Merge tag 'gcc-plugins-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull structure randomization updates from Kees Cook: "Now that IPC and other changes have landed, enable manual markings for randstruct plugin, including the task_struct. This is the rest of what was staged in -next for the gcc-plugins, and comes in three patches, largest first: - mark "easy" structs with __randomize_layout - mark task_struct with an optional anonymous struct to isolate the __randomize_layout section - mark structs to opt _out_ of automated marking (which will come later) And, FWIW, this continues to pass allmodconfig (normal and patched to enable gcc-plugins) builds of x86_64, i386, arm64, arm, powerpc, and s390 for me" * tag 'gcc-plugins-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: randstruct: opt-out externally exposed function pointer structs task_struct: Allow randomized layout randstruct: Mark various structs for randomization

Linus Torvalds committed 9 years ago

Commit e06fdaf2 parents a90c6ac 8acdf5042 files · +97 −66Browse files

Showing the changes to include/linux (30 of 42 files). Show all

Unified · Split

30 files

include/linux/binfmts.h +2 −2
include/linux/cdev.h +1 −1
include/linux/compiler-gcc.h +12 −1
include/linux/compiler.h +5 −0
include/linux/cred.h +2 −2
include/linux/dcache.h +1 −1
include/linux/fs.h +9 −8
include/linux/fs_struct.h +1 −1
include/linux/ipc.h +1 −1
include/linux/ipc_namespace.h +1 −1
include/linux/key-type.h +2 −2
include/linux/kmod.h +1 −1
include/linux/kobject.h +1 −1
include/linux/lsm_hooks.h +2 −2
include/linux/mm_types.h +2 −2
include/linux/module.h +2 −2
include/linux/mount.h +1 −1
include/linux/msg.h +1 −1
include/linux/path.h +1 −1
include/linux/pid_namespace.h +1 −1
include/linux/proc_ns.h +1 −1
include/linux/sched.h +15 −1
include/linux/sched/signal.h +1 −1
include/linux/sem.h +1 −1
include/linux/shm.h +1 −1
include/linux/sysctl.h +1 −1
include/linux/tty.h +1 −1
include/linux/tty_driver.h +2 −2
include/linux/user_namespace.h +1 −1
include/linux/utsname.h +1 −1

include/linux/binfmts.h+2−2

@@ -46,7 +46,7 @@ struct linux_binprm { · 45 unmodified lines
46	46	unsigned interp_flags;
47	47	unsigned interp_data;
48	48	unsigned long loader, exec;
49		−};
	49	+} __randomize_layout;
50	50
51	51	#define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
52	52	#define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)
@@ -81,7 +81,7 @@ struct linux_binfmt { · 28 unmodified lines
81	81	int (load_shlib)(struct file );
82	82	int (core_dump)(struct coredump_params cprm);
83	83	unsigned long min_coredump; /* minimal dump size */
84		−};
	84	+} __randomize_layout;
85	85
86	86	extern void __register_binfmt(struct linux_binfmt *fmt, int insert);
87	87

include/linux/cdev.h+1−1

@@ -17,7 +17,7 @@ struct cdev { · 16 unmodified lines
17	17	struct list_head list;
18	18	dev_t dev;
19	19	unsigned int count;
20		−};
	20	+} __randomize_layout;
21	21
22	22	void cdev_init(struct cdev , const struct file_operations );
23	23

include/linux/compiler-gcc.h+12−1

@@ -235,6 +235,7 @@ · 234 unmodified lines
235	235	#endif /* GCC_VERSION >= 40500 */
236	236
237	237	#if GCC_VERSION >= 40600
	238	+
238	239	/*
239	240	* When used with Link Time Optimization, gcc can optimize away C functions or
240	241	* variables which are referenced only from assembly code. __visible tells the
@@ -242,7 +243,17 @@ · 1 unmodified line
242	243	* this.
243	244	*/
244	245	#define __visible __attribute__((externally_visible))
245		−#endif
	246	+
	247	+/*
	248	+ * RANDSTRUCT_PLUGIN wants to use an anonymous struct, but it is only
	249	+ * possible since GCC 4.6. To provide as much build testing coverage
	250	+ * as possible, this is used for all GCC 4.6+ builds, and not just on
	251	+ * RANDSTRUCT_PLUGIN builds.
	252	+ */
	253	+#define randomized_struct_fields_start struct {
	254	+#define randomized_struct_fields_end } __randomize_layout;
	255	+
	256	+#endif /* GCC_VERSION >= 40600 */
246	257
247	258
248	259	#if GCC_VERSION >= 40900 && !defined(__CHECKER__)

