This series is to add copy-beyond-the-frame detection for hardened usercopy
for arm64 by adding more arguments to callbacks of stackstrace and by the way
more potential checks in the future can be done. This is done by:
- Change stacktrace callback prototype to pass more information which currently
includes pc, current stack's fp and previous frame's fp, so copying beyond the
frame can be detected.
- Add arch_within_stack_frames for arm64 based on existing x86 algorithm, but
via stacktrace.
- Make other arch_stack_walk callbacks use the new prototype.
- Tune lkdtm usercopy stack frame case. Currently the way to generate bad frame
use depends on stack layout of the architecture and compiler. It happens to
work with x86 but does not work for arm64 and it ruins the stack in
USERCOPY_STACK_FRAME_FROM and thus causes the call chain to return to NULL
address.
He Zhe (8):
stacktrace: Change callback prototype to pass more information
arm64: stacktrace: Add arch_within_stack_frames
arm64: stacktrace: Make callbacks use new prototype with frame info
powerpc: stacktrace: Make callbacks use new prototype with frame info
riscv: stacktrace: Make callbacks use new prototype with frame info
s390: stacktrace: Make callbacks use new prototype with frame info
x86: stacktrace: Make callbacks use new prototype with frame info
lkdtm: usercopy: Make USERCOPY_STACK_FRAME_x able to work for all
archs
arch/arm64/Kconfig | 1 +
arch/arm64/include/asm/thread_info.h | 12 +++++
arch/arm64/kernel/perf_callchain.c | 4 +-
arch/arm64/kernel/process.c | 6 +--
arch/arm64/kernel/return_address.c | 4 +-
arch/arm64/kernel/stacktrace.c | 76 ++++++++++++++++++++++++++--
arch/arm64/kernel/time.c | 6 +--
arch/powerpc/kernel/stacktrace.c | 18 ++++---
arch/riscv/include/asm/stacktrace.h | 2 +-
arch/riscv/kernel/perf_callchain.c | 4 +-
arch/riscv/kernel/stacktrace.c | 22 ++++----
arch/s390/kernel/stacktrace.c | 14 ++---
arch/x86/kernel/stacktrace.c | 28 ++++++----
drivers/misc/lkdtm/usercopy.c | 24 +--------
include/linux/stacktrace.h | 9 +++-
kernel/stacktrace.c | 10 ++--
16 files changed, 161 insertions(+), 79 deletions(-)
--
2.25.1