gcc-plugins: arm-ssp: Prepare for THREAD_INFO_IN_TASK support

We will be enabling THREAD_INFO_IN_TASK support for ARM, which means
that we can no longer load the stack canary value by masking the stack
pointer and taking the copy that lives in thread_info. Instead, we will
be able to load it from the task_struct directly, by using the TPIDRURO
register which will hold the current task pointer when
THREAD_INFO_IN_TASK is in effect. This is much more straight-forward,
and allows us to declutter this code a bit while at it.

Note that this means that ARMv6 (non-v6K) SMP systems can no longer use
this feature, but those are quite rare to begin with, so this is a
reasonable trade off.

Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Tested-by: Amit Daniel Kachhap <amit.kachhap@arm.com>

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index fc196421b2cedb5ecf92eaeff32bcd907a2399d8..ff3e64ae959e4496ae57f2d55d4a68dc30a93692 100644 (file)
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1600,7 +1600,7 @@ config XEN
 
 config STACKPROTECTOR_PER_TASK
        bool "Use a unique stack canary value for each task"
-       depends on GCC_PLUGINS && STACKPROTECTOR && SMP && !XIP_DEFLATED_DATA
+       depends on GCC_PLUGINS && STACKPROTECTOR && THREAD_INFO_IN_TASK && !XIP_DEFLATED_DATA
        select GCC_PLUGIN_ARM_SSP_PER_TASK
        default y
        help

diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 847c31e7c36870602a7ed5906f76402f8aa57eed..b46e673a0ebe67c007720e1491beb9bac59f31f9 100644 (file)
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -273,11 +273,8 @@ ifeq ($(CONFIG_STACKPROTECTOR_PER_TASK),y)
 prepare: stack_protector_prepare
 stack_protector_prepare: prepare0
        $(eval SSP_PLUGIN_CFLAGS := \
-               -fplugin-arg-arm_ssp_per_task_plugin-tso=$(shell        \
-                       awk '{if ($$2 == "THREAD_SZ_ORDER") print $$3;}'\
-                               include/generated/asm-offsets.h)        \
                -fplugin-arg-arm_ssp_per_task_plugin-offset=$(shell     \
-                       awk '{if ($$2 == "TI_STACK_CANARY") print $$3;}'\
+                       awk '{if ($$2 == "TSK_STACK_CANARY") print $$3;}'\
                                include/generated/asm-offsets.h))
        $(eval KBUILD_CFLAGS += $(SSP_PLUGIN_CFLAGS))
        $(eval GCC_PLUGINS_CFLAGS += $(SSP_PLUGIN_CFLAGS))

diff --git a/arch/arm/include/asm/stackprotector.h b/arch/arm/include/asm/stackprotector.h
index 72a20c3a0a90b2121952161ed3839274ebf8c44a..088d03161be5ca3ab2b52fb05a281136ba5a51ae 100644 (file)
--- a/arch/arm/include/asm/stackprotector.h
+++ b/arch/arm/include/asm/stackprotector.h
@@ -39,8 +39,6 @@ static __always_inline void boot_init_stack_canary(void)
        current->stack_canary = canary;
 #ifndef CONFIG_STACKPROTECTOR_PER_TASK
        __stack_chk_guard = current->stack_canary;
-#else
-       current_thread_info()->stack_canary = current->stack_canary;
 #endif
 }
 

diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 9a18da3e10cc3b776c2e8ad06f4fa43ed0a9edeb..f0cacc733231fcdefa3f32b7b9e8fb68387c2f8a 100644 (file)
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -55,9 +55,6 @@ struct thread_info {
        struct task_struct      *task;          /* main task structure */
        __u32                   cpu;            /* cpu */
        __u32                   cpu_domain;     /* cpu domain */
-#ifdef CONFIG_STACKPROTECTOR_PER_TASK
-       unsigned long           stack_canary;
-#endif
        struct cpu_context_save cpu_context;    /* cpu context */
        __u32                   abi_syscall;    /* ABI type and syscall nr */
        __u8                    used_cp[16];    /* thread used copro */

diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
index a646a3f6440f8415aa5bb67228e49c8248387c97..9c864ee76107bd5b81630ac0c30af6a3eb34b68a 100644 (file)
--- a/arch/arm/kernel/asm-offsets.c
+++ b/arch/arm/kernel/asm-offsets.c
@@ -63,10 +63,6 @@ int main(void)
 #ifdef CONFIG_IWMMXT
   DEFINE(TI_IWMMXT_STATE,      offsetof(struct thread_info, fpstate.iwmmxt));
 #endif
-#ifdef CONFIG_STACKPROTECTOR_PER_TASK
-  DEFINE(TI_STACK_CANARY,      offsetof(struct thread_info, stack_canary));
-#endif
-  DEFINE(THREAD_SZ_ORDER,      THREAD_SIZE_ORDER);
   BLANK();
   DEFINE(S_R0,                 offsetof(struct pt_regs, ARM_r0));
   DEFINE(S_R1,                 offsetof(struct pt_regs, ARM_r1));

diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 0e2d3051741ed52df555644ebd38792cf5ee10d9..cd73c216b2729d135cefad0f620875756d9d400b 100644 (file)
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -269,10 +269,6 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start,
 
        thread_notify(THREAD_NOTIFY_COPY, thread);
 
-#ifdef CONFIG_STACKPROTECTOR_PER_TASK
-       thread->stack_canary = p->stack_canary;
-#endif
-
        return 0;
 }
 

diff --git a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
index 8c1af9bdcb1bbaadb419e876717cded98ae9c408..7328d037f9751a624b340a135dd94b6fe8811033 100644 (file)
--- a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
+++ b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
@@ -4,7 +4,7 @@
 
 __visible int plugin_is_GPL_compatible;
 
-static unsigned int sp_mask, canary_offset;
+static unsigned int canary_offset;
 
 static unsigned int arm_pertask_ssp_rtl_execute(void)
 {
@@ -13,7 +13,7 @@ static unsigned int arm_pertask_ssp_rtl_execute(void)
        for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
                const char *sym;
                rtx body;
-               rtx mask, masked_sp;
+               rtx current;
 
                /*
                 * Find a SET insn involving a SYMBOL_REF to __stack_chk_guard
@@ -30,19 +30,13 @@ static unsigned int arm_pertask_ssp_rtl_execute(void)
 
                /*
                 * Replace the source of the SET insn with an expression that
-                * produces the address of the copy of the stack canary value
-                * stored in struct thread_info
+                * produces the address of the current task's stack canary value
                 */
-               mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode)));
-               masked_sp = gen_reg_rtx(Pmode);
+               current = gen_reg_rtx(Pmode);
 
-               emit_insn_before(gen_rtx_set(masked_sp,
-                                            gen_rtx_AND(Pmode,
-                                                        stack_pointer_rtx,
-                                                        mask)),
-                                insn);
+               emit_insn_before(gen_load_tp_hard(current), insn);
 
-               SET_SRC(body) = gen_rtx_PLUS(Pmode, masked_sp,
+               SET_SRC(body) = gen_rtx_PLUS(Pmode, current,
                                             GEN_INT(canary_offset));
        }
        return 0;
@@ -72,7 +66,6 @@ __visible int plugin_init(struct plugin_name_args *plugin_info,
        const char * const plugin_name = plugin_info->base_name;
        const int argc = plugin_info->argc;
        const struct plugin_argument *argv = plugin_info->argv;
-       int tso = 0;
        int i;
 
        if (!plugin_default_version_check(version, &gcc_version)) {
@@ -91,11 +84,6 @@ __visible int plugin_init(struct plugin_name_args *plugin_info,
                        return 1;
                }
 
-               if (!strcmp(argv[i].key, "tso")) {
-                       tso = atoi(argv[i].value);
-                       continue;
-               }
-
                if (!strcmp(argv[i].key, "offset")) {
                        canary_offset = atoi(argv[i].value);
                        continue;
@@ -105,9 +93,6 @@ __visible int plugin_init(struct plugin_name_args *plugin_info,
                return 1;
        }
 
-       /* create the mask that produces the base of the stack */
-       sp_mask = ~((1U << (12 + tso)) - 1);
-
        PASS_INFO(arm_pertask_ssp_rtl, "expand", 1, PASS_POS_INSERT_AFTER);
 
        register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP,