Skip to content

Commit 2e53b87

Browse files
keeskees
committed
lkdtm: Add CFI_BACKWARD to test ROP mitigations
In order to test various backward-edge control flow integrity methods, add a test that manipulates the return address on the stack. Currently only arm64 Pointer Authentication and Shadow Call Stack is supported. $ echo CFI_BACKWARD | cat >/sys/kernel/debug/provoke-crash/DIRECT Under SCS, successful test of the mitigation is reported as: lkdtm: Performing direct entry CFI_BACKWARD lkdtm: Attempting unchecked stack return address redirection ... lkdtm: ok: redirected stack return address. lkdtm: Attempting checked stack return address redirection ... lkdtm: ok: control flow unchanged. Under PAC, successful test of the mitigation is reported by the PAC exception handler: lkdtm: Performing direct entry CFI_BACKWARD lkdtm: Attempting unchecked stack return address redirection ... lkdtm: ok: redirected stack return address. lkdtm: Attempting checked stack return address redirection ... Unable to handle kernel paging request at virtual address bfffffc0088d0514 Mem abort info: ESR = 0x86000004 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault [bfffffc0088d0514] address between user and kernel address ranges ... If the CONFIGs are missing (or the mitigation isn't working), failure is reported as: lkdtm: Performing direct entry CFI_BACKWARD lkdtm: Attempting unchecked stack return address redirection ... lkdtm: ok: redirected stack return address. lkdtm: Attempting checked stack return address redirection ... lkdtm: FAIL: stack return address was redirected! lkdtm: This is probably expected, since this kernel was built *without* CONFIG_ARM64_PTR_AUTH_KERNEL=y nor CONFIG_SHADOW_CALL_STACK=y Co-developed-by: Dan Li <[email protected]> Signed-off-by: Dan Li <[email protected]> Cc: Arnd Bergmann <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Signed-off-by: Kees Cook <[email protected]> Link: https://lore.kernel.org/lkml/[email protected]
1 parent 73f62e6 commit 2e53b87

File tree

2 files changed

+135
-0
lines changed

2 files changed

+135
-0
lines changed

‎drivers/misc/lkdtm/cfi.c‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
* This is for all the tests relating directly to Control Flow Integrity.
44
*/
55
#include "lkdtm.h"
6+
#include <asm/page.h>
67

78
static int called_count;
89

@@ -42,8 +43,141 @@ static void lkdtm_CFI_FORWARD_PROTO(void)
4243
pr_expected_config(CONFIG_CFI_CLANG);
4344
}
4445

