• Kees Cook's avatar
    fork: unconditionally clear stack on fork · e01e8063
    Kees Cook authored
    One of the classes of kernel stack content leaks[1] is exposing the
    contents of prior heap or stack contents when a new process stack is
    allocated.  Normally, those stacks are not zeroed, and the old contents
    remain in place.  In the face of stack content exposure flaws, those
    contents can leak to userspace.
    
    Fixing this will make the kernel no longer vulnerable to these flaws, as
    the stack will be wiped each time a stack is assigned to a new process.
    There's not a meaningful change in runtime performance; it almost looks
    like it provides a benefit.
    
    Performing back-to-back kernel builds before:
    	Run times: 157.86 157.09 158.90 160.94 160.80
    	Mean: 159.12
    	Std Dev: 1.54
    
    and after:
    	Run times: 159.31 157.34 156.71 158.15 160.81
    	Mean: 158.46
    	Std Dev: 1.46
    
    Instead of making this a build or runtime config, Andy Lutomirski
    recommended this just be enabled by default.
    
    [1] A noisy search for many kinds of stack content leaks can be seen here:
    https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=linux+kernel+stack+leak
    
    I did some more with perf and cycle counts on running 100,000 execs of
    /bin/true.
    
    before:
    Cycles: 218858861551 218853036130 214727610969 227656844122 224980542841
    Mean:  221015379122.60
    Std Dev: 4662486552.47
    
    after:
    Cycles: 213868945060 213119275204 211820169456 224426673259 225489986348
    Mean:  217745009865.40
    Std Dev: 5935559279.99
    
    It continues to look like it's faster, though the deviation is rather
    wide, but I'm not sure what I could do that would be less noisy.  I'm
    open to ideas!
    
    Link: http://lkml.kernel.org/r/20180221021659.GA37073@beastSigned-off-by: default avatarKees Cook <keescook@chromium.org>
    Acked-by: default avatarMichal Hocko <mhocko@suse.com>
    Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Laura Abbott <labbott@redhat.com>
    Cc: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
    Cc: Mel Gorman <mgorman@techsingularity.net>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    e01e8063
fork.c 60.2 KB