Fix: Disable IBT around indirect function calls

When the Intel IBT feature is enabled, a CPU supporting this feature
validates that all indirect jumps/calls land on an ENDBR64 instruction.

The kernel seals functions which are not meant to be called indirectly,
which means that calling functions indirectly from their address fetched
using kallsyms or kprobes trigger a crash.

Use the MSR_IA32_S_CET CET_ENDBR_EN MSR bit to temporarily disable ENDBR
validation around indirect calls to kernel functions. Considering that
the main purpose of this feature is to prevent ROP-style attacks,
disabling the ENDBR validation temporarily around the call from a kernel
module does not affect the ROP protection.

Fixes #1408
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Change-Id: I97f5d8efce093c1e956cede1f44de2fcebf30227

diff --git a/include/wrapper/ibt.h b/include/wrapper/ibt.h
new file mode 100644 (file)
index 0000000..e089a8f
--- /dev/null
+++ b/include/wrapper/ibt.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: (GPL-2.0-only)
+ *
+ * wrapper/ibt.h
+ *
+ * Copyright (C) 2024 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+ */
+
+#ifndef _LTTNG_WRAPPER_IBT_H
+#define _LTTNG_WRAPPER_IBT_H
+
+struct irq_ibt_state {
+       u64 msr;
+       unsigned long flags;
+};
+
+/*
+ * Save (disable) and restore interrupts around MSR bit change and indirect
+ * function call to make sure this thread is not migrated to another CPU which
+ * would not have the MSR bit cleared.
+ */
+
+#ifdef CONFIG_X86_KERNEL_IBT
+# include <asm/cpufeature.h>
+# include <asm/msr.h>
+static inline __attribute__((always_inline))
+struct irq_ibt_state wrapper_irq_ibt_save(void)
+{
+       struct irq_ibt_state state = { 0, 0 };
+       u64 msr;
+
+       if (!cpu_feature_enabled(X86_FEATURE_IBT))
+               goto end;
+       local_irq_save(state.flags);
+       rdmsrl(MSR_IA32_S_CET, msr);
+       wrmsrl(MSR_IA32_S_CET, msr & ~CET_ENDBR_EN);
+       state.msr = msr;
+end:
+       return state;
+}
+
+static inline __attribute__((always_inline))
+void wrapper_irq_ibt_restore(struct irq_ibt_state state)
+{
+       u64 msr;
+
+       if (!cpu_feature_enabled(X86_FEATURE_IBT))
+               return;
+       rdmsrl(MSR_IA32_S_CET, msr);
+       msr &= ~CET_ENDBR_EN;
+       msr |= (state.msr & CET_ENDBR_EN);
+       wrmsrl(MSR_IA32_S_CET, msr);
+       local_irq_restore(state.flags);
+}
+#else
+static inline struct irq_ibt_state wrapper_irq_ibt_save(void) { struct irq_ibt_state state = { 0, 0 }; return state; }
+static inline void wrapper_irq_ibt_restore(struct irq_ibt_state state) { }
+#endif
+
+#endif /* _LTTNG_WRAPPER_IBT_H */

diff --git a/include/wrapper/kallsyms.h b/include/wrapper/kallsyms.h
index fe2daefbf108659b9bb41c88d00536fa23631dce..8129833f8a896e27e4084b8530ad4710b4479fe9 100644 (file)
--- a/include/wrapper/kallsyms.h
+++ b/include/wrapper/kallsyms.h
@@ -16,6 +16,8 @@
 #include <linux/kallsyms.h>
 #include <lttng/kernel-version.h>
 
+#include <wrapper/ibt.h>
+
 /* CONFIG_PPC64_ELF_ABI_V1/V2 were introduced in v5.19 */
 #if defined(CONFIG_PPC64_ELF_ABI_V2) || (defined(CONFIG_PPC64) && defined(CONFIG_CPU_LITTLE_ENDIAN))
 #define LTTNG_CONFIG_PPC64_ELF_ABI_V2

diff --git a/src/lttng-context-callstack-legacy-impl.h b/src/lttng-context-callstack-legacy-impl.h
index 833443d612c73efe38389a32a24ee3d52e79bb43..ba176de9bab6fa65ea9ba1a2541807407368d358 100644 (file)
--- a/src/lttng-context-callstack-legacy-impl.h
+++ b/src/lttng-context-callstack-legacy-impl.h
@@ -150,6 +150,7 @@ size_t lttng_callstack_sequence_get_size(void *priv, struct lttng_kernel_probe_c
        struct field_data *fdata = (struct field_data *) priv;
        size_t orig_offset = offset;
        int cpu = smp_processor_id();
+       struct irq_ibt_state irq_ibt_state;
 
        /* do not write data if no space is available */
        trace = stack_trace_context(fdata, cpu);
@@ -165,7 +166,9 @@ size_t lttng_callstack_sequence_get_size(void *priv, struct lttng_kernel_probe_c
                ++per_cpu(callstack_user_nesting, cpu);
 