46+
/*
47+
* This can stay local to LKDTM, as there should not be a production reason
48+
* to disable PAC && SCS.
49+
*/
50+
#ifdef CONFIG_ARM64_PTR_AUTH_KERNEL
51+
# ifdef CONFIG_ARM64_BTI_KERNEL
52+
# define __no_pac "branch-protection=bti"
53+
# else
54+
# define __no_pac "branch-protection=none"
55+
# endif
56+
# define __no_ret_protection __noscs __attribute__((__target__(__no_pac)))
57+
#else
58+
# define __no_ret_protection __noscs
59+
#endif
60+
61+
#define no_pac_addr(addr) \
62+
((__force __typeof__(addr))((__force u64)(addr) | PAGE_OFFSET))
63+
64+
/* The ultimate ROP gadget. */
65+
static noinline __no_ret_protection
66+
void set_return_addr_unchecked(unsigned long *expected, unsigned long *addr)
67+
{
68+
/* Use of volatile is to make sure final write isn't seen as a dead store. */
69+
unsigned long * volatile *ret_addr = (unsigned long **)__builtin_frame_address(0) + 1;
70+
71+
/* Make sure we've found the right place on the stack before writing it. */
72+
if (no_pac_addr(*ret_addr) == expected)
73+
*ret_addr = (addr);
74+
else
75+
/* Check architecture, stack layout, or compiler behavior... */
76+
pr_warn("Eek: return address mismatch! %px != %px\n",
77+
*ret_addr, addr);
78+
}
79+
80+
static noinline
81+
void set_return_addr(unsigned long *expected, unsigned long *addr)
82+
{
83+
/* Use of volatile is to make sure final write isn't seen as a dead store. */
84+
unsigned long * volatile *ret_addr = (unsigned long **)__builtin_frame_address(0) + 1;
85+
86+
/* Make sure we've found the right place on the stack before writing it. */
87+
if (no_pac_addr(*ret_addr) == expected)
88+
*ret_addr = (addr);
89+
else
90+
/* Check architecture, stack layout, or compiler behavior... */
91+
pr_warn("Eek: return address mismatch! %px != %px\n",
92+
*ret_addr, addr);
93+
}
94+
95+
static volatile int force_check;
96+
97+
static void lkdtm_CFI_BACKWARD(void)
98+
{
99+
/* Use calculated gotos to keep labels addressable. */
100+
void *labels[] = {0, &&normal, &&redirected, &&check_normal, &&check_redirected};
101+
102+
pr_info("Attempting unchecked stack return address redirection ...\n");
103+
104+
/* Always false */
105+
if (force_check) {
106+
/*
107+
* Prepare to call with NULLs to avoid parameters being treated as
108+
* constants in -02.
109+
*/
110+
set_return_addr_unchecked(NULL, NULL);
111+
set_return_addr(NULL, NULL);
112+
if (force_check)
113+
goto *labels[1];
114+
if (force_check)
115+
goto *labels[2];
116+
if (force_check)
117+
goto *labels[3];
118+
if (force_check)
119+
goto *labels[4];
120+
return;
121+
}
122+
123+
/*
124+
* Use fallthrough switch case to keep basic block ordering between
125+
* set_return_addr*() and the label after it.
126+
*/
127+
switch (force_check) {
128+
case 0:
129+
set_return_addr_unchecked(&&normal, &&redirected);
130+
fallthrough;
131+
case 1:
132+
normal:
133+
/* Always true */
134+
if (!force_check) {
135+
pr_err("FAIL: stack return address manipulation failed!\n");
136+
/* If we can't redirect "normally", we can't test mitigations. */
137+
return;
138+
}
139+
break;
140+
default:
141+
redirected:
142+
pr_info("ok: redirected stack return address.\n");
143+
break;
144+
}
145+
146+
pr_info("Attempting checked stack return address redirection ...\n");
147+
148+
switch (force_check) {
149+
case 0:
150+
set_return_addr(&&check_normal, &&check_redirected);
151+
fallthrough;
152+
case 1:
153+
check_normal:
154+
/* Always true */
155+
if (!force_check) {
156+
pr_info("ok: control flow unchanged.\n");
157+
return;
158+
}
159+
160+
check_redirected:
161+
pr_err("FAIL: stack return address was redirected!\n");
162+
break;
163+
}
164+
165+
if (IS_ENABLED(CONFIG_ARM64_PTR_AUTH_KERNEL)) {
166+
pr_expected_config(CONFIG_ARM64_PTR_AUTH_KERNEL);
167+
return;
168+
}
169+
if (IS_ENABLED(CONFIG_SHADOW_CALL_STACK)) {
170+
pr_expected_config(CONFIG_SHADOW_CALL_STACK);
171+
return;
172+
}
173+
pr_warn("This is probably expected, since this %s was built *without* %s=y nor %s=y\n",
174+
lkdtm_kernel_info,
175+
"CONFIG_ARM64_PTR_AUTH_KERNEL", "CONFIG_SHADOW_CALL_STACK");
176+
}
177+
45178
static struct crashtype crashtypes[] = {
46179
CRASHTYPE(CFI_FORWARD_PROTO),
180+
CRASHTYPE(CFI_BACKWARD),
47181
};
48182

49183
struct crashtype_category cfi_crashtypes = {

‎tools/testing/selftests/lkdtm/tests.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ USERCOPY_STACK_BEYOND
7474
USERCOPY_KERNEL
7575
STACKLEAK_ERASING OK: the rest of the thread stack is properly erased
7676
CFI_FORWARD_PROTO
77+
CFI_BACKWARD call trace:|ok: control flow unchanged
7778
FORTIFIED_STRSCPY
7879
FORTIFIED_OBJECT
7980
FORTIFIED_SUBOBJECT

0 commit comments

Comments
 (0)