From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E69EC43469 for ; Mon, 21 Sep 2020 16:22:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 106A620708 for ; Mon, 21 Sep 2020 16:22:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727361AbgIUQWa (ORCPT ); Mon, 21 Sep 2020 12:22:30 -0400 Received: from mga02.intel.com ([134.134.136.20]:36798 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726419AbgIUQW3 (ORCPT ); Mon, 21 Sep 2020 12:22:29 -0400 IronPort-SDR: WAODNz+AWg2Fv1qgtS+4SfBx2nYuI6MWYQRyP3bsZ7tj77dLTudoIB7CoTTrUlXTS1nvPJoRVC b8iThqVFPTkA== X-IronPort-AV: E=McAfee;i="6000,8403,9751"; a="148077072" X-IronPort-AV: E=Sophos;i="5.77,287,1596524400"; d="scan'208";a="148077072" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga007.jf.intel.com ([10.7.209.58]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Sep 2020 09:22:27 -0700 IronPort-SDR: DzeCj1CYXt5zm0Njvv2xtnUdYaZZmhzsBjJGNA1e7sXxqTd/uptwCH02FfBaxY46EttPZoUWgv pQwlJ5MOClew== X-IronPort-AV: E=Sophos;i="5.77,287,1596524400"; d="scan'208";a="348153605" Received: from yyu32-mobl1.amr.corp.intel.com (HELO [10.212.102.78]) ([10.212.102.78]) by orsmga007-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Sep 2020 09:22:26 -0700 Subject: Re: [PATCH v12 8/8] x86: Disallow vsyscall emulation when CET is enabled To: Andy Lutomirski Cc: X86 ML , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , LKML , "open list:DOCUMENTATION" , Linux-MM , linux-arch , Linux API , Arnd Bergmann , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang References: <20200918192312.25978-1-yu-cheng.yu@intel.com> <20200918192312.25978-9-yu-cheng.yu@intel.com> From: "Yu, Yu-cheng" Message-ID: Date: Mon, 21 Sep 2020 09:22:25 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Thunderbird/68.12.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-api@vger.kernel.org On 9/18/2020 5:11 PM, Andy Lutomirski wrote: > On Fri, Sep 18, 2020 at 12:23 PM Yu-cheng Yu wrote: >> >> Emulation of the legacy vsyscall page is required by some programs >> built before 2013. Newer programs after 2013 don't use it. >> Disable vsyscall emulation when Control-flow Enforcement (CET) is >> enabled to enhance security. >> >> Signed-off-by: Yu-cheng Yu >> --- >> v12: >> - Disable vsyscall emulation only when it is attempted (vs. at compile time). >> >> arch/x86/entry/vsyscall/vsyscall_64.c | 9 +++++++++ >> 1 file changed, 9 insertions(+) >> >> diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c >> index 44c33103a955..3196e963e365 100644 >> --- a/arch/x86/entry/vsyscall/vsyscall_64.c >> +++ b/arch/x86/entry/vsyscall/vsyscall_64.c >> @@ -150,6 +150,15 @@ bool emulate_vsyscall(unsigned long error_code, >> >> WARN_ON_ONCE(address != regs->ip); >> >> +#ifdef CONFIG_X86_INTEL_CET >> + if (current->thread.cet.shstk_size || >> + current->thread.cet.ibt_enabled) { >> + warn_bad_vsyscall(KERN_INFO, regs, >> + "vsyscall attempted with cet enabled"); >> + return false; >> + } > > Nope, try again. Having IBT on does *not* mean that every library in > the process knows that we have indirect branch tracking. The legacy > bitmap exists for a reason. Also, I want a way to flag programs as > not using the vsyscall page, but that flag should not be called CET. > And a process with vsyscalls off should not be able to read the > vsyscall page, and /proc/self/maps should be correct. > > So you have some choices: > > 1. Drop this patch and make it work. > > 2. Add a real per-process vsyscall control. Either make it depend on > vsyscall=xonly and wire it up correctly or actually make it work > correctly with vsyscall=emulate. > > NAK to any hacks in this space. Do it right or don't do it at all. > We can drop this patch, and bring back the previous patch that fixes up shadow stack and ibt. That makes vsyscall emulation work correctly, and does not force the application to do anything different from what is working now. I will post the previous patch as a reply to this thread so that people can make comments on it. Yu-cheng