From: Rich Felker <dalias@libc.org>
To: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
Cc: "corbet@lwn.net" <corbet@lwn.net>,
"ardb@kernel.org" <ardb@kernel.org>,
"maz@kernel.org" <maz@kernel.org>,
"shuah@kernel.org" <shuah@kernel.org>,
"Szabolcs.Nagy@arm.com" <Szabolcs.Nagy@arm.com>,
"keescook@chromium.org" <keescook@chromium.org>,
"james.morse@arm.com" <james.morse@arm.com>,
"debug@rivosinc.com" <debug@rivosinc.com>,
"akpm@linux-foundation.org" <akpm@linux-foundation.org>,
"catalin.marinas@arm.com" <catalin.marinas@arm.com>,
"oleg@redhat.com" <oleg@redhat.com>,
"arnd@arndb.de" <arnd@arndb.de>,
"ebiederm@xmission.com" <ebiederm@xmission.com>,
"will@kernel.org" <will@kernel.org>,
"suzuki.poulose@arm.com" <suzuki.poulose@arm.com>,
"sorear@fastmail.com" <sorear@fastmail.com>,
"oliver.upton@linux.dev" <oliver.upton@linux.dev>,
"broonie@kernel.org" <broonie@kernel.org>,
"brauner@kernel.org" <brauner@kernel.org>,
"fweimer@redhat.com" <fweimer@redhat.com>,
"aou@eecs.berkeley.edu" <aou@eecs.berkeley.edu>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"paul.walmsley@sifive.com" <paul.walmsley@sifive.com>,
"hjl.tools@gmail.com" <hjl.tools@gmail.com>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
"palmer@dabbelt.com" <palmer@dabbelt.com>,
"kvmarm@lists.linux.dev" <kvmarm@lists.linux.dev>,
"linux-arch@vger.kernel.org" <linux-arch@vger.kernel.org>,
"thiago.bauermann@linaro.org" <thiago.bauermann@linaro.org>,
"linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org>,
"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
"linux-arm-kernel@lists.infradead.org"
<linux-arm-kernel@lists.infradead.org>,
"linux-kselftest@vger.kernel.org"
<linux-kselftest@vger.kernel.org>,
"musl@lists.openwall.com" <musl@lists.openwall.com>,
"linux-riscv@lists.infradead.org"
<linux-riscv@lists.infradead.org>
Subject: Re: [musl] Re: [PATCH v8 00/38] arm64/gcs: Provide support for GCS in userspace
Date: Tue, 20 Feb 2024 13:57:15 -0500 [thread overview]
Message-ID: <20240220185714.GO4163@brightrain.aerifal.cx> (raw)
In-Reply-To: <4c7bdf8fde9cc45174f10b9221fa58ffb450b755.camel@intel.com>
On Tue, Feb 20, 2024 at 06:41:05PM +0000, Edgecombe, Rick P wrote:
> Hi,
>
> I worked on the x86 kernel shadow stack support. I think it is an
> interesting suggestion. Some questions below, and I will think more on
> it.
>
> On Tue, 2024-02-20 at 11:36 -0500, Stefan O'Rear wrote:
> > While discussing the ABI implications of shadow stacks in the context
> > of
> > Zicfiss and musl a few days ago, I had the following idea for how to
> > solve
> > the source compatibility problems with shadow stacks in POSIX.1-2004
> > and
> > POSIX.1-2017:
> >
> > 1. Introduce a "flexible shadow stack handling" option. For what
> > follows,
> > it doesn't matter if this is system-wide, per-mm, or per-vma.
> >
> > 2. Shadow stack faults on non-shadow stack pages, if flexible shadow
> > stack
> > handling is in effect, cause the affected page to become a shadow
> > stack
> > page. When this happens, the page filled with invalid address
> > tokens.
>
> Hmm, could the shadow stack underflow onto the real stack then? Not
> sure how bad that is. INCSSP (incrementing the SSP register on x86)
> loops are not rare so it seems like something that could happen.
Shadow stack underflow should fault on attempt to access
non-shadow-stack memory as shadow-stack, no?
> > Faults from non-shadow-stack accesses to a shadow-stack page which
> > was
> > created by the previous paragraph will cause the page to revert to
> > non-shadow-stack usage, with or without clearing.
>
> Won't this prevent catching stack overflows when they happen? An
> overflow will just turn the shadow stack into normal stack and only get
> detected when the shadow stack unwinds?
I don't think that's as big a problem as it sounds like. It might make
pinpointing the spot at which things went wrong take a little bit more
work, but it should not admit any wrong-execution.
> A related question would be how to handle the expanding nature of the
> initial stack. I guess the initial stack could be special and have a
> separate shadow stack.
That seems fine.
> > Important: a shadow stack operation can only load a valid address
> > from
> > a page if that page has been in continuous shadow stack use since
> > the
> > address was written by another shadow stack operation; the
> > flexibility
> > delays error reporting in cases of stray writes but it never
> > allows for
> > corruption of shadow stack operation.
>
> Shadow stacks currently have automatic guard gaps to try to prevent one
> thread from overflowing onto another thread's shadow stack. This would
> somewhat opens that up, as the stack guard gaps are usually maintained
> by userspace for new threads. It would have to be thought through if
> these could still be enforced with checking at additional spots.