include/linux/compiler.h+5−0

@@ -452,6 +452,11 @@ static __always_inline void __write_once_size(volatile void p, void res, int s · 451 unmodified lines
452	452	# define __no_randomize_layout
453	453	#endif
454	454
	455	+#ifndef randomized_struct_fields_start
	456	+# define randomized_struct_fields_start
	457	+# define randomized_struct_fields_end
	458	+#endif
	459	+
455	460	/*
456	461	* Tell gcc if a function is cold. The compiler will assume any path
457	462	* directly leading to the call is unlikely.

include/linux/cred.h+2−2

@@ -31,7 +31,7 @@ struct group_info { · 30 unmodified lines
31	31	atomic_t usage;
32	32	int ngroups;
33	33	kgid_t gid[0];
34		−};
	34	+} __randomize_layout;
35	35
36	36	/**
37	37	* get_group_info - Get a reference to a group info structure
@@ -145,7 +145,7 @@ struct cred { · 107 unmodified lines
145	145	struct user_namespace user_ns; / user_ns the caps and keyrings are relative to. */
146	146	struct group_info group_info; / supplementary groups for euid/fsgid */
147	147	struct rcu_head rcu; /* RCU deletion hook */
148		−};
	148	+} __randomize_layout;
149	149
150	150	extern void __put_cred(struct cred *);
151	151	extern void exit_creds(struct task_struct *);

include/linux/dcache.h+1−1

@@ -118,7 +118,7 @@ struct dentry { · 117 unmodified lines
118	118	struct hlist_bl_node d_in_lookup_hash; /* only for in-lookup ones */
119	119	struct rcu_head d_rcu;
120	120	} d_u;
121		−};
	121	+} __randomize_layout;
122	122
123	123	/*
124	124	* dentry->d_lock spinlock nesting subclasses:

include/linux/fs.h+9−8

@@ -296,7 +296,7 @@ struct kiocb { · 295 unmodified lines
296	296	void *private;
297	297	int ki_flags;
298	298	enum rw_hint ki_hint;
299		−};
	299	+} __randomize_layout;
300	300
301	301	static inline bool is_sync_kiocb(struct kiocb *kiocb)
302	302	{
@@ -404,7 +404,7 @@ struct address_space { · 101 unmodified lines
404	404	struct list_head private_list; /* ditto */
405	405	void private_data; / ditto */
406	406	errseq_t wb_err;
407		−} __attribute__((aligned(sizeof(long))));
	407	+} __attribute__((aligned(sizeof(long)))) __randomize_layout;
408	408	/*
409	409	* On most architectures that alignment is already the case; but
410	410	* must be enforced here for CRIS, to let the least significant bit
@@ -447,7 +447,7 @@ struct block_device { · 36 unmodified lines
447	447	int bd_fsfreeze_count;
448	448	/* Mutex for freeze */
449	449	struct mutex bd_fsfreeze_mutex;
450		−};
	450	+} __randomize_layout;
451	451
452	452	/*
453	453	* Radix-tree tags, for tagging dirty and writeback pages within the pagecache
@@ -666,7 +666,7 @@ struct inode { · 212 unmodified lines
666	666	#endif
667	667
668	668	void i_private; / fs or device private pointer */
669		−};
	669	+} __randomize_layout;
670	670
671	671	static inline unsigned int i_blocksize(const struct inode *node)
672	672	{
@@ -883,7 +883,8 @@ struct file { · 210 unmodified lines
883	883	#endif /* #ifdef CONFIG_EPOLL */
884	884	struct address_space *f_mapping;
885	885	errseq_t f_wb_err;
886		−} __attribute__((aligned(4))); /* lest something weird decides that 2 is OK */
	886	+} __randomize_layout
	887	+ __attribute__((aligned(4))); /* lest something weird decides that 2 is OK */
887	888
888	889	struct file_handle {
889	890	__u32 handle_bytes;
@@ -1020,7 +1021,7 @@ struct file_lock { · 130 unmodified lines
1020	1021	int state; /* state of grant or error if -ve */
1021	1022	} afs;
1022	1023	} fl_u;
1023		−};
	1024	+} __randomize_layout;
1024	1025
1025	1026	struct file_lock_context {
1026	1027	spinlock_t flc_lock;
@@ -1412,7 +1413,7 @@ struct super_block { · 385 unmodified lines
1412	1413
1413	1414	spinlock_t s_inode_wblist_lock;
1414	1415	struct list_head s_inodes_wb; /* writeback inodes */
1415		−};
	1416	+} __randomize_layout;
1416	1417
1417	1418	/* Helper functions so that in most cases filesystems will
1418	1419	* not need to deal directly with kuid_t and kgid_t and can
@@ -1698,7 +1699,7 @@ struct file_operations { · 279 unmodified lines
1698	1699	u64);
1699	1700	ssize_t (dedupe_file_range)(struct file , u64, u64, struct file *,
1700	1701	u64);
1701		−};
	1702	+} __randomize_layout;
1702	1703
1703	1704	struct inode_operations {
1704	1705	struct dentry * (lookup) (struct inode ,struct dentry *, unsigned int);

