All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mark Rutland <mark.rutland@arm.com>
To: Peter Zijlstra <peterz@infradead.org>
Cc: Sami Tolvanen <samitolvanen@google.com>,
	x86@kernel.org, Kees Cook <keescook@chromium.org>,
	Josh Poimboeuf <jpoimboe@redhat.com>,
	Nathan Chancellor <nathan@kernel.org>,
	Nick Desaulniers <ndesaulniers@google.com>,
	Sedat Dilek <sedat.dilek@gmail.com>,
	Steven Rostedt <rostedt@goodmis.org>,
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
	llvm@lists.linux.dev, ardb@kernel.org
Subject: Re: [PATCH v5 00/15] x86: Add support for Clang CFI
Date: Wed, 27 Oct 2021 13:05:15 +0100	[thread overview]
Message-ID: <20211027120515.GC54628@C02TD0UTHF1T.local> (raw)
In-Reply-To: <20211026201622.GG174703@worktop.programming.kicks-ass.net>

On Tue, Oct 26, 2021 at 10:16:22PM +0200, Peter Zijlstra wrote:
> On Wed, Oct 13, 2021 at 11:16:43AM -0700, Sami Tolvanen wrote:
> > This series adds support for Clang's Control-Flow Integrity (CFI)
> > checking to x86_64. With CFI, the compiler injects a runtime
> > check before each indirect function call to ensure the target is
> > a valid function with the correct static type. This restricts
> > possible call targets and makes it more difficult for an attacker
> > to exploit bugs that allow the modification of stored function
> > pointers. For more details, see:
> > 
> >   https://clang.llvm.org/docs/ControlFlowIntegrity.html
> 
> So, if I understand this right, the compiler emits, for every function
> two things: 1) the actual funcion and 2) a jump-table entry.
> 
> Then, every time the address of a function is taken, 2) is given instead
> of the expected 1), right?

Yes, and we had to bodge around this with function_nocfi() to get the
actual function address.

Really there should be a compiler intrinsic or attribute for this, given
the compiler has all the releveant information available. On arm64 we
had to us inine asm to generate the addres...

Taking a step back, it'd be nicer if we didn't have the jump-table shim
at all, and had some SW landing pad (e.g. a NOP with some magic bytes)
in the callees that the caller could check for. Then function pointers
would remain callable in call cases, and we could explcitly add landing
pads to asm to protect those. I *think* that's what the grsecurity folk
do, but I could be mistaken.

> But how does this work with things like static_call(), which we give a
> function address (now a jump-table entry) and use that to write direct
> call instructions?
> 
> Should not this jump-table thingy get converted to an actual function
> address somewhere around arch_static_call_transform() ? This also seems
> relevant for arm64 (which already has CLANG_CFI supported) given:
> 
>   https://lkml.kernel.org/r/20211025122102.46089-3-frederic@kernel.org

Ugh, yeah, we'll need to do the function_nocfi() dance somewhere...

Thanks,
Mark.

  parent reply	other threads:[~2021-10-27 12:05 UTC|newest]

