mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
feee1b8c49
The kernel code instrumentation in stackleak gcc plugin works in two stages.
At first, stack tracking is added to GIMPLE representation of every function
(except some special cases). And later, when stack frame size info is
available, stack tracking is removed from the RTL representation of the
functions with small stack frame. There is an unwanted side-effect for these
functions: some of them do useless work with caller-saved registers.
As an example of such case, proc_sys_write without() instrumentation:
55 push %rbp
41 b8 01 00 00 00 mov $0x1,%r8d
48 89 e5 mov %rsp,%rbp
e8 11 ff ff ff callq ffffffff81284610 <proc_sys_call_handler>
5d pop %rbp
c3 retq
0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
00 00 00
proc_sys_write() with instrumentation:
55 push %rbp
48 89 e5 mov %rsp,%rbp
41 56 push %r14
41 55 push %r13
41 54 push %r12
53 push %rbx
49 89 f4 mov %rsi,%r12
48 89 fb mov %rdi,%rbx
49 89 d5 mov %rdx,%r13
49 89 ce mov %rcx,%r14
4c 89 f1 mov %r14,%rcx
4c 89 ea mov %r13,%rdx
4c 89 e6 mov %r12,%rsi
48 89 df mov %rbx,%rdi
41 b8 01 00 00 00 mov $0x1,%r8d
e8 f2 fe ff ff callq ffffffff81298e80 <proc_sys_call_handler>
5b pop %rbx
41 5c pop %r12
41 5d pop %r13
41 5e pop %r14
5d pop %rbp
c3 retq
66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
00 00
Let's improve the instrumentation to avoid this:
1. Make stackleak_track_stack() save all register that it works with.
Use no_caller_saved_registers attribute for that function. This attribute
is available for x86_64 and i386 starting from gcc-7.
2. Insert calling stackleak_track_stack() in asm:
asm volatile("call stackleak_track_stack" :: "r" (current_stack_pointer))
Here we use ASM_CALL_CONSTRAINT trick from arch/x86/include/asm/asm.h.
The input constraint is taken into account during gcc shrink-wrapping
optimization. It is needed to be sure that stackleak_track_stack() call is
inserted after the prologue of the containing function, when the stack
frame is prepared.
This work is a deep reengineering of the idea described on grsecurity blog
https://grsecurity.net/resolving_an_unfortunate_stackleak_interaction
Signed-off-by: Alexander Popov <alex.popov@linux.com>
Acked-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Link: https://lore.kernel.org/r/20200624123330.83226-5-alex.popov@linux.com
Signed-off-by: Kees Cook <keescook@chromium.org>
286 lines
12 KiB
C
286 lines
12 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __LINUX_COMPILER_ATTRIBUTES_H
|
|
#define __LINUX_COMPILER_ATTRIBUTES_H
|
|
|
|
/*
|
|
* The attributes in this file are unconditionally defined and they directly
|
|
* map to compiler attribute(s), unless one of the compilers does not support
|
|
* the attribute. In that case, __has_attribute is used to check for support
|
|
* and the reason is stated in its comment ("Optional: ...").
|
|
*
|
|
* Any other "attributes" (i.e. those that depend on a configuration option,
|
|
* on a compiler, on an architecture, on plugins, on other attributes...)
|
|
* should be defined elsewhere (e.g. compiler_types.h or compiler-*.h).
|
|
* The intention is to keep this file as simple as possible, as well as
|
|
* compiler- and version-agnostic (e.g. avoiding GCC_VERSION checks).
|
|
*
|
|
* This file is meant to be sorted (by actual attribute name,
|
|
* not by #define identifier). Use the __attribute__((__name__)) syntax
|
|
* (i.e. with underscores) to avoid future collisions with other macros.
|
|
* Provide links to the documentation of each supported compiler, if it exists.
|
|
*/
|
|
|
|
/*
|
|
* __has_attribute is supported on gcc >= 5, clang >= 2.9 and icc >= 17.
|
|
* In the meantime, to support 4.6 <= gcc < 5, we implement __has_attribute
|
|
* by hand.
|
|
*
|
|
* sparse does not support __has_attribute (yet) and defines __GNUC_MINOR__
|
|
* depending on the compiler used to build it; however, these attributes have
|
|
* no semantic effects for sparse, so it does not matter. Also note that,
|
|
* in order to avoid sparse's warnings, even the unsupported ones must be
|
|
* defined to 0.
