linux-kernel - Re: [PATCH v3 29/29] kselftest/riscv: kselftest for user mode cfi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 9 May 2024 12:16:29 -0700
From: Deepak Gupta <debug@...osinc.com>
To: Charlie Jenkins <charlie@...osinc.com>
Cc: paul.walmsley@...ive.com, rick.p.edgecombe@...el.com,
	broonie@...nel.org, Szabolcs.Nagy@....com, kito.cheng@...ive.com,
	keescook@...omium.org, ajones@...tanamicro.com,
	conor.dooley@...rochip.com, cleger@...osinc.com,
	atishp@...shpatra.org, alex@...ti.fr, bjorn@...osinc.com,
	alexghiti@...osinc.com, samuel.holland@...ive.com, conor@...nel.org,
	linux-doc@...r.kernel.org, linux-riscv@...ts.infradead.org,
	linux-kernel@...r.kernel.org, devicetree@...r.kernel.org,
	linux-mm@...ck.org, linux-arch@...r.kernel.org,
	linux-kselftest@...r.kernel.org, corbet@....net, palmer@...belt.com,
	aou@...s.berkeley.edu, robh+dt@...nel.org,
	krzysztof.kozlowski+dt@...aro.org, oleg@...hat.com,
	akpm@...ux-foundation.org, arnd@...db.de, ebiederm@...ssion.com,
	Liam.Howlett@...cle.com, vbabka@...e.cz, lstoakes@...il.com,
	shuah@...nel.org, brauner@...nel.org, andy.chiu@...ive.com,
	jerry.shih@...ive.com, hankuan.chen@...ive.com,
	greentime.hu@...ive.com, evan@...osinc.com, xiao.w.wang@...el.com,
	apatel@...tanamicro.com, mchitale@...tanamicro.com,
	dbarboza@...tanamicro.com, sameo@...osinc.com,
	shikemeng@...weicloud.com, willy@...radead.org,
	vincent.chen@...ive.com, guoren@...nel.org, samitolvanen@...gle.com,
	songshuaishuai@...ylab.org, gerg@...nel.org, heiko@...ech.de,
	bhe@...hat.com, jeeheng.sia@...rfivetech.com, cyy@...self.name,
	maskray@...gle.com, ancientmodern4@...il.com,
	mathis.salmen@...sal.de, cuiyunhui@...edance.com,
	bgray@...ux.ibm.com, mpe@...erman.id.au, baruch@...s.co.il,
	alx@...nel.org, david@...hat.com, catalin.marinas@....com,
	revest@...omium.org, josh@...htriplett.org, shr@...kernel.io,
	deller@....de, omosnace@...hat.com, ojeda@...nel.org,
	jhubbard@...dia.com
Subject: Re: [PATCH v3 29/29] kselftest/riscv: kselftest for user mode cfi

On Thu, May 09, 2024 at 11:21:15AM -0700, Charlie Jenkins wrote:
>On Wed, Apr 03, 2024 at 04:35:17PM -0700, Deepak Gupta wrote:
>> +
>> +int main(int argc, char *argv[])
>> +{
>> +	int ret = 0;
>> +	unsigned long lpad_status = 0, ss_status = 0;
>> +
>> +	ksft_print_header();
>> +
>> +	ksft_set_plan(RISCV_CFI_SELFTEST_COUNT);
>> +
>> +	ksft_print_msg("starting risc-v tests\n");
>> +
>> +	/*
>> +	 * Landing pad test. Not a lot of kernel changes to support landing
>> +	 * pad for user mode except lighting up a bit in senvcfg via a prctl
>> +	 * Enable landing pad through out the execution of test binary
>> +	 */
>> +	ret = my_syscall5(__NR_prctl, PR_GET_INDIR_BR_LP_STATUS, &lpad_status, 0, 0, 0);
>
>There is an assumption here that the libc supports setting
>INDIR_BR_LP_STATUS but does not support the standard prctl interface
>defined in <sys/prctl.h>. my_syscall5() is defined to fill in gaps in
>the libc, so this test case should also set the status manually rather
>than relying on the libc.
>
>I don't think it's necessary to define my_syscall5() since every libc
>should have a prctl() definition. However, these CFI prctls are very new
>and glibc does not yet support (correct me if I am wrong) it so these
>prctls should be enabled by the test cases.

In one of my previous patches, it was setting landing pad and shadow stack enabling
directly via handcrafted prctl macro. I changed it to check for status for following reasons

- If this binary is compiled with landing pad and shadow stack option then toolchain being used
   already has libc with shadow stack and landing pad enabling

- Currently upstream glibc toolchain dont have support but libc with toolchain has the support.

In case of shadow stack enabling, macro is needed and `prctl` function can't be used.
Because you enter `prctl` function with no shadow stack but exit with shadow stack and will lead to
fault in its epilog.

Due to all these reasons, kselftests have to be compiled with toolchain with cfi codegen and thus libc
should have support to light them up. Here tests only checks if they are already lit up, If not it fails.

Although you're spot on one thing here, since this test is assuming libc already lit-up landing pad and
shadow stack. It doesn't need macro here for status check of feature and can simply use `prctl` syscall
interface.

>
>- Charlie
>
>> +	if (ret)