mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
synced 2025-01-01 10:42:11 +00:00
aebc7b0d8d
Numerous production kernel configs (see [1, 2]) are choosing to enable
CONFIG_DEBUG_LIST, which is also being recommended by KSPP for hardened
configs [3]. The motivation behind this is that the option can be used
as a security hardening feature (e.g. CVE-2019-2215 and CVE-2019-2025
are mitigated by the option [4]).
The feature has never been designed with performance in mind, yet common
list manipulation is happening across hot paths all over the kernel.
Introduce CONFIG_LIST_HARDENED, which performs list pointer checking
inline, and only upon list corruption calls the reporting slow path.
To generate optimal machine code with CONFIG_LIST_HARDENED:
1. Elide checking for pointer values which upon dereference would
result in an immediate access fault (i.e. minimal hardening
checks). The trade-off is lower-quality error reports.
2. Use the __preserve_most function attribute (available with Clang,
but not yet with GCC) to minimize the code footprint for calling
the reporting slow path. As a result, function size of callers is
reduced by avoiding saving registers before calling the rarely
called reporting slow path.
Note that all TUs in lib/Makefile already disable function tracing,
including list_debug.c, and __preserve_most's implied notrace has
no effect in this case.
3. Because the inline checks are a subset of the full set of checks in
__list_*_valid_or_report(), always return false if the inline
checks failed. This avoids redundant compare and conditional
branch right after return from the slow path.
As a side-effect of the checks being inline, if the compiler can prove
some condition to always be true, it can completely elide some checks.
Since DEBUG_LIST is functionally a superset of LIST_HARDENED, the
Kconfig variables are changed to reflect that: DEBUG_LIST selects
LIST_HARDENED, whereas LIST_HARDENED itself has no dependency on
DEBUG_LIST.
Running netperf with CONFIG_LIST_HARDENED (using a Clang compiler with
"preserve_most") shows throughput improvements, in my case of ~7% on
average (up to 20-30% on some test cases).
Link: https://r.android.com/1266735 [1]
Link: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/blob/main/config [2]
Link: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings [3]
Link: https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html [4]
Signed-off-by: Marco Elver <elver@google.com>
Link: https://lore.kernel.org/r/20230811151847.1594958-3-elver@google.com
Signed-off-by: Kees Cook <keescook@chromium.org>
|
||
|---|---|---|
| .. | ||
| altera-stapl | ||
| bcm-vk | ||
| c2port | ||
| cardreader | ||
| cb710 | ||
| cxl | ||
| echo | ||
| eeprom | ||
| genwqe | ||
| ibmasm | ||
| lis3lv02d | ||
| lkdtm | ||
| mchp_pci1xxxx | ||
| mei | ||
| ocxl | ||
| pvpanic | ||
| sgi-gru | ||
| sgi-xp | ||
| ti-st | ||
| uacce | ||
| vmw_vmci | ||
| ad525x_dpot-i2c.c | ||
| ad525x_dpot-spi.c | ||
| ad525x_dpot.c | ||
| ad525x_dpot.h | ||
| apds990x.c | ||
| apds9802als.c | ||
| atmel-ssc.c | ||
| bh1770glc.c | ||
| cs5535-mfgpt.c | ||
| ds1682.c | ||
| dummy-irq.c | ||
| dw-xdata-pcie.c | ||
| enclosure.c | ||
| fastrpc.c | ||
| gehc-achc.c | ||
| hi6421v600-irq.c | ||
| hisi_hikey_usb.c | ||
| hmc6352.c | ||
| hpilo.c | ||
| hpilo.h | ||
| ibmvmc.c | ||
| ibmvmc.h | ||
| ics932s401.c | ||
| isl29003.c | ||
| isl29020.c | ||
| Kconfig | ||
| kgdbts.c | ||
| lattice-ecp3-config.c | ||
| Makefile | ||
| open-dice.c | ||
| pch_phub.c | ||
| pci_endpoint_test.c | ||
| phantom.c | ||
| qcom-coincell.c | ||
| smpro-errmon.c | ||
| smpro-misc.c | ||
| sram-exec.c | ||
| sram.c | ||
| sram.h | ||
| tifm_7xx1.c | ||
| tifm_core.c | ||
| tps6594-esm.c | ||
| tps6594-pfsm.c | ||
| tsl2550.c | ||
| vcpu_stall_detector.c | ||
| vmw_balloon.c | ||
| xilinx_sdfec.c | ||
| xilinx_tmr_inject.c | ||
| xilinx_tmr_manager.c | ||