user/sven/linux.git/scripts/gcc-plugins, branch v4.20.11

stackleak: Register the 'stackleak_cleanup' pass before the '*free_cfg' pass

2018-12-06T17:10:23Z

Currently the 'stackleak_cleanup' pass deleting a CALL insn is executed after the 'reload' pass. That allows gcc to do some weird optimization in function prologues and epilogues, which are generated later [1]. Let's avoid that by registering the 'stackleak_cleanup' pass before the '*free_cfg' pass. It's the moment when the stack frame size is already final, function prologues and epilogues are generated, and the machine-dependent code transformations are not done. [1] https://www.openwall.com/lists/kernel-hardening/2018/11/23/2 Reported-by: kbuild test robot Signed-off-by: Alexander Popov Signed-off-by: Kees Cook

stackleak: Allow runtime disabling of kernel stack erasing

2018-09-04T17:35:48Z

Introduce CONFIG_STACKLEAK_RUNTIME_DISABLE option, which provides 'stack_erasing' sysctl. It can be used in runtime to control kernel stack erasing for kernels built with CONFIG_GCC_PLUGIN_STACKLEAK. Suggested-by: Ingo Molnar Signed-off-by: Alexander Popov Tested-by: Laura Abbott Signed-off-by: Kees Cook

fs/proc: Show STACKLEAK metrics in the /proc file system

2018-09-04T17:35:48Z

Introduce CONFIG_STACKLEAK_METRICS providing STACKLEAK information about tasks via the /proc file system. In particular, /proc//stack_depth shows the maximum kernel stack consumption for the current and previous syscalls. Although this information is not precise, it can be useful for estimating the STACKLEAK performance impact for your workloads. Suggested-by: Ingo Molnar Signed-off-by: Alexander Popov Tested-by: Laura Abbott Signed-off-by: Kees Cook

gcc-plugins: Add STACKLEAK plugin for tracking the kernel stack

2018-09-04T17:35:47Z

The STACKLEAK feature erases the kernel stack before returning from syscalls. That reduces the information which kernel stack leak bugs can reveal and blocks some uninitialized stack variable attacks. This commit introduces the STACKLEAK gcc plugin. It is needed for tracking the lowest border of the kernel stack, which is important for the code erasing the used part of the kernel stack at the end of syscalls (comes in a separate commit). The STACKLEAK feature is ported from grsecurity/PaX. More information at: https://grsecurity.net/ https://pax.grsecurity.net/ This code is modified from Brad Spengler/PaX Team's code in the last public patch of grsecurity/PaX based on our understanding of the code. Changes or omissions from the original code are ours and don't reflect the original grsecurity/PaX code. Signed-off-by: Alexander Popov Tested-by: Laura Abbott Signed-off-by: Kees Cook

x86/entry: Add STACKLEAK erasing the kernel stack at the end of syscalls

2018-09-04T17:35:47Z

The STACKLEAK feature (initially developed by PaX Team) has the following benefits: 1. Reduces the information that can be revealed through kernel stack leak bugs. The idea of erasing the thread stack at the end of syscalls is similar to CONFIG_PAGE_POISONING and memzero_explicit() in kernel crypto, which all comply with FDP_RIP.2 (Full Residual Information Protection) of the Common Criteria standard. 2. Blocks some uninitialized stack variable attacks (e.g. CVE-2017-17712, CVE-2010-2963). That kind of bugs should be killed by improving C compilers in future, which might take a long time. This commit introduces the code filling the used part of the kernel stack with a poison value before returning to userspace. Full STACKLEAK feature also contains the gcc plugin which comes in a separate commit. The STACKLEAK feature is ported from grsecurity/PaX. More information at: https://grsecurity.net/ https://pax.grsecurity.net/ This code is modified from Brad Spengler/PaX Team's code in the last public patch of grsecurity/PaX based on our understanding of the code. Changes or omissions from the original code are ours and don't reflect the original grsecurity/PaX code. Performance impact: Hardware: Intel Core i7-4770, 16 GB RAM Test #1: building the Linux kernel on a single core 0.91% slowdown Test #2: hackbench -s 4096 -l 2000 -g 15 -f 25 -P 4.2% slowdown So the STACKLEAK description in Kconfig includes: "The tradeoff is the performance impact: on a single CPU system kernel compilation sees a 1% slowdown, other systems and workloads may vary and you are advised to test this feature on your expected workload before deploying it". Signed-off-by: Alexander Popov Acked-by: Thomas Gleixner Reviewed-by: Dave Hansen Acked-by: Ingo Molnar Signed-off-by: Kees Cook

Merge tag 'gcc-plugins-v4.19-rc1-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2018-08-26T18:41:08Z

Pull gcc plugin fix from Kees Cook: "Lift gcc test into Kconfig. This is for better behavior when the kernel is built with Clang, reported by Stefan Agner" * tag 'gcc-plugins-v4.19-rc1-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: gcc-plugins: Disable when building under Clang

gcc-plugins: Disable when building under Clang

2018-08-23T17:06:12Z

Prior to doing compiler feature detection in Kconfig, attempts to build GCC plugins with Clang would fail the build, much in the same way missing GCC plugin headers would fail the build. However, now that this logic has been lifted into Kconfig, add an explicit test for GCC (instead of duplicating it in the feature-test script). Reported-by: Stefan Agner Signed-off-by: Kees Cook Reviewed-by: Masahiro Yamada

gcc-plugins: Clean up the cgraph_create_edge* macros

2018-07-24T23:14:06Z

Drop useless redefinitions of cgraph_create_edge* macros. Drop the unused nest argument. Also support gcc-8, which doesn't have freq argument. Signed-off-by: Alexander Popov Signed-off-by: Kees Cook

gcc-plugins: split out Kconfig entries to scripts/gcc-plugins/Kconfig

2018-07-24T23:11:07Z

Collect relevant code into the scripts/gcc-plugins directory. Signed-off-by: Masahiro Yamada Signed-off-by: Kees Cook

gcc-plugins: remove unused GCC_PLUGIN_SUBDIR

2018-07-03T02:27:00Z

GCC_PLUGIN_SUBDIR has never been used. If you really need this in the future, please re-add it then. For now, the code is unused. Remove. 'export HOSTLIBS' is not necessary either. Signed-off-by: Masahiro Yamada Signed-off-by: Kees Cook