From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.6 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0DDE4C433E6 for ; Wed, 10 Feb 2021 02:39:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CA22464D5D for ; Wed, 10 Feb 2021 02:39:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235414AbhBJCjB (ORCPT ); Tue, 9 Feb 2021 21:39:01 -0500 Received: from mail.kernel.org ([198.145.29.99]:34412 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235339AbhBJCfu (ORCPT ); Tue, 9 Feb 2021 21:35:50 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id A020564E6C; Wed, 10 Feb 2021 02:33:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1612924433; bh=EndaGyRdjN9oy9Zca2ujwb1bEzZLVxLQbsL8F5iThuY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ctb5fIbAFcuSYro0m5gatX6VCcabk0pUfsB6pfbWiuzTK7meZJ/Qx4JlomvaZPyE2 uN3EIp5ad0f4t+Ka+SGEisk/CfW3U9Qwkizu4CT4qjdx8XFs77Yz19KDoeVRQibQLg 5iUFcM58vjfMqbZeV5Ec2B1bWp4F/6CazKETAZTaEH4So0iR0ttKgGMBQj3vTbSzkg yzsVrfK9wBIIbFxW8Y70MGSZG7Bm/8WdJ9GztyZQoof5UxPy8sH66NFGgzwrMnWLj8 4WC00C1CZElgyK0koeYNcXln2biN59EuyS8xXJe6IGfO903g7A/veWfEnBGa+eg7UU PbNJZFwjExA/Q== From: Andy Lutomirski To: x86@kernel.org Cc: LKML , Dave Hansen , Alexei Starovoitov , Daniel Borkmann , Yonghong Song , Masami Hiramatsu , Andy Lutomirski , Peter Zijlstra Subject: [PATCH v2 07/14] x86/fault: Improve kernel-executing-user-memory handling Date: Tue, 9 Feb 2021 18:33:39 -0800 Message-Id: X-Mailer: git-send-email 2.29.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Right now we treat the case of the kernel trying to execute from user memory more or less just like the kernel getting a page fault on a user access. In the failure path, we check for erratum #93, try to otherwise fix up the error, and then oops. If we manage to jump to the user address space, with or without SMEP, we should not try to resolve the page fault. This is an error, pure and simple. Rearrange the code so that we catch this case early, check for erratum #93, and bail out. Cc: Dave Hansen Cc: Peter Zijlstra Signed-off-by: Andy Lutomirski --- arch/x86/mm/fault.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index b1104844260d..cbb1a9754473 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -447,6 +447,9 @@ static int is_errata93(struct pt_regs *regs, unsigned long address) || boot_cpu_data.x86 != 0xf) return 0; + if (user_mode(regs)) + return 0; + if (address != regs->ip) return 0; @@ -744,9 +747,6 @@ no_context(struct pt_regs *regs, unsigned long error_code, if (is_prefetch(regs, error_code, address)) return; - if (is_errata93(regs, address)) - return; - /* * Buggy firmware could access regions which might page fault, try to * recover from such faults. @@ -1239,6 +1239,21 @@ void do_user_addr_fault(struct pt_regs *regs, tsk = current; mm = tsk->mm; + if (unlikely((error_code & (X86_PF_USER | X86_PF_INSTR)) == X86_PF_INSTR)) { + /* + * Whoops, this is kernel mode code trying to execute from + * user memory. Unless this is AMD erratum #93, which + * corrupts RIP such that it looks like a user address, + * this is unrecoverable. Don't even try to look up the + * VMA. + */ + if (is_errata93(regs, address)) + return; + + bad_area_nosemaphore(regs, error_code, address); + return; + } + /* kprobes don't want to hook the spurious faults: */ if (unlikely(kprobe_page_fault(regs, X86_TRAP_PF))) return; -- 2.29.2