From: Dan Li <ashimida@linux.alibaba.com>
To: Kees Cook <keescook@chromium.org>
Cc: akpm@linux-foundation.org, arnd@arndb.de,
catalin.marinas@arm.com, gregkh@linuxfoundation.org,
linux@roeck-us.net, luc.vanoostenryck@gmail.com,
elver@google.com, mark.rutland@arm.com, masahiroy@kernel.org,
ojeda@kernel.org, nathan@kernel.org, npiggin@gmail.com,
ndesaulniers@google.com, samitolvanen@google.com,
shuah@kernel.org, tglx@linutronix.de, will@kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
llvm@lists.linux.dev, linux-hardening@vger.kernel.org
Subject: Re: [PATCH v3 2/2] lkdtm: Add Shadow Call Stack tests
Date: Fri, 4 Mar 2022 07:01:18 -0800 [thread overview]
Message-ID: <48268e7c-a912-c648-be69-b5e41639bf3e@linux.alibaba.com> (raw)
In-Reply-To: <c26c8946-f979-de83-38ff-ab6533b55885@linux.alibaba.com>
On 3/4/22 06:54, Dan Li wrote:
>
>
> On 3/3/22 11:09, Kees Cook wrote:
>> On Thu, Mar 03, 2022 at 10:42:45AM -0800, Kees Cook wrote:
>>> Though, having the IS_ENABLED in there makes me wonder if this test
>>> should instead be made _survivable_ on failure. Something like this,
>>> completely untested:
>>>
>>>
>>> And we should, actually, be able to make the "set_lr" functions be
>>> arch-specific, leaving the test itself arch-agnostic....
>>
>> Yeah, as a tested example, this works for x86_64, and based on what you
>> had, I'd expect it to work on arm64 too:
>>
>> #include <stdio.h>
>>
>> static __attribute__((noinline))
>> void set_return_addr(unsigned long *expected, unsigned long *addr)
>> {
>> /* Use of volatile is to make sure final write isn't seen as a dead store. */
>> unsigned long * volatile *ret_addr = (unsigned long **)__builtin_frame_address(0) + 1;
>>
>> /* Make sure we've found the right place on the stack before writing it. */
>> if (*ret_addr == expected)
>> *ret_addr = addr;
>> }
>>
>> volatile int force_label;
>> int main(void)
>> {
>> do {
>> /* Keep labels in scope. */
>> if (force_label)
>> goto normal;
>> if (force_label)
>> goto redirected;
>>
>> set_return_addr(&&normal, &&redirected);
>> normal:
>> printf("I should be skipped\n");
>> break;
>
> From the assembly code, it seems that "&&normal" does't always equal
> to the address of label "normal" when we use clang with -O2.
>
>> redirected:
>> printf("Redirected\n");
>> } while (0);
>>
>
> The address of "&&redirected" may appear in the middle of the assembly
> instructions of the printf. If we unconditionally jump to "&&normal",> it may crash directly because x0 is not set correctly.
Sorry, it should be:
The address of "&&redirected" may appear in the middle of the assembly
instructions of the printf. If we unconditionally jump to "&&redirected",
it may crash directly because x0 of printf is not set correctly.
Thanks,
Dan.
>
>> return 0;
>> }
>>
>>
>> It does _not_ work under Clang, though, which I'm still looking at.
>>
>
> AFAICT, maybe we could specify -O0 optimization to bypass this.
>
>
> BTW:
> Occasionally found, the following code works correctly, but i think
> it doesn't solve the issue :)
>
> #include <stdio.h>
>
> static __attribute__((noinline))
> void set_return_addr(unsigned long *expected, unsigned long *addr)
> {
> /* Use of volatile is to make sure final write isn't seen as a dead store. */
> unsigned long * volatile *ret_addr = (unsigned long **)__builtin_frame_address(0) + 1;
>
> /* Make sure we've found the right place on the stack before writing it. */
> // if (*ret_addr == expected)
> *ret_addr = addr;
> }
> volatile int force_label;
> int main(void)
> {
> do {
> /* Keep labels in scope. */
> if (force_label)
> goto normal;
> if (force_label)
> goto redirected;
>
> set_return_addr(&&normal, &&redirected);
> normal:
> printf("I should be skipped\n");
> break;
>
> redirected:
> printf("Redirected\n");
> printf("\n"); //add a new printf
> } while (0);
>
> return 0;
> }
next prev parent reply other threads:[~2022-03-04 15:01 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-03 7:33 [PATCH v3 0/2] AARCH64: Enable GCC-based Shadow Call Stack Dan Li
2022-03-03 7:43 ` [PATCH v3 1/2] AARCH64: Add gcc Shadow Call Stack support Dan Li
2022-03-10 18:15 ` (subset) " Kees Cook
2022-03-03 7:43 ` [PATCH v3 2/2] lkdtm: Add Shadow Call Stack tests Dan Li
2022-03-03 18:42 ` Kees Cook
2022-03-03 19:09 ` Kees Cook
2022-03-04 14:54 ` Dan Li
2022-03-04 15:01 ` Dan Li [this message]
2022-03-07 15:16 ` Dan Li
2022-03-09 20:16 ` Kees Cook
2022-03-11 2:46 ` Dan Li
2022-03-04 14:34 ` Dan Li
2022-03-14 13:53 ` [PATCH v4 " Dan Li
2022-03-14 14:02 ` Dan Li
2022-04-06 1:28 ` Dan Li
2022-04-06 1:48 ` Dan Li
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=48268e7c-a912-c648-be69-b5e41639bf3e@linux.alibaba.com \
--to=ashimida@linux.alibaba.com \
--cc=akpm@linux-foundation.org \
--cc=arnd@arndb.de \
--cc=catalin.marinas@arm.com \
--cc=elver@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=llvm@lists.linux.dev \
--cc=luc.vanoostenryck@gmail.com \
--cc=mark.rutland@arm.com \
--cc=masahiroy@kernel.org \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=npiggin@gmail.com \
--cc=ojeda@kernel.org \
--cc=samitolvanen@google.com \
--cc=shuah@kernel.org \
--cc=tglx@linutronix.de \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).