|
|
*/
|
|
#ifndef __has_attribute
|
|
# define __has_attribute(x) __GCC4_has_attribute_##x
|
|
# define __GCC4_has_attribute___assume_aligned__ (__GNUC_MINOR__ >= 9)
|
|
# define __GCC4_has_attribute___copy__ 0
|
|
# define __GCC4_has_attribute___designated_init__ 0
|
|
# define __GCC4_has_attribute___externally_visible__ 1
|
|
# define __GCC4_has_attribute___no_caller_saved_registers__ 0
|
|
# define __GCC4_has_attribute___noclone__ 1
|
|
# define __GCC4_has_attribute___nonstring__ 0
|
|
# define __GCC4_has_attribute___no_sanitize_address__ (__GNUC_MINOR__ >= 8)
|
|
# define __GCC4_has_attribute___fallthrough__ 0
|
|
#endif
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alias-function-attribute
|
|
*/
|
|
#define __alias(symbol) __attribute__((__alias__(#symbol)))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-aligned-function-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html#index-aligned-type-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-aligned-variable-attribute
|
|
*/
|
|
#define __aligned(x) __attribute__((__aligned__(x)))
|
|
#define __aligned_largest __attribute__((__aligned__))
|
|
|
|
/*
|
|
* Note: users of __always_inline currently do not write "inline" themselves,
|
|
* which seems to be required by gcc to apply the attribute according
|
|
* to its docs (and also "warning: always_inline function might not be
|
|
* inlinable [-Wattributes]" is emitted).
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-always_005finline-function-attribute
|
|
* clang: mentioned
|
|
*/
|
|
#define __always_inline inline __attribute__((__always_inline__))
|
|
|
|
/*
|
|
* The second argument is optional (default 0), so we use a variadic macro
|
|
* to make the shorthand.
|
|
*
|
|
* Beware: Do not apply this to functions which may return
|
|
* ERR_PTRs. Also, it is probably unwise to apply it to functions
|
|
* returning extra information in the low bits (but in that case the
|
|
* compiler should see some alignment anyway, when the return value is
|
|
* massaged by 'flags = ptr & 3; ptr &= ~3;').
|
|
*
|
|
* Optional: only supported since gcc >= 4.9
|
|
* Optional: not supported by icc
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-assume_005faligned-function-attribute
|
|
* clang: https://clang.llvm.org/docs/AttributeReference.html#assume-aligned
|
|
*/
|
|
#if __has_attribute(__assume_aligned__)
|
|
# define __assume_aligned(a, ...) __attribute__((__assume_aligned__(a, ## __VA_ARGS__)))
|
|
#else
|
|
# define __assume_aligned(a, ...)
|
|
#endif
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-cold-function-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Label-Attributes.html#index-cold-label-attribute
|
|
*/
|
|
#define __cold __attribute__((__cold__))
|
|
|
|
/*
|
|
* Note the long name.
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-const-function-attribute
|
|
*/
|
|
#define __attribute_const__ __attribute__((__const__))
|
|
|
|
/*
|
|
* Optional: only supported since gcc >= 9
|
|
* Optional: not supported by clang
|
|
* Optional: not supported by icc
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-copy-function-attribute
|
|
*/
|
|
#if __has_attribute(__copy__)
|
|
# define __copy(symbol) __attribute__((__copy__(symbol)))
|
|
#else
|
|
# define __copy(symbol)
|
|
#endif
|
|
|
|
/*
|
|
* Don't. Just don't. See commit 771c035372a0 ("deprecate the '__deprecated'
|
|
* attribute warnings entirely and for good") for more information.
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-deprecated-function-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html#index-deprecated-type-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-deprecated-variable-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Enumerator-Attributes.html#index-deprecated-enumerator-attribute
|
|
* clang: https://clang.llvm.org/docs/AttributeReference.html#deprecated
|
|
*/
|
|
#define __deprecated
|
|
|
|
/*
|
|
* Optional: only supported since gcc >= 5.1
|
|
* Optional: not supported by clang
|
|
* Optional: not supported by icc
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html#index-designated_005finit-type-attribute
|
|
*/
|
|
#if __has_attribute(__designated_init__)
|
|
# define __designated_init __attribute__((__designated_init__))
|
|
#else
|
|
# define __designated_init
|
|
#endif
|
|
|
|
/*
|
|
* Optional: not supported by clang
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-externally_005fvisible-function-attribute
|
|
*/
|
|
#if __has_attribute(__externally_visible__)
|
|
# define __visible __attribute__((__externally_visible__))
|
|
#else
|
|
# define __visible
|
|
#endif
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-format-function-attribute
|
|
* clang: https://clang.llvm.org/docs/AttributeReference.html#format
|
|
*/
|
|
#define __printf(a, b) __attribute__((__format__(printf, a, b)))
|
|
#define __scanf(a, b) __attribute__((__format__(scanf, a, b)))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-gnu_005finline-function-attribute
|
|
* clang: https://clang.llvm.org/docs/AttributeReference.html#gnu-inline
|
|
*/
|
|
#define __gnu_inline __attribute__((__gnu_inline__))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-malloc-function-attribute
|
|
*/
|
|
#define __malloc __attribute__((__malloc__))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html#index-mode-type-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-mode-variable-attribute
|
|
*/
|
|
#define __mode(x) __attribute__((__mode__(x)))
|
|
|
|
/*
|
|
* Optional: only supported since gcc >= 7
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/x86-Function-Attributes.html#index-no_005fcaller_005fsaved_005fregisters-function-attribute_002c-x86
|
|
* clang: https://clang.llvm.org/docs/AttributeReference.html#no-caller-saved-registers
|
|
*/
|
|
#if __has_attribute(__no_caller_saved_registers__)
|
|
# define __no_caller_saved_registers __attribute__((__no_caller_saved_registers__))
|
|
#else
|
|
# define __no_caller_saved_registers
|
|
#endif
|
|
|
|
/*
|
|
* Optional: not supported by clang
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-noclone-function-attribute
|
|
*/
|
|
#if __has_attribute(__noclone__)
|
|
# define __noclone __attribute__((__noclone__))
|
|
#else
|
|
# define __noclone
|
|
#endif
|
|
|
|
/*
|
|
* Add the pseudo keyword 'fallthrough' so case statement blocks
|
|
* must end with any of these keywords:
|
|
* break;
|
|
* fallthrough;
|
|
* goto <label>;
|
|
* return [expression];
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Statement-Attributes.html#Statement-Attributes
|
|
*/
|
|
#if __has_attribute(__fallthrough__)
|
|
# define fallthrough __attribute__((__fallthrough__))
|
|
#else
|
|
# define fallthrough do {} while (0) /* fallthrough */
|
|
#endif
|
|
|
|
/*
|
|
* Note the missing underscores.
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-noinline-function-attribute
|
|
* clang: mentioned
|
|
*/
|
|
#define noinline __attribute__((__noinline__))
|
|
|
|
/*
|
|
* Optional: only supported since gcc >= 8
|
|
* Optional: not supported by clang
|
|
* Optional: not supported by icc
|
|
*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-nonstring-variable-attribute
|
|
*/
|
|
#if __has_attribute(__nonstring__)
|
|
# define __nonstring __attribute__((__nonstring__))
|
|
#else
|
|
# define __nonstring
|
|
#endif
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-noreturn-function-attribute
|
|
* clang: https://clang.llvm.org/docs/AttributeReference.html#noreturn
|
|
* clang: https://clang.llvm.org/docs/AttributeReference.html#id1
|
|
*/
|
|
#define __noreturn __attribute__((__noreturn__))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html#index-packed-type-attribute
|
|
* clang: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-packed-variable-attribute
|
|
*/
|
|
#define __packed __attribute__((__packed__))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-pure-function-attribute
|
|
*/
|
|
#define __pure __attribute__((__pure__))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-section-function-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-section-variable-attribute
|
|
* clang: https://clang.llvm.org/docs/AttributeReference.html#section-declspec-allocate
|
|
*/
|
|
#define __section(S) __attribute__((__section__(#S)))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-unused-function-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html#index-unused-type-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-unused-variable-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Label-Attributes.html#index-unused-label-attribute
|
|
* clang: https://clang.llvm.org/docs/AttributeReference.html#maybe-unused-unused
|
|
*/
|
|
#define __always_unused __attribute__((__unused__))
|
|
#define __maybe_unused __attribute__((__unused__))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-used-function-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-used-variable-attribute
|
|
*/
|
|
#define __used __attribute__((__used__))
|
|
|
|
/*
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-weak-function-attribute
|
|
* gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-weak-variable-attribute
|
|
*/
|
|
#define __weak __attribute__((__weak__))
|
|
|
|
#endif /* __LINUX_COMPILER_ATTRIBUTES_H */
|