include/linux/fs_struct.h+1−1

@@ -12,7 +12,7 @@ struct fs_struct { · 11 unmodified lines
12	12	int umask;
13	13	int in_exec;
14	14	struct path root, pwd;
15		−};
	15	+} __randomize_layout;
16	16
17	17	extern struct kmem_cache *fs_cachep;
18	18

include/linux/ipc.h+1−1

@@ -23,6 +23,6 @@ struct kern_ipc_perm { · 22 unmodified lines
23	23
24	24	struct rcu_head rcu;
25	25	atomic_t refcount;
26		−} ____cacheline_aligned_in_smp;
	26	+} ____cacheline_aligned_in_smp __randomize_layout;
27	27
28	28	#endif /* _LINUX_IPC_H */

include/linux/ipc_namespace.h+1−1

@@ -61,7 +61,7 @@ struct ipc_namespace { · 60 unmodified lines
61	61	struct ucounts *ucounts;
62	62
63	63	struct ns_common ns;
64		−};
	64	+} __randomize_layout;
65	65
66	66	extern struct ipc_namespace init_ipc_ns;
67	67	extern spinlock_t mq_lock;

include/linux/key-type.h+2−2

@@ -45,7 +45,7 @@ struct key_preparsed_payload { · 44 unmodified lines
45	45	size_t datalen; /* Raw datalen */
46	46	size_t quotalen; /* Quota length for proposed payload */
47	47	time_t expiry; /* Expiry time of key */
48		−};
	48	+} __randomize_layout;
49	49
50	50	typedef int (request_key_actor_t)(struct key_construction key,
51	51	const char op, void aux);
@@ -158,7 +158,7 @@ struct key_type { · 106 unmodified lines
158	158	/* internal fields */
159	159	struct list_head link; /* link in types list */
160	160	struct lock_class_key lock_class; /* key->sem lock class */
161		−};
	161	+} __randomize_layout;
162	162
163	163	extern struct key_type key_type_keyring;
164	164

include/linux/kmod.h+1−1

@@ -64,7 +64,7 @@ struct subprocess_info { · 63 unmodified lines
64	64	int (init)(struct subprocess_info info, struct cred *new);
65	65	void (cleanup)(struct subprocess_info info);
66	66	void *data;
67		−};
	67	+} __randomize_layout;
68	68
69	69	extern int
70	70	call_usermodehelper(const char path, char argv, char *envp, int wait);

include/linux/kobject.h+1−1

@@ -172,7 +172,7 @@ struct kset { · 171 unmodified lines
172	172	spinlock_t list_lock;
173	173	struct kobject kobj;
174	174	const struct kset_uevent_ops *uevent_ops;
175		−};
	175	+} __randomize_layout;
176	176
177	177	extern void kset_init(struct kset *kset);
178	178	extern int __must_check kset_register(struct kset *kset);

include/linux/lsm_hooks.h+2−2

@@ -1912,7 +1912,7 @@ struct security_hook_heads { · 1911 unmodified lines
1912	1912	struct list_head audit_rule_match;
1913	1913	struct list_head audit_rule_free;
1914	1914	#endif /* CONFIG_AUDIT */
1915		−};
	1915	+} __randomize_layout;
1916	1916
1917	1917	/*
1918	1918	* Security module hook list structure.
@@ -1923,7 +1923,7 @@ struct security_hook_list { · 4 unmodified lines
1923	1923	struct list_head *head;
1924	1924	union security_list_options hook;
1925	1925	char *lsm;
1926		−};
	1926	+} __randomize_layout;
1927	1927
1928	1928	/*
1929	1929	* Initializing a security_hook_list structure takes