        /* do the real work and reserve space */
+       irq_ibt_state = wrapper_irq_ibt_save();
        cs_types[fdata->mode].save_func(trace);
+       wrapper_irq_ibt_restore(irq_ibt_state);
 
        if (fdata->mode == CALLSTACK_USER)
                per_cpu(callstack_user_nesting, cpu)--;

diff --git a/src/lttng-context-callstack-stackwalk-impl.h b/src/lttng-context-callstack-stackwalk-impl.h
index e73d1156ae7c0731e7918c194982e2446688f278..5075e9850d6742f320a89e2aa412807c256fdfd0 100644 (file)
--- a/src/lttng-context-callstack-stackwalk-impl.h
+++ b/src/lttng-context-callstack-stackwalk-impl.h
@@ -152,6 +152,7 @@ size_t lttng_callstack_sequence_get_size(void *priv, struct lttng_kernel_probe_c
        struct field_data *fdata = (struct field_data *) priv;
        size_t orig_offset = offset;
        int cpu = smp_processor_id();
+       struct irq_ibt_state irq_ibt_state;
 
        /* do not write data if no space is available */
        trace = stack_trace_context(fdata, cpu);
@@ -166,14 +167,18 @@ size_t lttng_callstack_sequence_get_size(void *priv, struct lttng_kernel_probe_c
        switch (fdata->mode) {
        case CALLSTACK_KERNEL:
                /* do the real work and reserve space */
+               irq_ibt_state = wrapper_irq_ibt_save();
                trace->nr_entries = save_func_kernel(trace->entries,
                                                MAX_ENTRIES, 0);
+               wrapper_irq_ibt_restore(irq_ibt_state);
                break;
        case CALLSTACK_USER:
                ++per_cpu(callstack_user_nesting, cpu);
                /* do the real work and reserve space */
+               irq_ibt_state = wrapper_irq_ibt_save();
                trace->nr_entries = save_func_user(trace->entries,
                                                MAX_ENTRIES);
+               wrapper_irq_ibt_restore(irq_ibt_state);
                per_cpu(callstack_user_nesting, cpu)--;
                break;
        default:

diff --git a/src/wrapper/irqdesc.c b/src/wrapper/irqdesc.c
index 1bfae91a3c2efad263b166d517bbb7d912085297..b77b044b7d8fe543d8af450bfd0b3c93b706273f 100644 (file)
--- a/src/wrapper/irqdesc.c
+++ b/src/wrapper/irqdesc.c
@@ -29,7 +29,13 @@ struct irq_desc *wrapper_irq_to_desc(unsigned int irq)
        if (!irq_to_desc_sym)
                irq_to_desc_sym = (void *) kallsyms_lookup_funcptr("irq_to_desc");
        if (irq_to_desc_sym) {
-               return irq_to_desc_sym(irq);
+               struct irq_ibt_state irq_ibt_state;
+               struct irq_desc *ret;
+
+               irq_ibt_state = wrapper_irq_ibt_save();
+               ret = irq_to_desc_sym(irq);
+               wrapper_irq_ibt_restore(irq_ibt_state);
+               return ret;
        } else {
                printk_once(KERN_WARNING "LTTng: irq_to_desc symbol lookup failed.\n");
                return NULL;

diff --git a/src/wrapper/kallsyms.c b/src/wrapper/kallsyms.c
index 2535c2a527faed90f20909ce809334adaae28169..295617f6434084f030959bcb33736820eeecf0a3 100644 (file)
--- a/src/wrapper/kallsyms.c
+++ b/src/wrapper/kallsyms.c
@@ -127,9 +127,15 @@ unsigned long wrapper_kallsyms_lookup_name(const char *name)
        if (!kallsyms_lookup_name_sym) {
                kallsyms_lookup_name_sym = (void *)do_get_kallsyms();
        }
-       if (kallsyms_lookup_name_sym)
-               return kallsyms_lookup_name_sym(name);
-       else {
+       if (kallsyms_lookup_name_sym) {
+               struct irq_ibt_state irq_ibt_state;
+               unsigned long ret;
+
+               irq_ibt_state = wrapper_irq_ibt_save();
+               ret = kallsyms_lookup_name_sym(name);
+               wrapper_irq_ibt_restore(irq_ibt_state);
+               return ret;
+       } else {
                printk_once(KERN_WARNING "LTTng: requires kallsyms_lookup_name\n");
                return 0;
        }

diff --git a/src/wrapper/page_alloc.c b/src/wrapper/page_alloc.c
index a03838fad4f2b2d2f3ced26f80068305a0ba786f..5e19d7b5c786accd74e0a9697ceb3af588dfc3ef 100644 (file)
--- a/src/wrapper/page_alloc.c
+++ b/src/wrapper/page_alloc.c
@@ -30,7 +30,13 @@ unsigned long wrapper_get_pfnblock_flags_mask(struct page *page,
 {
        WARN_ON_ONCE(!get_pfnblock_flags_mask_sym);
        if (get_pfnblock_flags_mask_sym) {
-               return get_pfnblock_flags_mask_sym(page, pfn, end_bitidx, mask);
+               struct irq_ibt_state irq_ibt_state;
+               unsigned long ret;
+
+               irq_ibt_state = wrapper_irq_ibt_save();
+               ret = get_pfnblock_flags_mask_sym(page, pfn, end_bitidx, mask);
+               wrapper_irq_ibt_restore(irq_ibt_state);
+               return ret;
        } else {
                return -ENOSYS;
        }