functional per-arch entropy filtering

Browse Source 
An unintended consequence of commit 9c573cd313 ("randomize_kstack:
Improve entropy diffusion") was that the per-architecture entropy size
filtering reduced how many bits were being added to the mix, rather than
how many bits were being used during the offsetting. All architectures
fell back to the existing default of 0x3FF (10 bits), which will consume
at most 1KiB of stack space. It seems that this is working just fine,
so let's avoid the confusion and update everything to use the default.

The prior intent of the per-architecture limits were:

  arm64: capped at 0x1FF (9 bits), 5 bits effective
  powerpc: uncapped (10 bits), 6 or 7 bits effective
  riscv: uncapped (10 bits), 6 bits effective
  x86: capped at 0xFF (8 bits), 5 (x86_64) or 6 (ia32) bits effective
  s390: capped at 0xFF (8 bits), undocumented effective entropy

Current discussion has led to just dropping the original per-architecture
filters. The additional entropy appears to be safe for arm64, x86,
and s390. Quoting Arnd, "There is no point pretending that 15.75KB is
somehow safe to use while 15.00KB is not."

Co-developed-by: Yuntao Liu <liuyuntao12@huawei.com>
Signed-off-by: Yuntao Liu <liuyuntao12@huawei.com>
Fixes: 9c573cd313 ("randomize_kstack: Improve entropy diffusion")
Link: https://lore.kernel.org/r/20240617133721.377540-1-liuyuntao12@huawei.com
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com> # s390
Link: https://lore.kernel.org/r/20240619214711.work.953-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Kees Cook 2024-06-19 14:47:15 -07:00
parent 2003e483a8
commit ef40d28f17
3 changed files with 14 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
arch/arm64/kernel/syscall.c
View File

@ -53,17 +53,15 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno,
syscall_set_return_value(current, regs, 0, ret); syscall_set_return_value(current, regs, 0, ret);
/* /*
* Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), * This value will get limited by KSTACK_OFFSET_MAX(), which is 10
* but not enough for arm64 stack utilization comfort. To keep * bits. The actual entropy will be further reduced by the compiler
* reasonable stack head room, reduce the maximum offset to 9 bits. * when applying stack alignment constraints: the AAPCS mandates a
* 16-byte aligned SP at function boundaries, which will remove the
* 4 low bits from any entropy chosen here.
* *
* The actual entropy will be further reduced by the compiler when * The resulting 6 bits of entropy is seen in SP[9:4].
* applying stack alignment constraints: the AAPCS mandates a
* 16-byte (i.e. 4-bit) aligned SP at function boundaries.
*
* The resulting 5 bits of entropy is seen in SP[8:4].
*/ */
choose_random_kstack_offset(get_random_u16() & 0x1FF); choose_random_kstack_offset(get_random_u16());
} }
static inline bool has_syscall_work(unsigned long flags) static inline bool has_syscall_work(unsigned long flags)

2
arch/s390/include/asm/entry-common.h
View File

@ -54,7 +54,7 @@ static __always_inline void arch_exit_to_user_mode(void)
static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs, static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,
unsigned long ti_work) unsigned long ti_work)
{ {
choose_random_kstack_offset(get_tod_clock_fast() & 0xff); choose_random_kstack_offset(get_tod_clock_fast());
} }
#define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare

15
arch/x86/include/asm/entry-common.h
View File

@ -73,19 +73,16 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,
#endif #endif
/* /*
* Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), * This value will get limited by KSTACK_OFFSET_MAX(), which is 10
* but not enough for x86 stack utilization comfort. To keep * bits. The actual entropy will be further reduced by the compiler
* reasonable stack head room, reduce the maximum offset to 8 bits. * when applying stack alignment constraints (see cc_stack_align4/8 in
*
* The actual entropy will be further reduced by the compiler when
* applying stack alignment constraints (see cc_stack_align4/8 in
* arch/x86/Makefile), which will remove the 3 (x86_64) or 2 (ia32) * arch/x86/Makefile), which will remove the 3 (x86_64) or 2 (ia32)
* low bits from any entropy chosen here. * low bits from any entropy chosen here.
* *
* Therefore, final stack offset entropy will be 5 (x86_64) or * Therefore, final stack offset entropy will be 7 (x86_64) or
* 6 (ia32) bits. * 8 (ia32) bits.
*/ */
choose_random_kstack_offset(rdtsc() & 0xFF); choose_random_kstack_offset(rdtsc());
} }
#define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare #define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare