All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core)
@ 2016-06-20 23:43 ` Andy Lutomirski
  0 siblings, 0 replies; 269+ messages in thread
From: Andy Lutomirski @ 2016-06-20 23:43 UTC (permalink / raw)
  To: x86, linux-kernel
  Cc: linux-arch, Borislav Petkov, Nadav Amit, Kees Cook, Brian Gerst,
	kernel-hardening, Linus Torvalds, Josh Poimboeuf, Jann Horn,
	Heiko Carstens, Andy Lutomirski

Since the dawn of time, a kernel stack overflow has been a real PITA
to debug, has caused nondeterministic crashes some time after the
actual overflow, and has generally been easy to exploit for root.

With this series, arches can enable HAVE_ARCH_VMAP_STACK.  Arches
that enable it (just x86 for now) get virtually mapped stacks with
guard pages.  This causes reliable faults when the stack overflows.

If the arch implements it well, we get a nice OOPS on stack overflow
(as opposed to panicing directly or otherwise exploding badly).  On
x86, the OOPS is nice, has a usable call trace, and the overflowing
task is killed cleanly.

On my laptop, this adds about 1.5µs of overhead to task creation,
which seems to be mainly caused by vmalloc inefficiently allocating
individual pages even when a higher-order page is available on the
freelist.

This does not address interrupt stacks.  It also does not address
the possibility of privilege escalation by a controlled stack
overflow that overwrites thread_info without hitting the guard page.
I'll send patches to address the latter issue once this series
lands.

It's worth noting that s390 has an arch-specific gcc feature that
detects stack overflows by adjusting function prologues.  Arches
with features like that may wish to avoid using vmapped stacks to
minimize the performance hit.

Ingo, would it make sense to throw it into a seaparate branch in
-tip?  I wouldn't mind seeing some -next testing to give people a
chance to shake out problems.  I'm particularly interested in
whether there are any drivers that expect virt_to_phys to work on
stack addresses.  (I know that virtio-net used to, but I fixed that
a while back.)

Changes from v2:
 - Delete kerne_unmap_pages_in_pgd rather than hardening it (Borislav)
 - Fix sub-page stack accounting better (Josh)

Changes from v1:
 - Fix rewind_stack_and_do_exit (Josh)
 - Fix deadlock under load
 - Clean up generic stack vmalloc code
 - Many other minor fixes

Andy Lutomirski (12):
  x86/cpa: In populate_pgd, don't set the pgd entry until it's populated
  x86/mm: Remove kernel_unmap_pages_in_pgd() and
    efi_cleanup_page_tables()
  mm: Track NR_KERNEL_STACK in KiB instead of number of stacks
  mm: Fix memcg stack accounting for sub-page stacks
  fork: Add generic vmalloced stack support
  x86/die: Don't try to recover from an OOPS on a non-default stack
  x86/dumpstack: When OOPSing, rewind the stack before do_exit
  x86/dumpstack: When dumping stack bytes due to OOPS, start with
    regs->sp
  x86/dumpstack: Try harder to get a call trace on stack overflow
  x86/dumpstack/64: Handle faults when printing the "Stack:" part of an
    OOPS
  x86/mm/64: Enable vmapped stacks
  x86/mm: Improve stack-overflow #PF handling

Ingo Molnar (1):
  x86/mm/hotplug: Don't remove PGD entries in remove_pagetable()

 arch/Kconfig                         | 29 ++++++++++++
 arch/ia64/include/asm/thread_info.h  |  2 +-
 arch/x86/Kconfig                     |  1 +
 arch/x86/entry/entry_32.S            | 11 +++++
 arch/x86/entry/entry_64.S            | 11 +++++
 arch/x86/include/asm/efi.h           |  1 -
 arch/x86/include/asm/pgtable_types.h |  2 -
 arch/x86/include/asm/switch_to.h     | 28 +++++++++++-
 arch/x86/include/asm/traps.h         |  6 +++
 arch/x86/kernel/dumpstack.c          | 19 +++++++-
 arch/x86/kernel/dumpstack_32.c       |  4 +-
 arch/x86/kernel/dumpstack_64.c       | 16 +++++--
 arch/x86/kernel/traps.c              | 32 ++++++++++++++
 arch/x86/mm/fault.c                  | 39 ++++++++++++++++
 arch/x86/mm/init_64.c                | 27 -----------
 arch/x86/mm/pageattr.c               | 32 ++------------
 arch/x86/mm/tlb.c                    | 15 +++++++
 arch/x86/platform/efi/efi.c          |  2 -
 arch/x86/platform/efi/efi_32.c       |  3 --
 arch/x86/platform/efi/efi_64.c       |  5 ---
 drivers/base/node.c                  |  3 +-
 fs/proc/meminfo.c                    |  2 +-
 include/linux/memcontrol.h           |  2 +-
 include/linux/mmzone.h               |  2 +-
 include/linux/sched.h                | 15 +++++++
 kernel/fork.c                        | 86 +++++++++++++++++++++++++++---------
 mm/memcontrol.c                      |  2 +-
 mm/page_alloc.c                      |  3 +-
 28 files changed, 295 insertions(+), 105 deletions(-)

-- 
2.5.5

^ permalink raw reply	[flat|nested] 269+ messages in thread

end of thread, other threads:[~2016-09-06 16:40 UTC | newest]

Thread overview: 269+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-20 23:43 [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Andy Lutomirski
2016-06-20 23:43 ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 01/13] x86/mm/hotplug: Don't remove PGD entries in remove_pagetable() Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 02/13] x86/cpa: In populate_pgd, don't set the pgd entry until it's populated Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 03/13] x86/mm: Remove kernel_unmap_pages_in_pgd() and efi_cleanup_page_tables() Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-21  9:53   ` Matt Fleming
2016-06-21  9:53     ` [kernel-hardening] " Matt Fleming
2016-06-21  9:53     ` Matt Fleming
2016-06-20 23:43 ` [PATCH v3 04/13] mm: Track NR_KERNEL_STACK in KiB instead of number of stacks Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-21  9:46   ` Vladimir Davydov
2016-06-21  9:46     ` [kernel-hardening] " Vladimir Davydov
2016-06-21  9:46     ` Vladimir Davydov
2016-06-21  9:46     ` Vladimir Davydov
2016-06-22  7:35   ` Michal Hocko
2016-06-22  7:35     ` [kernel-hardening] " Michal Hocko
2016-06-22  7:35     ` Michal Hocko
2016-06-22  7:35     ` Michal Hocko
2016-06-20 23:43 ` [PATCH v3 05/13] mm: Fix memcg stack accounting for sub-page stacks Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-21  9:54   ` Vladimir Davydov
2016-06-21  9:54     ` [kernel-hardening] " Vladimir Davydov
2016-06-21  9:54     ` Vladimir Davydov
2016-06-21  9:54     ` Vladimir Davydov
2016-06-22  7:38   ` Michal Hocko
2016-06-22  7:38     ` [kernel-hardening] " Michal Hocko
2016-06-22  7:38     ` Michal Hocko
2016-06-22  7:38     ` Michal Hocko
2016-06-20 23:43 ` [PATCH v3 06/13] fork: Add generic vmalloced stack support Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-21  7:30   ` Jann Horn
2016-06-21  7:30     ` [kernel-hardening] " Jann Horn
2016-06-21  7:30     ` Jann Horn
2016-06-21 16:59     ` Andy Lutomirski
2016-06-21 16:59       ` [kernel-hardening] " Andy Lutomirski
2016-06-21 16:59       ` Andy Lutomirski
2016-06-21 17:13       ` Kees Cook
2016-06-21 17:13         ` [kernel-hardening] " Kees Cook
2016-06-21 17:13         ` Kees Cook
2016-06-21 17:28         ` Andy Lutomirski
2016-06-21 17:28           ` [kernel-hardening] " Andy Lutomirski
2016-06-21 17:28           ` Andy Lutomirski
2016-06-21 18:32         ` [kernel-hardening] " Rik van Riel
2016-06-21 18:32           ` Rik van Riel
2016-06-21 19:44           ` [kernel-hardening] " Arnd Bergmann
2016-06-21 19:44             ` Arnd Bergmann
2016-06-21 19:43             ` [kernel-hardening] " Andy Lutomirski
2016-06-21 19:43               ` Andy Lutomirski
2016-06-21 19:43               ` Andy Lutomirski
2016-07-11 17:00           ` [kernel-hardening] " Andrey Ryabinin
2016-06-20 23:43 ` [PATCH v3 07/13] x86/die: Don't try to recover from an OOPS on a non-default stack Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 08/13] x86/dumpstack: When OOPSing, rewind the stack before do_exit Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 09/13] x86/dumpstack: When dumping stack bytes due to OOPS, start with regs->sp Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 10/13] x86/dumpstack: Try harder to get a call trace on stack overflow Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 11/13] x86/dumpstack/64: Handle faults when printing the "Stack:" part of an OOPS Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 12/13] x86/mm/64: Enable vmapped stacks Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 13/13] x86/mm: Improve stack-overflow #PF handling Andy Lutomirski
2016-06-20 23:43   ` [kernel-hardening] " Andy Lutomirski
2016-06-20 23:43   ` Andy Lutomirski
2016-06-21  4:01 ` [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Linus Torvalds
2016-06-21  4:01   ` [kernel-hardening] " Linus Torvalds
2016-06-21  4:01   ` Linus Torvalds
2016-06-21 16:45   ` Andy Lutomirski
2016-06-21 16:45     ` [kernel-hardening] " Andy Lutomirski
2016-06-21 16:45     ` Andy Lutomirski
2016-06-21 17:16     ` Linus Torvalds
2016-06-21 17:16       ` [kernel-hardening] " Linus Torvalds
2016-06-21 17:16       ` Linus Torvalds
2016-06-21 17:27       ` Andy Lutomirski
2016-06-21 17:27         ` [kernel-hardening] " Andy Lutomirski
2016-06-21 17:27         ` Andy Lutomirski
2016-06-21 18:12         ` Kees Cook
2016-06-21 18:12           ` [kernel-hardening] " Kees Cook
2016-06-21 18:12           ` Kees Cook
2016-06-21 18:19           ` [kernel-hardening] " Rik van Riel
2016-06-21 18:19             ` Rik van Riel
2016-06-23  1:22   ` Andy Lutomirski
2016-06-23  1:22     ` [kernel-hardening] " Andy Lutomirski
2016-06-23  1:22     ` Andy Lutomirski
2016-06-23  6:02     ` Linus Torvalds
2016-06-23  6:02       ` [kernel-hardening] " Linus Torvalds
2016-06-23  6:02       ` Linus Torvalds
2016-06-23 14:31       ` Oleg Nesterov
2016-06-23 14:31         ` [kernel-hardening] " Oleg Nesterov
2016-06-23 14:31         ` Oleg Nesterov
2016-06-23 16:30         ` Linus Torvalds
2016-06-23 16:30           ` [kernel-hardening] " Linus Torvalds
2016-06-23 16:30           ` Linus Torvalds
2016-06-23 16:41           ` Andy Lutomirski
2016-06-23 16:41             ` [kernel-hardening] " Andy Lutomirski
2016-06-23 16:41             ` Andy Lutomirski
2016-06-23 17:10             ` Oleg Nesterov
2016-06-23 17:10               ` [kernel-hardening] " Oleg Nesterov
2016-06-23 17:10               ` Oleg Nesterov
2016-09-06 16:19             ` Jann Horn
2016-09-06 16:19               ` [kernel-hardening] " Jann Horn
2016-09-06 16:19               ` Jann Horn
2016-09-06 16:40               ` Andy Lutomirski
2016-09-06 16:40                 ` [kernel-hardening] " Andy Lutomirski
2016-09-06 16:40                 ` Andy Lutomirski
2016-06-23 17:03           ` Oleg Nesterov
2016-06-23 17:03             ` [kernel-hardening] " Oleg Nesterov
2016-06-23 17:03             ` Oleg Nesterov
2016-06-23 17:44             ` Linus Torvalds
2016-06-23 17:44               ` [kernel-hardening] " Linus Torvalds
2016-06-23 17:44               ` Linus Torvalds
2016-06-23 17:52               ` Linus Torvalds
2016-06-23 17:52                 ` [kernel-hardening] " Linus Torvalds
2016-06-23 17:52                 ` Linus Torvalds
2016-06-23 18:00                 ` Kees Cook
2016-06-23 18:00                   ` [kernel-hardening] " Kees Cook
2016-06-23 18:00                   ` Kees Cook
2016-06-23 18:54                   ` Peter Zijlstra
2016-06-23 18:54                     ` [kernel-hardening] " Peter Zijlstra
2016-06-23 18:54                     ` Peter Zijlstra
2016-06-23 18:12                 ` Oleg Nesterov
2016-06-23 18:12                   ` [kernel-hardening] " Oleg Nesterov
2016-06-23 18:12                   ` Oleg Nesterov
2016-06-23 18:55                   ` Peter Zijlstra
2016-06-23 18:55                     ` [kernel-hardening] " Peter Zijlstra
2016-06-23 18:55                     ` Peter Zijlstra
2016-06-23 18:46                 ` Linus Torvalds
2016-06-23 18:46                   ` [kernel-hardening] " Linus Torvalds
2016-06-23 18:46                   ` Linus Torvalds
2016-06-23 19:08                   ` Andy Lutomirski
2016-06-23 19:08                     ` [kernel-hardening] " Andy Lutomirski
2016-06-23 19:08                     ` Andy Lutomirski
2016-06-23 18:53                 ` Peter Zijlstra
2016-06-23 18:53                   ` [kernel-hardening] " Peter Zijlstra
2016-06-23 18:53                   ` Peter Zijlstra
2016-06-23 19:09                   ` Andy Lutomirski
2016-06-23 19:09                     ` [kernel-hardening] " Andy Lutomirski
2016-06-23 19:09                     ` Andy Lutomirski
2016-06-23 19:13                     ` Peter Zijlstra
2016-06-23 19:13                       ` [kernel-hardening] " Peter Zijlstra
2016-06-23 19:13                       ` Peter Zijlstra
2016-06-23 19:17                   ` Linus Torvalds
2016-06-23 19:17                     ` [kernel-hardening] " Linus Torvalds
2016-06-23 19:17                     ` Linus Torvalds
2016-06-24  6:17                     ` Linus Torvalds
2016-06-24  6:17                       ` [kernel-hardening] " Linus Torvalds
2016-06-24  6:17                       ` Linus Torvalds
2016-06-24 12:25                       ` Brian Gerst
2016-06-24 12:25                         ` [kernel-hardening] " Brian Gerst
2016-06-24 12:25                         ` Brian Gerst
2016-06-24 17:21                         ` Linus Torvalds
2016-06-24 17:21                           ` [kernel-hardening] " Linus Torvalds
2016-06-24 17:21                           ` Linus Torvalds
2016-06-24 17:40                           ` Linus Torvalds
2016-06-24 17:40                             ` [kernel-hardening] " Linus Torvalds
2016-06-24 17:40                             ` Linus Torvalds
2016-06-24 17:47                             ` Andy Lutomirski
2016-06-24 17:47                               ` [kernel-hardening] " Andy Lutomirski
2016-06-24 17:47                               ` Andy Lutomirski
2016-06-24 17:56                               ` Linus Torvalds
2016-06-24 17:56                                 ` [kernel-hardening] " Linus Torvalds
2016-06-24 17:56                                 ` Linus Torvalds
2016-06-24 18:36                                 ` Andy Lutomirski
2016-06-24 18:36                                   ` [kernel-hardening] " Andy Lutomirski
2016-06-24 18:36                                   ` Andy Lutomirski
2016-06-24 17:51                             ` Linus Torvalds
2016-06-24 17:51                               ` [kernel-hardening] " Linus Torvalds
2016-06-24 17:51                               ` Linus Torvalds
2016-06-24 18:11                               ` Linus Torvalds
2016-06-24 18:11                                 ` [kernel-hardening] " Linus Torvalds
2016-06-24 18:11                                 ` Linus Torvalds
2016-06-24 20:25                                 ` Josh Poimboeuf
2016-06-24 20:25                                   ` [kernel-hardening] " Josh Poimboeuf
2016-06-24 20:25                                   ` Josh Poimboeuf
2016-06-24 20:51                                   ` Josh Poimboeuf
2016-06-24 20:51                                     ` [kernel-hardening] " Josh Poimboeuf
2016-06-24 20:51                                     ` Josh Poimboeuf
2016-06-24 20:53                                     ` Andy Lutomirski
2016-06-24 20:53                                       ` [kernel-hardening] " Andy Lutomirski
2016-06-24 20:53                                       ` Andy Lutomirski
2016-06-24 21:06                                     ` Linus Torvalds
2016-06-24 21:06                                       ` [kernel-hardening] " Linus Torvalds
2016-06-24 21:06                                       ` Linus Torvalds
2016-06-24 21:25                                       ` Andy Lutomirski
2016-06-24 21:25                                         ` [kernel-hardening] " Andy Lutomirski
2016-06-24 21:25                                         ` Andy Lutomirski
2016-06-24 21:32                                         ` Linus Torvalds
2016-06-24 21:32                                           ` [kernel-hardening] " Linus Torvalds
2016-06-24 21:32                                           ` Linus Torvalds
2016-06-24 21:34                                           ` Andy Lutomirski
2016-06-24 21:34                                             ` [kernel-hardening] " Andy Lutomirski
2016-06-24 21:34                                             ` Andy Lutomirski
2016-06-25  2:41                                             ` Linus Torvalds
2016-06-25  2:41                                               ` [kernel-hardening] " Linus Torvalds
2016-06-25  2:41                                               ` Linus Torvalds
2016-06-25 23:19                                               ` Andy Lutomirski
2016-06-25 23:19                                                 ` [kernel-hardening] " Andy Lutomirski
2016-06-25 23:19                                                 ` Andy Lutomirski
2016-06-25 23:30                                                 ` Andy Lutomirski
2016-06-25 23:30                                                   ` [kernel-hardening] " Andy Lutomirski
2016-06-25 23:30                                                   ` Andy Lutomirski
2016-06-26  1:23                                                   ` Linus Torvalds
2016-06-26  1:23                                                     ` [kernel-hardening] " Linus Torvalds
2016-06-26  1:23                                                     ` Linus Torvalds
2016-06-23 18:52               ` Oleg Nesterov
2016-06-23 18:52                 ` [kernel-hardening] " Oleg Nesterov
2016-06-23 18:52                 ` Oleg Nesterov
2016-06-24 14:05                 ` Michal Hocko
2016-06-24 14:05                   ` [kernel-hardening] " Michal Hocko
2016-06-24 14:05                   ` Michal Hocko
2016-06-24 15:06                   ` Michal Hocko
2016-06-24 15:06                     ` [kernel-hardening] " Michal Hocko
2016-06-24 15:06                     ` Michal Hocko
2016-06-24 15:06                     ` Michal Hocko
2016-06-24 20:22                     ` Oleg Nesterov
2016-06-24 20:22                       ` [kernel-hardening] " Oleg Nesterov
2016-06-24 20:22                       ` Oleg Nesterov
2016-06-27 10:36                       ` Michal Hocko
2016-06-27 10:36                         ` [kernel-hardening] " Michal Hocko
2016-06-27 10:36                         ` Michal Hocko
2016-06-23 19:11         ` Peter Zijlstra
2016-06-23 19:11           ` [kernel-hardening] " Peter Zijlstra
2016-06-23 19:11           ` Peter Zijlstra
2016-06-23 19:34           ` Linus Torvalds
2016-06-23 19:34             ` [kernel-hardening] " Linus Torvalds
2016-06-23 19:34             ` Linus Torvalds
2016-06-23 19:46             ` Peter Zijlstra
2016-06-23 19:46               ` [kernel-hardening] " Peter Zijlstra
2016-06-23 19:46               ` Peter Zijlstra
2016-06-21  9:24 ` Arnd Bergmann
2016-06-21  9:24   ` [kernel-hardening] " Arnd Bergmann
2016-06-21  9:24   ` Arnd Bergmann
2016-06-21 17:16   ` Kees Cook
2016-06-21 17:16     ` [kernel-hardening] " Kees Cook
2016-06-21 17:16     ` Kees Cook
2016-06-21 18:02     ` [kernel-hardening] " Rik van Riel
2016-06-21 18:02       ` Rik van Riel
2016-06-21 18:05       ` [kernel-hardening] " Andy Lutomirski
2016-06-21 18:05         ` Andy Lutomirski
2016-06-21 18:05         ` Andy Lutomirski
2016-06-21 19:47     ` Arnd Bergmann
2016-06-21 19:47       ` [kernel-hardening] " Arnd Bergmann
2016-06-21 19:47       ` Arnd Bergmann
2016-06-21 19:47       ` Andy Lutomirski
2016-06-21 19:47         ` [kernel-hardening] " Andy Lutomirski
2016-06-21 19:47         ` Andy Lutomirski
2016-06-21 20:18         ` Kees Cook
2016-06-21 20:18           ` [kernel-hardening] " Kees Cook
2016-06-21 20:18           ` Kees Cook

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.