Linux 5.18 Hardens The Kernel For 64-bit Arm With Shadow Call Stack Support

In addition to supporting the Tesla FSD chip, Raspberry Pi Zero 2 W, and other new Arm SoCs in Linux 5.18, this kernel will also be more secure for 64-bit Arm with adding Shadow Call Stack support.

The GCC 12 compiler to be released very soon adds AArch64 Shadow Call Stack support similar to the SCS instrumentation already supported by the LLVM Clang compiler. The Shadow Call Stack compiler support is to help protect against stack buffer overflows

With the Linux 5.18 hardening updates there is support added for ARM64 (AArch64) Shadow Call Stack support when building the Linux kernel with GCC 12 and newer. Previously this work was attempted for the kernel as a kernel-specific GCC plug-in but now thankfully the GCC compiler has this upstream SCS instrumentation pass.

The ARM64 SCS support is the prominent hardening change for this current kernel cycle for protecting against return address overwrites.