Shadow call stacks will be available in GCC >= 12, this patch makes the corresponding kernel configuration available when compiling the kernel with the gcc. Note that the implementation in GCC is slightly different from Clang. With SCS enabled, functions will only pop x30 once in the epilogue, like: str x30, [x18], #8 stp x29, x30, [sp, #-16]! ...... - ldp x29, x30, [sp], #16 //clang + ldr x29, [sp], #16 //GCC ldr x30, [x18, #-8]! Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=ce09ab17ddd21f73ff2caf6eec3b0ee9b0e1a11e
Unified · Split
| @@ -599,21 +599,22 @@ config STACKPROTECTOR_STRONG · 598 unmodified lines | |||
| 599 | config ARCH_SUPPORTS_SHADOW_CALL_STACK | 599 | config ARCH_SUPPORTS_SHADOW_CALL_STACK |
| 600 | bool | 600 | bool |
| 601 | help | 601 | help |
| 602 | An architecture should select this if it supports Clang's Shadow | 602 | An architecture should select this if it supports the compiler's |
| 603 | Call Stack and implements runtime support for shadow stack | 603 | Shadow Call Stack and implements runtime support for shadow stack |
| 604 | switching. | 604 | switching. |
| 605 | 605 | ||
| 606 | config SHADOW_CALL_STACK | 606 | config SHADOW_CALL_STACK |
| 607 | bool "Clang Shadow Call Stack" | 607 | bool "Shadow Call Stack" |
| 608 | depends on CC_IS_CLANG && ARCH_SUPPORTS_SHADOW_CALL_STACK | 608 | depends on ARCH_SUPPORTS_SHADOW_CALL_STACK |
| 609 | depends on DYNAMIC_FTRACE_WITH_REGS || !FUNCTION_GRAPH_TRACER | 609 | depends on DYNAMIC_FTRACE_WITH_REGS || !FUNCTION_GRAPH_TRACER |
| 610 | help | 610 | help |
| 611 | This option enables Clang's Shadow Call Stack, which uses a | 611 | This option enables the compiler's Shadow Call Stack, which |
| 612 | shadow stack to protect function return addresses from being | 612 | uses a shadow stack to protect function return addresses from |
| 613 | overwritten by an attacker. More information can be found in | 613 | being overwritten by an attacker. More information can be found |
| 614 | Clang's documentation: | 614 | in the compiler's documentation: |
| 615 | 615 | ||
| 616 | https://clang.llvm.org/docs/ShadowCallStack.html | 616 | - Clang: https://clang.llvm.org/docs/ShadowCallStack.html |
| 617 | - GCC: https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#Instrumentation-Options | ||
| 617 | 618 | ||
| 618 | Note that security guarantees in the kernel differ from the | 619 | Note that security guarantees in the kernel differ from the |
| 619 | ones documented for user space. The kernel must store addresses | 620 | ones documented for user space. The kernel must store addresses |
| @@ -1239,7 +1239,7 @@ config HW_PERF_EVENTS · 1238 unmodified lines | |||
| 1239 | config ARCH_HAS_FILTER_PGPROT | 1239 | config ARCH_HAS_FILTER_PGPROT |
| 1240 | def_bool y | 1240 | def_bool y |
| 1241 | 1241 | ||
| 1242 | # Supported by clang >= 7.0 | 1242 | # Supported by clang >= 7.0 or GCC >= 12.0.0 |
| 1243 | config CC_HAVE_SHADOW_CALL_STACK | 1243 | config CC_HAVE_SHADOW_CALL_STACK |
| 1244 | def_bool $(cc-option, -fsanitize=shadow-call-stack -ffixed-x18) | 1244 | def_bool $(cc-option, -fsanitize=shadow-call-stack -ffixed-x18) |
| 1245 | 1245 | ||
| @@ -97,6 +97,10 @@ · 96 unmodified lines | |||
| 97 | #define KASAN_ABI_VERSION 4 | 97 | #define KASAN_ABI_VERSION 4 |
| 98 | #endif | 98 | #endif |
| 99 | 99 | ||
| 100 | #ifdef CONFIG_SHADOW_CALL_STACK | ||
| 101 | #define __noscs __attribute__((__no_sanitize__("shadow-call-stack"))) | ||
| 102 | #endif | ||
| 103 | |||
| 100 | #if __has_attribute(__no_sanitize_address__) | 104 | #if __has_attribute(__no_sanitize_address__) |
| 101 | #define __no_sanitize_address __attribute__((no_sanitize_address)) | 105 | #define __no_sanitize_address __attribute__((no_sanitize_address)) |
| 102 | #else | 106 | #else |