linux-kernel - [PATCH] x86/kcfi: Require FRED for FineIBT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250214192210.work.253-kees@kernel.org>
Date: Fri, 14 Feb 2025 11:22:21 -0800
From: Kees Cook <kees@...nel.org>
To: Peter Zijlstra <peterz@...radead.org>
Cc: Kees Cook <kees@...nel.org>,
	Jennifer Miller <jmill@....edu>,
	Andrew Cooper <andrew.cooper3@...rix.com>,
	Sami Tolvanen <samitolvanen@...gle.com>,
	Jann Horn <jannh@...gle.com>,
	Nathan Chancellor <nathan@...nel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	Borislav Petkov <bp@...en8.de>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	x86@...nel.org,
	"H. Peter Anvin" <hpa@...or.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Josh Poimboeuf <jpoimboe@...nel.org>,
	"Mike Rapoport (Microsoft)" <rppt@...nel.org>,
	Rik van Riel <riel@...riel.com>,
	linux-kernel@...r.kernel.org,
	linux-hardening@...r.kernel.org
Subject: [PATCH] x86/kcfi: Require FRED for FineIBT

With what appears to be an unavoidable pivot gadget always present in
the kernel (the entry code), FineIBT's lack of caller-side CFI hash
validation leaves it critically flawed[1]. Require FRED for FineIBT[2]
(and probably should also require eXecute-Only memory too), and default
to kCFI when CFI is built in.

Link: https://lore.kernel.org/linux-hardening/Z60NwR4w%2F28Z7XUa@ubun/ [1]
Link: https://lore.kernel.org/linux-hardening/c46f5614-a82e-42fc-91eb-05e483a7df9c@citrix.com/ [2]
Signed-off-by: Kees Cook <kees@...nel.org>
---
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Jennifer Miller <jmill@....edu>
Cc: Andrew Cooper <andrew.cooper3@...rix.com>
Cc: Sami Tolvanen <samitolvanen@...gle.com>
Cc: Jann Horn <jannh@...gle.com>
Cc: Nathan Chancellor <nathan@...nel.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Ingo Molnar <mingo@...hat.com>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Dave Hansen <dave.hansen@...ux.intel.com>
Cc: x86@...nel.org
Cc: "H. Peter Anvin" <hpa@...or.com>
Cc: Alexei Starovoitov <ast@...nel.org>
Cc: Josh Poimboeuf <jpoimboe@...nel.org>
Cc: "Mike Rapoport (Microsoft)" <rppt@...nel.org>
---
 arch/x86/Kconfig              | 9 +++++----
 arch/x86/include/asm/cfi.h    | 2 +-
 arch/x86/kernel/alternative.c | 4 +++-
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c94dae634176..47aec3a497f6 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2432,12 +2432,13 @@ config STRICT_SIGALTSTACK_SIZE
 
 config CFI_AUTO_DEFAULT
 	bool "Attempt to use FineIBT by default at boot time"
-	depends on FINEIBT
+	depends on FINEIBT && X86_FRED
 	default y
 	help
-	  Attempt to use FineIBT by default at boot time. If enabled,
-	  this is the same as booting with "cfi=auto". If disabled,
-	  this is the same as booting with "cfi=kcfi".
+	  Attempt to use FineIBT by default at boot time if supported
+	  and sensible for the hardware. If enabled, this is the same
+	  as booting with "cfi=auto". If disabled, this is the same as
+	  booting with "cfi=kcfi".
 
 source "kernel/livepatch/Kconfig"
 
diff --git a/arch/x86/include/asm/cfi.h b/arch/x86/include/asm/cfi.h
index ef5e0a698253..dfa2ba4cceca 100644
--- a/arch/x86/include/asm/cfi.h
+++ b/arch/x86/include/asm/cfi.h
@@ -93,7 +93,7 @@
  *
  */
 enum cfi_mode {
-	CFI_AUTO,	/* FineIBT if hardware has IBT, otherwise kCFI */
+	CFI_AUTO,	/* FineIBT if hardware has IBT, FRED, and XOM */
 	CFI_OFF,	/* Taditional / IBT depending on .config */
 	CFI_KCFI,	/* Optionally CALL_PADDING, IBT, RETPOLINE */
 	CFI_FINEIBT,	/* see arch/x86/kernel/alternative.c */
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 97422292b609..acc12a6efc18 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -1323,7 +1323,9 @@ static void __apply_fineibt(s32 *start_retpoline, s32 *end_retpoline,
 
 	if (cfi_mode == CFI_AUTO) {
 		cfi_mode = CFI_KCFI;
-		if (HAS_KERNEL_IBT && cpu_feature_enabled(X86_FEATURE_IBT))
+		/* FineIBT requires IBT and will only be safe with FRED */
+		if (HAS_KERNEL_IBT && cpu_feature_enabled(X86_FEATURE_IBT) &&
+		    cpu_feature_enabled(X86_FEATURE_FRED))
 			cfi_mode = CFI_FINEIBT;
 	}
 
-- 
2.34.1