include/linux/mm_types.h+2−2

@@ -342,7 +342,7 @@ struct vm_area_struct { · 341 unmodified lines
342	342	struct mempolicy vm_policy; / NUMA policy for the VMA */
343	343	#endif
344	344	struct vm_userfaultfd_ctx vm_userfaultfd_ctx;
345		−};
	345	+} __randomize_layout;
346	346
347	347	struct core_thread {
348	348	struct task_struct *task;
@@ -500,7 +500,7 @@ struct mm_struct { · 151 unmodified lines
500	500	atomic_long_t hugetlb_usage;
501	501	#endif
502	502	struct work_struct async_put_work;
503		−};
	503	+} __randomize_layout;
504	504
505	505	extern struct mm_struct init_mm;
506	506

include/linux/module.h+2−2

@@ -45,7 +45,7 @@ struct module_kobject { · 44 unmodified lines
45	45	struct kobject *drivers_dir;
46	46	struct module_param_attrs *mp;
47	47	struct completion *kobj_completion;
48		−};
	48	+} __randomize_layout;
49	49
50	50	struct module_attribute {
51	51	struct attribute attr;
@@ -475,7 +475,7 @@ struct module { · 423 unmodified lines
475	475	ctor_fn_t *ctors;
476	476	unsigned int num_ctors;
477	477	#endif
478		−} ____cacheline_aligned;
	478	+} ____cacheline_aligned __randomize_layout;
479	479	#ifndef MODULE_ARCH_INIT
480	480	#define MODULE_ARCH_INIT {}
481	481	#endif

include/linux/mount.h+1−1

@@ -67,7 +67,7 @@ struct vfsmount { · 66 unmodified lines
67	67	struct dentry mnt_root; / root of the mounted tree */
68	68	struct super_block mnt_sb; / pointer to superblock */
69	69	int mnt_flags;
70		−};
	70	+} __randomize_layout;
71	71
72	72	struct file; /* forward dec */
73	73	struct path;

include/linux/msg.h+1−1

@@ -29,7 +29,7 @@ struct msg_queue { · 28 unmodified lines
29	29	struct list_head q_messages;
30	30	struct list_head q_receivers;
31	31	struct list_head q_senders;
32		−};
	32	+} __randomize_layout;
33	33
34	34	/* Helper routines for sys_msgsnd and sys_msgrcv */
35	35	extern long do_msgsnd(int msqid, long mtype, void __user *mtext,

include/linux/path.h+1−1

@@ -7,7 +7,7 @@ struct vfsmount; · 6 unmodified lines
7	7	struct path {
8	8	struct vfsmount *mnt;
9	9	struct dentry *dentry;
10		−};
	10	+} __randomize_layout;
11	11
12	12	extern void path_get(const struct path *);
13	13	extern void path_put(const struct path *);

include/linux/pid_namespace.h+1−1

@@ -52,7 +52,7 @@ struct pid_namespace { · 51 unmodified lines
52	52	int hide_pid;
53	53	int reboot; /* group exit code if this pidns was rebooted */
54	54	struct ns_common ns;
55		−};
	55	+} __randomize_layout;
56	56
57	57	extern struct pid_namespace init_pid_ns;
58	58

include/linux/proc_ns.h+1−1

@@ -21,7 +21,7 @@ struct proc_ns_operations { · 20 unmodified lines
21	21	int (install)(struct nsproxy nsproxy, struct ns_common *ns);
22	22	struct user_namespace (owner)(struct ns_common *ns);
23	23	struct ns_common (get_parent)(struct ns_common *ns);
24		−};
	24	+} __randomize_layout;
25	25
26	26	extern const struct proc_ns_operations netns_operations;
27	27	extern const struct proc_ns_operations utsns_operations;

