On Wed, 15 Apr 2020 at 23:07, Kristen Carlson Accardi
<kristen@xxxxxxxxxxxxxxx> wrote:
>
> If a module has functions split out into separate text sections
> (i.e. compiled with the -ffunction-sections flag), reorder the
> functions to provide some code diversification to modules.
>
Is that the only prerequisite? I.e., is it sufficient for another
architecture to add -ffunction-sections to the module CFLAGS to get
this functionality? (assuming it defines CONFIG_FG_KASLR=y)
> Signed-off-by: Kristen Carlson Accardi <kristen@xxxxxxxxxxxxxxx>
> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
> ---
> kernel/module.c | 82 +++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 82 insertions(+)
>
> diff --git a/kernel/module.c b/kernel/module.c
> index 646f1e2330d2..e432ec5f6df4 100644
> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -53,6 +53,8 @@
> #include <linux/bsearch.h>
> #include <linux/dynamic_debug.h>
> #include <linux/audit.h>
> +#include <linux/random.h>
> +#include <asm/setup.h>
> #include <uapi/linux/module.h>
> #include "module-internal.h"
>
> @@ -2370,6 +2372,83 @@ static long get_offset(struct module *mod, unsigned int *size,
> return ret;
> }
>
> +/*
> + * shuffle_text_list()
> + * Use a Fisher Yates algorithm to shuffle a list of text sections.
> + */
> +static void shuffle_text_list(Elf_Shdr **list, int size)
> +{
> + int i;
> + unsigned int j;
> + Elf_Shdr *temp;
> +
> + for (i = size - 1; i > 0; i--) {
> + /*
> + * pick a random index from 0 to i
> + */
> + get_random_bytes(&j, sizeof(j));
> + j = j % (i + 1);
> +
> + temp = list[i];
> + list[i] = list[j];
> + list[j] = temp;
> + }
> +}
> +
> +/*
> + * randomize_text()
> + * Look through the core section looking for executable code sections.
> + * Store sections in an array and then shuffle the sections
> + * to reorder the functions.
> + */
> +static void randomize_text(struct module *mod, struct load_info *info)
> +{
> + int i;
> + int num_text_sections = 0;
> + Elf_Shdr **text_list;
> + int size = 0;
> + int max_sections = info->hdr->e_shnum;
> + unsigned int sec = find_sec(info, ".text");
> +
> + if (sec == 0)
> + return;
> +
> + text_list = kmalloc_array(max_sections, sizeof(*text_list), GFP_KERNEL);
> + if (text_list == NULL)
> + return;
> +
> + for (i = 0; i < max_sections; i++) {
> + Elf_Shdr *shdr = &info->sechdrs[i];
> + const char *sname = info->secstrings + shdr->sh_name;
> +
> + if (!(shdr->sh_flags & SHF_ALLOC) ||
> + !(shdr->sh_flags & SHF_EXECINSTR) ||
> + strstarts(sname, ".init"))
> + continue;
> +
> + text_list[num_text_sections] = shdr;
> + num_text_sections++;
> + }
> +
> + shuffle_text_list(text_list, num_text_sections);
> +
> + for (i = 0; i < num_text_sections; i++) {
> + Elf_Shdr *shdr = text_list[i];
> +
> + /*
> + * get_offset has a section index for it's last
> + * argument, that is only used by arch_mod_section_prepend(),
> + * which is only defined by parisc. Since this this type
> + * of randomization isn't supported on parisc, we can
> + * safely pass in zero as the last argument, as it is
> + * ignored.
> + */
> + shdr->sh_entsize = get_offset(mod, &size, shdr, 0);
> + }
> +
> + kfree(text_list);
> +}
> +
> /* Lay out the SHF_ALLOC sections in a way not dissimilar to how ld
> might -- code, read-only data, read-write data, small data. Tally
> sizes, and place the offsets into sh_entsize fields: high bit means it
> @@ -2460,6 +2539,9 @@ static void layout_sections(struct module *mod, struct load_info *info)
> break;
> }
> }
> +
> + if (IS_ENABLED(CONFIG_FG_KASLR) && kaslr_enabled())
kaslr_enabled() only exists [as a function] on x86
> + randomize_text(mod, info);
> }
>
> static void set_license(struct module *mod, const char *license)
> --
> 2.20.1
>