Thread overview: 117+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-13 18:16 [PATCH v5 00/15] x86: Add support for Clang CFI Sami Tolvanen
2021-10-13 18:16 ` [PATCH v5 01/15] objtool: Add CONFIG_CFI_CLANG support Sami Tolvanen
2021-10-13 18:59   ` Kees Cook
2021-10-14  0:44   ` Josh Poimboeuf
2021-10-14 10:22   ` Peter Zijlstra
2021-10-14 19:20     ` Sami Tolvanen
2021-10-13 18:16 ` [PATCH v5 02/15] objtool: Add ASM_STACK_FRAME_NON_STANDARD Sami Tolvanen
2021-10-13 18:59   ` Kees Cook
2021-10-13 18:16 ` [PATCH v5 03/15] linkage: Add DECLARE_NOT_CALLED_FROM_C Sami Tolvanen
2021-10-13 19:00   ` Kees Cook
2021-10-15  2:51   ` Andy Lutomirski
2021-10-15 15:35     ` Sami Tolvanen
2021-10-15 15:55     ` Thomas Gleixner
2021-10-15 16:22       ` Andy Lutomirski
2021-10-15 16:47         ` Sami Tolvanen
2021-10-15 17:34           ` Andy Lutomirski
2021-10-15 17:57       ` Thomas Gleixner
2021-10-15 18:42         ` Sami Tolvanen
2021-10-15 19:35           ` Andy Lutomirski
2021-10-15 20:37             ` Sami Tolvanen
2021-10-16 21:12               ` Josh Poimboeuf
2021-10-18 17:08                 ` Sami Tolvanen
2021-10-15 22:17           ` Thomas Gleixner
2021-10-16 21:16             ` Josh Poimboeuf
2021-10-13 18:16 ` [PATCH v5 04/15] cfi: Add DEFINE_CFI_IMMEDIATE_RETURN_STUB Sami Tolvanen
2021-10-13 19:02   ` Kees Cook
2021-10-13 18:16 ` [PATCH v5 05/15] tracepoint: Exclude tp_stub_func from CFI checking Sami Tolvanen
2021-10-13 19:03   ` Kees Cook
2021-10-13 19:20   ` Steven Rostedt
2021-10-13 18:16 ` [PATCH v5 06/15] ftrace: Use an opaque type for functions not callable from C Sami Tolvanen
2021-10-13 19:04   ` Kees Cook
2021-10-13 19:20   ` Steven Rostedt
2021-10-13 18:16 ` [PATCH v5 07/15] lkdtm: Disable UNSET_SMEP with CFI Sami Tolvanen
2021-10-13 18:16 ` [PATCH v5 08/15] lkdtm: Use an opaque type for lkdtm_rodata_do_nothing Sami Tolvanen
2021-10-13 18:16 ` [PATCH v5 09/15] x86: Use an opaque type for functions not callable from C Sami Tolvanen
2021-10-14 11:21   ` Borislav Petkov
2021-10-14 16:07     ` Kees Cook
2021-10-14 17:31       ` Borislav Petkov
2021-10-14 18:24         ` Sami Tolvanen
2021-10-14 19:00           ` Nick Desaulniers
2021-10-14 18:47         ` Kees Cook
2021-10-14 18:52           ` Steven Rostedt
2021-10-14 19:06             ` Josh Poimboeuf
2021-10-13 18:16 ` [PATCH v5 10/15] x86/purgatory: Disable CFI Sami Tolvanen
2021-10-13 19:05   ` Kees Cook
2021-10-13 18:16 ` [PATCH v5 11/15] x86, relocs: Ignore __typeid__ relocations Sami Tolvanen
2021-10-13 18:16 ` [PATCH v5 12/15] x86, module: " Sami Tolvanen
2021-10-13 18:55   ` Kees Cook
2021-10-13 18:16 ` [PATCH v5 13/15] x86, cpu: Use LTO for cpu.c with CFI Sami Tolvanen
2021-10-13 18:16 ` [PATCH v5 14/15] x86, kprobes: Fix optprobe_template_func type mismatch Sami Tolvanen
2021-10-13 18:16 ` [PATCH v5 15/15] x86, build: Allow CONFIG_CFI_CLANG to be selected Sami Tolvanen
2021-10-13 18:56   ` Kees Cook
2021-10-13 19:07 ` [PATCH v5 00/15] x86: Add support for Clang CFI Kees Cook
2021-10-19 10:06 ` Alexander Lobakin
2021-10-19 15:40   ` Sami Tolvanen
2021-10-21 10:27 ` Alexander Lobakin
2021-10-26 20:16 ` Peter Zijlstra
2021-10-27 10:02   ` David Laight
2021-10-27 10:17     ` Peter Zijlstra
2021-10-27 12:05   ` Mark Rutland [this message]
2021-10-27 12:22     ` Ard Biesheuvel
2021-10-27 12:48       ` Peter Zijlstra
2021-10-27 13:04         ` Peter Zijlstra
2021-10-27 13:30           ` Ard Biesheuvel
2021-10-27 14:03             ` Peter Zijlstra
2021-10-27 14:18               ` Ard Biesheuvel
2021-10-27 14:36                 ` Peter Zijlstra
2021-10-27 15:50                 ` Sami Tolvanen
2021-10-27 15:55                   ` Ard Biesheuvel
2021-10-29 20:03                   ` Peter Zijlstra
2021-10-30  7:47                     ` [PATCH] static_call,x86: Robustify trampoline patching Peter Zijlstra
2021-10-30  8:16                       ` Peter Zijlstra
2021-11-02 17:35                         ` Kees Cook
2021-11-02 18:15                           ` Peter Zijlstra
2021-11-15 13:09                         ` Rasmus Villemoes
2021-10-30 17:19                       ` Ard Biesheuvel
2021-10-30 18:02                         ` Peter Zijlstra
2021-10-30 18:55                           ` Ard Biesheuvel
2021-10-31 16:24                             ` Ard Biesheuvel
2021-10-31 16:39                               ` Peter Zijlstra
2021-10-31 16:44                                 ` Ard Biesheuvel
2021-10-31 20:09                                   ` Peter Zijlstra
2021-10-31 20:21                                     ` Ard Biesheuvel
2021-10-31 20:44                                       ` Peter Zijlstra
2021-10-31 23:36                                         ` Ard Biesheuvel
2021-11-01  9:01                                           ` Peter Zijlstra
2021-11-01  9:36                                             ` David Laight
2021-11-01 14:14                                             ` Ard Biesheuvel
2021-11-02 12:57                                               ` Peter Zijlstra
2021-11-02 15:15                                                 ` Peter Zijlstra
2021-11-02 17:44                                                   ` Ard Biesheuvel
2021-11-02 18:14                                                     ` Peter Zijlstra
2021-11-02 18:17                                                       ` Peter Zijlstra
2021-11-02 18:18                                                       ` Ard Biesheuvel
2021-11-02 21:48                                                         ` Peter Zijlstra
2021-11-02 18:10                                                 ` Kees Cook
2021-11-02 21:02                                                   ` Andy Lutomirski
2021-11-02 23:13                                                     ` Kees Cook
2021-11-03  0:20                                                       ` Andy Lutomirski
2021-11-03  8:35                                                         ` Peter Zijlstra
2021-11-03 10:01                                                           ` David Laight
2021-11-03 19:32                                                           ` Andy Lutomirski
2021-11-02 21:19                                                   ` Peter Zijlstra
2021-11-11 12:15                       ` [tip: locking/urgent] " tip-bot2 for Peter Zijlstra
2021-10-30 19:07                     ` [PATCH v5 00/15] x86: Add support for Clang CFI Sami Tolvanen
2021-10-27 17:11           ` Kees Cook
2021-10-27 21:21             ` Peter Zijlstra
2021-10-27 22:27               ` Kees Cook
2021-10-28 11:09                 ` Peter Zijlstra
2021-10-28 17:12                   ` Kees Cook
2021-10-28 20:29                     ` Peter Zijlstra
2021-11-02 17:26                       ` Kees Cook
2021-11-01  4:13                 ` Andy Lutomirski
2021-10-27 12:46     ` Peter Zijlstra
2021-10-27 12:55     ` David Laight
2021-10-27 13:17       ` Mark Rutland
2021-10-27 21:31         ` David Laight

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211027120515.GC54628@C02TD0UTHF1T.local \
    --to=mark.rutland@arm.com \
    --cc=ardb@kernel.org \
    --cc=jpoimboe@redhat.com \
    --cc=keescook@chromium.org \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=llvm@lists.linux.dev \
    --cc=nathan@kernel.org \
    --cc=ndesaulniers@google.com \
    --cc=peterz@infradead.org \
    --cc=rostedt@goodmis.org \
    --cc=samitolvanen@google.com \
    --cc=sedat.dilek@gmail.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.