include/linux/sched.h+15−1

@@ -426,7 +426,7 @@ struct sched_rt_entity { · 425 unmodified lines
426	426	/* rq "owned" by this entity/group: */
427	427	struct rt_rq *my_q;
428	428	#endif
429		−};
	429	+} __randomize_layout;
430	430
431	431	struct sched_dl_entity {
432	432	struct rb_node rb_node;
@@ -526,6 +526,13 @@ struct task_struct { · 93 unmodified lines
526	526	#endif
527	527	/* -1 unrunnable, 0 runnable, >0 stopped: */
528	528	volatile long state;
	529	+
	530	+ /*
	531	+ * This begins the randomizable portion of task_struct. Only
	532	+ * scheduling-critical items should be added above here.
	533	+ */
	534	+ randomized_struct_fields_start
	535	+
529	536	void *stack;
530	537	atomic_t usage;
531	538	/* Per task flags (PF_), defined further below: /
@@ -1079,6 +1086,13 @@ struct task_struct { · 547 unmodified lines
1079	1086	/* Used by LSM modules for access restriction: */
1080	1087	void *security;
1081	1088	#endif
	1089	+
	1090	+ /*
	1091	+ * New fields for task_struct should be added above here, so that
	1092	+ * they are included in the randomized portion of task_struct.
	1093	+ */
	1094	+ randomized_struct_fields_end
	1095	+
1082	1096	/* CPU-specific state of this task: */
1083	1097	struct thread_struct thread;
1084	1098

include/linux/sched/signal.h+1−1

@@ -222,7 +222,7 @@ struct signal_struct { · 221 unmodified lines
222	222	struct mutex cred_guard_mutex; /* guard against foreign influences on
223	223	* credential calculations
224	224	* (notably. ptrace) */
225		−};
	225	+} __randomize_layout;
226	226
227	227	/*
228	228	* Bits in flags field of signal_struct.

include/linux/sem.h+1−1

@@ -41,7 +41,7 @@ struct sem_array { · 40 unmodified lines
41	41	unsigned int use_global_lock;/* >0: global lock required */
42	42
43	43	struct sem sems[];
44		−};
	44	+} __randomize_layout;
45	45
46	46	#ifdef CONFIG_SYSVIPC
47	47

include/linux/shm.h+1−1

@@ -22,7 +22,7 @@ struct shmid_kernel /* private to the kernel */ · 21 unmodified lines
22	22	/* The task created the shm object. NULL if the task is dead. */
23	23	struct task_struct *shm_creator;
24	24	struct list_head shm_clist; /* list by creator */
25		−};
	25	+} __randomize_layout;
26	26
27	27	/* shm_mode upper byte flags */
28	28	#define SHM_DEST 01000 /* segment will be destroyed on last detach */

include/linux/sysctl.h+1−1

@@ -120,7 +120,7 @@ struct ctl_table · 119 unmodified lines
120	120	struct ctl_table_poll *poll;
121	121	void *extra1;
122	122	void *extra2;
123		−};
	123	+} __randomize_layout;
124	124
125	125	struct ctl_node {
126	126	struct rb_node node;

include/linux/tty.h+1−1

@@ -332,7 +332,7 @@ struct tty_struct { · 331 unmodified lines
332	332	/* If the tty has a pending do_SAK, queue it here - akpm */
333	333	struct work_struct SAK_work;
334	334	struct tty_port *port;
335		−};
	335	+} __randomize_layout;
336	336
337	337	/* Each of a tty's open files has private_data pointing to tty_file_private */
338	338	struct tty_file_private {

include/linux/tty_driver.h+2−2

@@ -291,7 +291,7 @@ struct tty_operations { · 290 unmodified lines
291	291	void (poll_put_char)(struct tty_driver driver, int line, char ch);
292	292	#endif
293	293	const struct file_operations *proc_fops;
294		−};
	294	+} __randomize_layout;
295	295
296	296	struct tty_driver {
297	297	int magic; /* magic number for this structure */
@@ -325,7 +325,7 @@ struct tty_driver { · 27 unmodified lines
325	325
326	326	const struct tty_operations *ops;
327	327	struct list_head tty_drivers;
328		−};
	328	+} __randomize_layout;
329	329
330	330	extern struct list_head tty_drivers;
331	331

include/linux/user_namespace.h+1−1

@@ -66,7 +66,7 @@ struct user_namespace { · 65 unmodified lines
66	66	#endif
67	67	struct ucounts *ucounts;
68	68	int ucount_max[UCOUNT_COUNTS];
69		−};
	69	+} __randomize_layout;
70	70
71	71	struct ucounts {
72	72	struct hlist_node node;

include/linux/utsname.h+1−1

@@ -26,7 +26,7 @@ struct uts_namespace { · 25 unmodified lines
26	26	struct user_namespace *user_ns;
27	27	struct ucounts *ucounts;
28	28	struct ns_common ns;
29		−};
	29	+} __randomize_layout;
30	30	extern struct uts_namespace init_uts_ns;
31	31
32	32	#ifdef CONFIG_UTS_NS