linux-kernel - Re: [PATCH] sched: fix build with GCC_PLUGIN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200627181214.3a4d4a42@oasis.local.home>
Date:   Sat, 27 Jun 2020 18:12:14 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Mike Rapoport <rppt@...nel.org>
Cc:     linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Juri Lelli <juri.lelli@...hat.com>,
        Vincent Guittot <vincent.guittot@...aro.org>,
        Dietmar Eggemann <dietmar.eggemann@....com>,
        Ben Segall <bsegall@...gle.com>, Mel Gorman <mgorman@...e.de>,
        Mike Rapoport <rppt@...ux.ibm.com>,
        Kees Cook <keescook@...omium.org>
Subject: Re: [PATCH] sched: fix build with GCC_PLUGIN_RANDSTRUCT

On Sat, 20 Jun 2020 13:41:36 +0300
Mike Rapoport <rppt@...nel.org> wrote:

> From: Mike Rapoport <rppt@...ux.ibm.com>
> 
> Since the commit a148866489fb ("sched: Replace rq::wake_list")
> task_struct and CSD_TYPE_TTWU objects can be on the same queue and this
> requires that have "layout similar enough".
> 
> This assumption is broken when CONFIG_GCC_PLUGIN_RANDSTRUCT is enabled:

You forgot to Cc Kees, who's the one that is probably the most
concerned about randomizing structures!



> 
>   CHK     include/generated/compile.h
>   CC      kernel/smp.o
> In file included from arch/x86/include/asm/atomic.h:5,
>                  from include/linux/atomic.h:7,
>                  from include/linux/llist.h:51,
>                  from include/linux/irq_work.h:5,
>                  from kernel/smp.c:10:
> kernel/smp.c: In function ‘smp_init’:
> include/linux/compiler.h:392:38: error: call to ‘__compiletime_assert_157’ declared with attribute error: BUILD_BUG_ON failed: offsetof(struct task_struct, wake_entry_type) - offsetof(struct task_struct, wake_entry) != offsetof(struct __call_single_data, flags) - offsetof(struct __call_single_data, llist)
>   392 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
>       |                                      ^
> include/linux/compiler.h:373:4: note: in definition of macro ‘__compiletime_assert’
>   373 |    prefix ## suffix();    \
>       |    ^~~~~~
> include/linux/compiler.h:392:2: note: in expansion of macro ‘_compiletime_assert’
>   392 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
>       |  ^~~~~~~~~~~~~~~~~~~
> include/linux/build_bug.h:39:37: note: in expansion of macro ‘compiletime_assert’
>    39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
>       |                                     ^~~~~~~~~~~~~~~~~~
> include/linux/build_bug.h:50:2: note: in expansion of macro ‘BUILD_BUG_ON_MSG’
>    50 |  BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
>       |  ^~~~~~~~~~~~~~~~
> kernel/smp.c:687:2: note: in expansion of macro ‘BUILD_BUG_ON’
>   687 |  BUILD_BUG_ON(offsetof(struct task_struct, wake_entry_type) - offsetof(struct task_struct, wake_entry) !=
>       |  ^~~~~~~~~~~~
> make[2]: *** [scripts/Makefile.build:280: kernel/smp.o] Error 1
> make[1]: *** [Makefile:1764: kernel] Error 2
> make[1]: *** Waiting for unfinished jobs....
> make[1]: Leaving directory '/home/mike/build/kernel'
> make: *** [Makefile:185: __sub-make] Error 2

Seems the dependency is that the offsets between wake_entry and
wake_entry_type doesn't change.

> 
> Move 'wake_entry' and 'wake_entry_type' fiels of task_struct out of
> the randomized fields to keep their layout intact.
> 
> Signed-off-by: Mike Rapoport <rppt@...ux.ibm.com>
> ---
>  include/linux/sched.h | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/sched.h b/include/linux/sched.h
> index b62e6aaf28f0..c885573669ac 100644
> --- a/include/linux/sched.h
> +++ b/include/linux/sched.h
> @@ -641,6 +641,15 @@ struct task_struct {
>  	/* -1 unrunnable, 0 runnable, >0 stopped: */
>  	volatile long			state;
>  
> +	/*
> +	 * The layout of these fields must match the layout
> CSD_TYPE_TTWU
> +	 * so they can be on the same the @call_single_queue
> +	 */
> +#ifdef CONFIG_SMP
> +	struct llist_node		wake_entry;
> +	unsigned int			wake_entry_type;
> +#endif
> +
>  	/*
>  	 * This begins the randomizable portion of task_struct. Only
>  	 * scheduling-critical items should be added above here.
> @@ -654,8 +663,6 @@ struct task_struct {
>  	unsigned int			ptrace;
>  
>  #ifdef CONFIG_SMP
> -	struct llist_node		wake_entry;
> -	unsigned int			wake_entry_type;

What about instead just create an anonymous structure of the two. That
way they can still be randomized within the task struct and not be a
target of attacks?

	struct {
		struct llist_node	wake_entry;
		unsigned int		wake_entry_type;
	};

Would that work?

-- Steve


>  	int				on_cpu;
>  #ifdef CONFIG_THREAD_INFO_IN_TASK
>  	/* Current CPU: */