stackleak: Allow runtime disabling of kernel stack erasing

Introduce CONFIG_STACKLEAK_RUNTIME_DISABLE option, which provides
'stack_erasing' sysctl. It can be used in runtime to control kernel
stack erasing for kernels built with CONFIG_GCC_PLUGIN_STACKLEAK.

Suggested-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Alexander Popov <alex.popov@linux.com>
Tested-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Kees Cook <keescook@chromium.org>

2 files changed, 52 insertions, 1 deletions

diff --git a/kernel/stackleak.c b/kernel/stackleak.c
index f66239572c89..e42892926244 100644
--- a/kernel/stackleak.c
+++ b/kernel/stackleak.c
@@ -12,6 +12,41 @@
 
 #include <linux/stackleak.h>
 
+#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE
+#include <linux/jump_label.h>
+#include <linux/sysctl.h>
+
+static DEFINE_STATIC_KEY_FALSE(stack_erasing_bypass);
+
+int stack_erasing_sysctl(struct ctl_table *table, int write,
+                        void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int ret = 0;
+        int state = !static_branch_unlikely(&stack_erasing_bypass);
+        int prev_state = state;
+
+        table->data = &state;
+        table->maxlen = sizeof(int);
+        ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+        state = !!state;
+        if (ret || !write || state == prev_state)
+                return ret;
+
+        if (state)
+                static_branch_disable(&stack_erasing_bypass);
+        else
+                static_branch_enable(&stack_erasing_bypass);
+
+        pr_warn("stackleak: kernel stack erasing is %s\n",
+                                        state ? "enabled" : "disabled");
+        return ret;
+}
+
+#define skip_erasing()  static_branch_unlikely(&stack_erasing_bypass)
+#else
+#define skip_erasing()  false
+#endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */
+
 asmlinkage void stackleak_erase(void)
 {
         /* It would be nice not to have 'kstack_ptr' and 'boundary' on stack */
@@ -20,6 +55,9 @@ asmlinkage void stackleak_erase(void)
         unsigned int poison_count = 0;
         const unsigned int depth = STACKLEAK_SEARCH_DEPTH / sizeof(unsigned long);
 
+        if (skip_erasing())
+                return;
+
         /* Check that 'lowest_stack' value is sane */
         if (unlikely(kstack_ptr - boundary >= THREAD_SIZE))
                 kstack_ptr = boundary;
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index cc02050fd0c4..3ae223f7b5df 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -91,7 +91,9 @@
 #ifdef CONFIG_CHR_DEV_SG
 #include <scsi/sg.h>
 #endif
-
+#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE
+#include <linux/stackleak.h>
+#endif
 #ifdef CONFIG_LOCKUP_DETECTOR
 #include <linux/nmi.h>
 #endif
@@ -1233,6 +1235,17 @@ static struct ctl_table kern_table[] = {
                 .extra2         = &one,
         },
 #endif
+#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE
+        {
+                .procname       = "stack_erasing",
+                .data           = NULL,
+                .maxlen         = sizeof(int),
+                .mode           = 0600,
+                .proc_handler   = stack_erasing_sysctl,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+#endif
         { }
 };