| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20250821064202.work.893-kees@kernel.org>
Date: Thu, 21 Aug 2025 00:26:33 -0700
From: Kees Cook <kees@...nel.org>
To: Qing Zhao <qing.zhao@...cle.com>
Cc: Kees Cook <kees@...nel.org>,
gcc-patches@....gnu.org,
Joseph Myers <josmyers@...hat.com>,
Richard Biener <rguenther@...e.de>,
Jan Hubicka <hubicka@....cz>,
Richard Earnshaw <richard.earnshaw@....com>,
Richard Sandiford <richard.sandiford@....com>,
Marcus Shawcroft <marcus.shawcroft@....com>,
Kyrylo Tkachov <kyrylo.tkachov@....com>,
Kito Cheng <kito.cheng@...il.com>,
Palmer Dabbelt <palmer@...belt.com>,
Andrew Waterman <andrew@...ive.com>,
Jim Wilson <jim.wilson.gcc@...il.com>,
Peter Zijlstra <peterz@...radead.org>,
Dan Li <ashimida.1990@...il.com>,
linux-hardening@...r.kernel.org
Subject: [RFC PATCH 0/7] Introduce Kernel Control Flow Integrity ABI [PR107048]
Hi!
Repeating the start of the 3rd (core kcfi) patch's commit log:
This series implements the Linux Kernel Control Flow Integrity ABI,
which provides a function prototype based forward edge control flow
integrity protection by instrumenting every indirect call to check for
a hash value before the target function address. If the hash at the call
site and the hash at the target do not match, execution will trap.
Just to set expectations, this is an RFC because this is my first time
working on most of the affected areas in GCC, and it is likely I have
missed really obvious stuff, or gone about doing things in very wrong
ways. I tried to find the best way to do stuff, but I was left with many
questions. :) All that said, this works for x86_64 and aarch64 Linux
kernels. (I have implemented riscv64 as well, but I lack a viable test
environment -- I am working on this still.)
I tried to get comments and code style into reasonable shape so as
to not distract horribly from the actual implementation details, but
I suspect I'm still missing some correct style in places. The commit
logs are not in proper ChangeLog format either. I am planning to get
that sorted once this series has gotten some review and I've actually
got code in the right places.
I gave up on trying to keep the testsuite files wrapped at 80
characters. It seemed much less readable, but I will defer to whatever
folks want to see there. :)
Thanks!
-Kees
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107048
https://github.com/KSPP/linux/issues/369
Kees Cook (7):
sanitizer: Expand sanitizer flag from 32-bit to 64-bit
mangle: Introduce C typeinfo mangling API
kcfi: Add core Kernel Control Flow Integrity infrastructure
x86: Add x86_64 Kernel Control Flow Integrity implementation
aarch64: Add AArch64 Kernel Control Flow Integrity implementation
riscv: Add RISC-V Kernel Control Flow Integrity implementation
kcfi: Add regression test suite
gcc/Makefile.in | 2 +
gcc/asan.h | 4 +-
gcc/c-family/c-common.h | 2 +-
gcc/config/aarch64/aarch64-protos.h | 4 +
gcc/config/i386/i386-protos.h | 4 +
gcc/config/riscv/riscv-protos.h | 1 +
gcc/flag-types.h | 66 +-
gcc/kcfi.h | 85 ++
gcc/mangle.h | 29 +
gcc/opts.h | 8 +-
gcc/selftest.h | 1 +
gcc/tree-pass.h | 1 +
gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-esr.c | 36 +
gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c | 83 ++
gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c | 83 ++
gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c | 75 ++
.../gcc.dg/kcfi/kcfi-cold-partition.c | 133 +++
.../gcc.dg/kcfi/kcfi-complex-addressing.c | 116 +++
.../gcc.dg/kcfi/kcfi-insn-sequence.c | 42 +
.../gcc.dg/kcfi/kcfi-ipa-robustness.c | 54 ++
.../gcc.dg/kcfi/kcfi-no-sanitize-inline.c | 96 ++
gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c | 39 +
.../gcc.dg/kcfi/kcfi-offset-validation.c | 41 +
.../gcc.dg/kcfi/kcfi-patchable-basic.c | 54 ++
.../gcc.dg/kcfi/kcfi-patchable-entry-only.c | 36 +
.../gcc.dg/kcfi/kcfi-patchable-large.c | 47 +
.../gcc.dg/kcfi/kcfi-patchable-medium.c | 52 ++
.../gcc.dg/kcfi/kcfi-patchable-none.c | 18 +
.../gcc.dg/kcfi/kcfi-patchable-prefix-only.c | 48 +
.../gcc.dg/kcfi/kcfi-pic-addressing.c | 98 ++
gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c | 111 +++
gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c | 56 ++
.../gcc.dg/kcfi/kcfi-type-mangling.c | 864 ++++++++++++++++++
gcc/c-family/c-attribs.cc | 19 +-
gcc/c/c-parser.cc | 4 +-
gcc/cfgcleanup.cc | 20 +
gcc/cfgexpand.cc | 61 ++
gcc/combine.cc | 1 +
gcc/common.opt | 2 +-
gcc/config/aarch64/aarch64.cc | 112 +++
gcc/config/aarch64/aarch64.md | 137 +++
gcc/config/i386/i386-options.cc | 3 +
gcc/config/i386/i386.cc | 128 +++
gcc/config/i386/i386.md | 144 +++
gcc/config/riscv/riscv.cc | 157 ++++
gcc/config/riscv/riscv.md | 49 +
gcc/cp/typeck.cc | 2 +-
gcc/d/d-attribs.cc | 8 +-
gcc/doc/invoke.texi | 76 ++
gcc/dwarf2asm.cc | 2 +-
gcc/emit-rtl.cc | 1 +
gcc/kcfi.cc | 783 ++++++++++++++++
gcc/mangle.cc | 548 +++++++++++
gcc/opts.cc | 17 +-
gcc/passes.cc | 1 +
gcc/passes.def | 3 +
gcc/recog.cc | 1 +
gcc/reg-notes.def | 6 +
gcc/targhooks.cc | 50 +-
gcc/testsuite/gcc.dg/kcfi/kcfi.exp | 36 +
gcc/toplev.cc | 8 +
gcc/varasm.cc | 18 +
62 files changed, 4721 insertions(+), 65 deletions(-)
create mode 100644 gcc/kcfi.h
create mode 100644 gcc/mangle.h
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-esr.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-cold-partition.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-complex-addressing.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-insn-sequence.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-ipa-robustness.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize-inline.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-offset-validation.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-basic.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-entry-only.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-large.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-medium.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-none.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-prefix-only.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-pic-addressing.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-type-mangling.c
create mode 100644 gcc/kcfi.cc
create mode 100644 gcc/mangle.cc
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi.exp
--
2.34.1
Powered by blists - more mailing lists