I would think the existing guard pages would already do that if a
thread's shadow stack is contiguous with its own data stack.
> > 3. Standards-defined operations which use a user-provided stack
> > (makecontext, sigaltstack, pthread_attr_setstack) use a subrange
> > of the
> > provided stack for shadow stack storage. I propose to use a
> > shadow
> > stack size of 1/32 of the provided stack size, rounded up to a
> > positive
> > integer number of pages, and place the shadow stack allocation at
> > the
> > lowest page-aligned address inside the provided stack region.
> >
> > Since page usage is flexible, no change in page permissions is
> > immediately needed; this merely sets the initial shadow stack
> > pointer for
> > the new context.
> >
> > If the shadow stack grew in the opposite direction to the
> > architectural
> > stack, it would not be necessary to pick a fixed direction.
> >
> > 4. SIGSTKSZ and MINSIGSTKSZ are increased by 2 pages to provide
> > sufficient
> > space for a minimum-sized shadow stack region and worst case
> > alignment.
>
> Do all makecontext() callers ensure the size is greater than this?
>
> I guess glibc's makecontext() could do this scheme to prevent leaking
> without any changes to the kernel. Basically steal a little of the
> stack address range and overwrite it with a shadow stack mapping. But
> only if the apps leave enough room. If they need to be updated, then
> they could be updated to manage their own shadow stacks too I think.
From the musl side, I have always looked at the entirely of shadow
stack stuff with very heavy skepticism, and anything that breaks
existing interface contracts, introduced places where apps can get
auto-killed because a late resource allocation fails, or requires
applications to code around the existence of something that should be
an implementation detail, is a non-starter. To even consider shadow
stack support, it must truely be fully non-breaking.
> > _Without_ doing this, sigaltstack cannot be used to recover from
> > stack
> > overflows if the shadow stack limit is reached first, and makecontext
> > cannot be supported without memory leaks and unreportable error
> > conditions.
>
> FWIW, I think the makecontext() shadow stack leaking is a bad idea. I
> would prefer the existing makecontext() interface just didn't support
> shadow stack, rather than the leaking solution glibc does today.
AIUI the proposal by Stefan makes it non-leaking because it's just
using normal memory that reverts to normal usage on any
non-shadow-stack access.
Rich
next prev parent reply other threads:[~2024-02-20 19:12 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20240203-arm64-gcs-v8-0-c9fec77673ef@kernel.org>
2024-02-20 16:36 ` Stefan O'Rear
2024-02-20 18:41 ` Edgecombe, Rick P
2024-02-20 18:57 ` Rich Felker [this message]
2024-02-20 23:30 ` Edgecombe, Rick P
2024-02-20 23:54 ` dalias
2024-02-21 0:35 ` Edgecombe, Rick P
2024-02-21 0:44 ` Mark Brown
2024-02-21 1:27 ` dalias
2024-02-21 2:11 ` Edgecombe, Rick P
2024-02-21 4:18 ` Edgecombe, Rick P
2024-02-21 13:53 ` Mark Brown
2024-02-21 14:58 ` dalias
2024-02-21 17:36 ` Mark Brown
2024-02-21 17:57 ` dalias
2024-02-21 18:12 ` Edgecombe, Rick P
2024-02-21 18:30 ` dalias
2024-02-21 18:53 ` Edgecombe, Rick P
2024-02-21 19:06 ` dalias
2024-02-21 19:22 ` Edgecombe, Rick P
2024-02-21 20:18 ` dalias
2024-02-21 20:18 ` H.J. Lu
2024-02-21 20:25 ` H.J. Lu
2024-02-21 21:12 ` H.J. Lu
2024-02-22 13:57 ` Mark Brown
2024-02-21 18:32 ` Mark Brown
2024-02-21 19:10 ` dalias
2024-03-02 14:57 ` Szabolcs Nagy
2024-03-02 15:05 ` H.J. Lu
2024-03-14 14:03 ` Mark Brown
2024-02-20 23:59 ` Stefan O'Rear
2024-02-21 0:40 ` Mark Brown
2024-02-21 4:30 ` Edgecombe, Rick P
2024-02-20 20:14 ` Mark Brown
2024-02-20 23:30 ` Edgecombe, Rick P
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240220185714.GO4163@brightrain.aerifal.cx \
--to=dalias@libc.org \
--cc=Szabolcs.Nagy@arm.com \
--cc=akpm@linux-foundation.org \
--cc=aou@eecs.berkeley.edu \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=brauner@kernel.org \
--cc=broonie@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=corbet@lwn.net \
--cc=debug@rivosinc.com \
--cc=ebiederm@xmission.com \
--cc=fweimer@redhat.com \
--cc=hjl.tools@gmail.com \
--cc=james.morse@arm.com \
--cc=keescook@chromium.org \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-riscv@lists.infradead.org \
--cc=maz@kernel.org \
--cc=musl@lists.openwall.com \
--cc=oleg@redhat.com \
--cc=oliver.upton@linux.dev \
--cc=palmer@dabbelt.com \
--cc=paul.walmsley@sifive.com \
--cc=rick.p.edgecombe@intel.com \
--cc=shuah@kernel.org \
--cc=sorear@fastmail.com \
--cc=suzuki.poulose@arm.com \
--cc=thiago.bauermann@linaro.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).