From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x225Y1iY0wgWFxUMB94rJlRCAovJZKDKWruMyqTYhrVi9gYV6ivKmctAdwUNokLHUCotOo2lI ARC-Seal: i=1; a=rsa-sha256; t=1517945367; cv=none; d=google.com; s=arc-20160816; b=MrlpC5dKyeiXiBfZED7whjJk1PLymXBo5COCf0uXQ5+Q2NvG5iDThPzLtoQzyOnv5Y LU8AkmId+RTCevHrxWcjMs4XGhDrtIHCi9RyBzdrhfPQbFjZ4yTip1izguG+4MhW/ZlB Kp3g8YDI4gOx7SqGHKtIqrYfa2GWoDtEW/FlA6/W6T5ZXdtBQcUUWrIxc/420HRwtWJT t1C+Oy5d2yHyxT2NsvMmgdGHknEHEOGOzQyR95x4yNm+cyt+gnxjxD8ma11ysz9LRE6o +DYjU0VnyXPFZTWkEmKOMgmuFSYtKkQNRp+ldZgf2OK+qlIFX6WfWEWeP454j6zfRozW oXdA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date :arc-authentication-results; bh=xMMsgH/A7T9efs4+qoOauKDAB5QyZqGANTBjxAiHwC8=; b=DCrXcpyyPIV2ehPV6wxvM/qbKeKJX1NYz4GbqaftAQp5H7/CFCd7iqUuqu7shu2DAy ZDtikkCv4UndyMSFimGwx7B4h68VgiMQZVtA5l04JPNc5vASVDJUje6UTpCxOF0YIJ7s jHz7xECh8SoWUk8Ysqghl5MDn8ngKw0lkhUy0sVqH9rsCIYUo7AL44cS42vExcozwtmo 9rfORgakNHyve07hRlBpnUUANo76Uv0ZY2Dk+bRM1e4oLRoU7g6i4l6W9I+G64Q8VE25 +8m3IQiBsg3qSU5PciMOIHjyR420TW3jVp48W/4195p1OYqiidtnDdfqgV9zVfZvv+55 PESQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of lhenriques@suse.com designates 195.135.220.15 as permitted sender) smtp.mailfrom=lhenriques@suse.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of lhenriques@suse.com designates 195.135.220.15 as permitted sender) smtp.mailfrom=lhenriques@suse.com Date: Tue, 6 Feb 2018 19:29:25 +0000 From: Luis Henriques To: Dan Williams Cc: linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org, kernel-hardening@lists.openwall.com, gregkh@linuxfoundation.org, x86@kernel.org, Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , tglx@linutronix.de, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@linux.intel.com Subject: Re: [PATCH v4 07/10] x86: narrow out of bounds syscalls to sys_read under speculation Message-ID: <20180206192925.qkmghwsbaysr4iv2@hermes.olymp> References: <151632009605.21271.11304291057104672116.stgit@dwillia2-desk3.amr.corp.intel.com> <151632014097.21271.16980532033566583357.stgit@dwillia2-desk3.amr.corp.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <151632014097.21271.16980532033566583357.stgit@dwillia2-desk3.amr.corp.intel.com> X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1589977480308913684?= X-GMAIL-MSGID: =?utf-8?q?1591681081721537403?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Thu, Jan 18, 2018 at 04:02:21PM -0800, Dan Williams wrote: > The syscall table base is a user controlled function pointer in kernel > space. Like, 'get_user, use 'MASK_NOSPEC' to prevent any out of bounds > speculation. While retpoline prevents speculating into the user > controlled target it does not stop the pointer de-reference, the concern > is leaking memory relative to the syscall table base. This patch seems to cause a regression. An easy way to reproduce what I'm seeing is to run the samples/statx/test-statx. Here's what I see when I have this patchset applied: # ./test-statx /tmp statx(/tmp) = -1 /tmp: Bad file descriptor Reverting this single patch seems to fix it. Cheers, -- Luís > > Reported-by: Linus Torvalds > Cc: Thomas Gleixner > Cc: Ingo Molnar > Cc: "H. Peter Anvin" > Cc: x86@kernel.org > Cc: Andy Lutomirski > Signed-off-by: Dan Williams > --- > arch/x86/entry/entry_64.S | 2 ++ > arch/x86/include/asm/smap.h | 9 ++++++++- > 2 files changed, 10 insertions(+), 1 deletion(-) > > diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S > index 4f8e1d35a97c..2320017077d4 100644 > --- a/arch/x86/entry/entry_64.S > +++ b/arch/x86/entry/entry_64.S > @@ -35,6 +35,7 @@ > #include > #include > #include > +#include > #include > #include > #include > @@ -264,6 +265,7 @@ entry_SYSCALL_64_fastpath: > cmpl $__NR_syscall_max, %eax > #endif > ja 1f /* return -ENOSYS (already in pt_regs->ax) */ > + MASK_NOSPEC %r11 %rax /* sanitize syscall_nr wrt speculation */ > movq %r10, %rcx > > /* > diff --git a/arch/x86/include/asm/smap.h b/arch/x86/include/asm/smap.h > index 2b4ad4c6a226..3b5b2cf58dc6 100644 > --- a/arch/x86/include/asm/smap.h > +++ b/arch/x86/include/asm/smap.h > @@ -35,7 +35,14 @@ > * this directs the cpu to speculate with a NULL ptr rather than > * something targeting kernel memory. > * > - * assumes CF is set from a previous 'cmp TASK_addr_limit, %ptr' > + * In the syscall entry path it is possible to speculate past the > + * validation of the system call number. Use MASK_NOSPEC to sanitize the > + * syscall array index to zero (sys_read) rather than an arbitrary > + * target. > + * > + * assumes CF is set from a previous 'cmp' i.e.: > + * cmp TASK_addr_limit, %ptr > + * cmp __NR_syscall_max, %idx > */ > .macro MASK_NOSPEC mask val > sbb \mask, \mask > >