[PATCH v4 0/3] Compile-time stack frame pointer validation

[Josh Poimboeuf]

In discussions around the live kernel patching consistency model RFC
[1], Peter and Ingo correctly pointed out that stack traces aren't
reliable.  And as Ingo said, there's no "strong force" which ensures we
can rely on them.

So I've been thinking about how to fix that.  My goal is to eventually
make stack traces reliable.  Or at the very least, to be able to detect
at runtime when a given stack trace *might* be unreliable.  But improved
stack traces would broadly benefit the entire kernel, regardless of the
outcome of the live kernel patching consistency model discussions.

This patch set is just the first in a series of proposed stack trace
reliability improvements.  Future proposals will include runtime stack
reliability checking, as well as compile-time and runtime DWARF
validations.

As far as I can tell, there are two main obstacles which prevent frame
pointer based stack traces from being reliable:

1) Missing frame pointer logic: currently, most assembly functions don't
   set up the frame pointer.

2) Interrupts: if a function is interrupted before it can save and set
   up the frame pointer, its caller won't show up in the stack trace.

This patch set aims to remove the first obstacle by enforcing that all
asm functions honor CONFIG_FRAME_POINTER.  This is done with a new
stackvalidate host tool which is automatically run for every compiled .S
file and which validates that every asm function does the proper frame
pointer setup.

Also, to make sure somebody didn't forget to annotate their callable asm
code as a function, flag an error for any return instructions which are
hiding outside of a function.  In almost all cases, return instructions
are part of callable functions and should be annotated as such so that
we can validate their frame pointer usage.  A whitelist mechanism exists
for those few return instructions which are not actually in callable
code.

It currently only supports x86_64.  It *almost* supports x86_32, but the
stackvalidate code doesn't yet know how to deal with 32-bit REL
relocations for the return whitelists.  I tried to make the code generic
so that support for other architectures can be plugged in pretty easily.

As a first step, all reported non-compliances result in warnings.  Right
now I'm seeing 200+ warnings.  Once we get them all cleaned up, we can
change the warnings to build errors so the asm code can stay clean.

The patches are based on linux-next.  Patch 1 adds the stackvalidate
host tool.  Patch 2 is a cleanup which makes the push/pop CFI macros
arch-independent, in preparation for patch 3.  Patch 3 adds some helper
macros for asm functions so that they can comply with stackvalidate.

[1] http://lkml.kernel.org/r/cover.1423499826.git.jpoimboe@xxxxxxxxxx

v4:
- Changed the default to CONFIG_STACK_VALIDATION=n, until all the asm
  code can get cleaned up.
- Fixed a stackvalidate error path exit code issue found by Michal
  Marek.

v3:
- Added a patch to make the push/pop CFI macros arch-independent, as
  suggested by H. Peter Anvin

v2:
- Fixed memory leaks reported by Petr Mladek

Josh Poimboeuf (3):
  x86, stackvalidate: Compile-time stack frame pointer validation
  x86: Make push/pop CFI macros arch-independent
  x86, stackvalidate: Add asm frame pointer setup macros

 MAINTAINERS                           |   6 +
 arch/Kconfig                          |   3 +
 arch/x86/Kconfig                      |   1 +
 arch/x86/Makefile                     |   6 +-
 arch/x86/ia32/ia32entry.S             |  60 +++---
 arch/x86/include/asm/calling.h        |  28 +--
 arch/x86/include/asm/dwarf2.h         |  92 ++++-----
 arch/x86/include/asm/frame.h          |   4 +-
 arch/x86/include/asm/func.h           |  82 ++++++++
 arch/x86/kernel/entry_32.S            | 214 ++++++++++-----------
 arch/x86/kernel/entry_64.S            |  96 +++++-----
 arch/x86/lib/atomic64_386_32.S        |   4 +-
 arch/x86/lib/atomic64_cx8_32.S        |  40 ++--
 arch/x86/lib/checksum_32.S            |  42 ++--
 arch/x86/lib/cmpxchg16b_emu.S         |   6 +-
 arch/x86/lib/cmpxchg8b_emu.S          |   6 +-
 arch/x86/lib/msr-reg.S                |  34 ++--
 arch/x86/lib/rwsem.S                  |  40 ++--
 arch/x86/lib/thunk_32.S               |  12 +-
 arch/x86/lib/thunk_64.S               |  36 ++--
 lib/Kconfig.debug                     |  11 ++
 scripts/Makefile                      |   1 +
 scripts/Makefile.build                |  22 ++-
 scripts/stackvalidate/Makefile        |  17 ++
 scripts/stackvalidate/arch-x86.c      | 134 +++++++++++++
 scripts/stackvalidate/arch.h          |  10 +
 scripts/stackvalidate/elf.c           | 352 ++++++++++++++++++++++++++++++++++
 scripts/stackvalidate/elf.h           |  56 ++++++
 scripts/stackvalidate/list.h          | 217 +++++++++++++++++++++
 scripts/stackvalidate/stackvalidate.c | 226 ++++++++++++++++++++++
 30 files changed, 1484 insertions(+), 374 deletions(-)
 create mode 100644 arch/x86/include/asm/func.h
 create mode 100644 scripts/stackvalidate/Makefile
 create mode 100644 scripts/stackvalidate/arch-x86.c
 create mode 100644 scripts/stackvalidate/arch.h
 create mode 100644 scripts/stackvalidate/elf.c
 create mode 100644 scripts/stackvalidate/elf.h
 create mode 100644 scripts/stackvalidate/list.h
 create mode 100644 scripts/stackvalidate/stackvalidate.c

-- 
2.1.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/