From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 388CBC47425 for ; Mon, 28 Sep 2020 17:38:00 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id D43272100A for ; Mon, 28 Sep 2020 17:37:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="BWf0gF/1" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D43272100A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 4BC336B0087; Mon, 28 Sep 2020 13:37:59 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 446436B0089; Mon, 28 Sep 2020 13:37:59 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3105C6B008A; Mon, 28 Sep 2020 13:37:59 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0223.hostedemail.com [216.40.44.223]) by kanga.kvack.org (Postfix) with ESMTP id 16B7C6B0087 for ; Mon, 28 Sep 2020 13:37:59 -0400 (EDT) Received: from smtpin15.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id CBDE482499A8 for ; Mon, 28 Sep 2020 17:37:58 +0000 (UTC) X-FDA: 77313178236.15.sofa42_0e0192327183 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin15.hostedemail.com (Postfix) with ESMTP id 8BE021814B0C8 for ; Mon, 28 Sep 2020 17:37:58 +0000 (UTC) X-HE-Tag: sofa42_0e0192327183 X-Filterd-Recvd-Size: 5624 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf20.hostedemail.com (Postfix) with ESMTP for ; Mon, 28 Sep 2020 17:37:57 +0000 (UTC) Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C160321D41 for ; Mon, 28 Sep 2020 17:37:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601314677; bh=NigSMLyumIm9ggwTyG5LDnbruxmBhHyjdEZJ9Az6pxk=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=BWf0gF/1Q2N2DRi0WitlGM15dK3OoCFj7ovB6s6ZXn5zi2NKs3faVDgZTWbQcnGc0 cGifc3fJghySiXTrJ7GmiKOHhCYNGczgcFgzS1ey7Yzx4wfjeZSNbAhghZBhCql8PV XM6gRGQYTk2QBxa7BidHfDlS6u3mAqGTqwZNQJ1I= Received: by mail-wm1-f44.google.com with SMTP id s13so1958114wmh.4 for ; Mon, 28 Sep 2020 10:37:56 -0700 (PDT) X-Gm-Message-State: AOAM533SOOudUdF8miaMOd64ijxFGqXfuJ2ZqtHDoMb1V9FVZ/B0Brj5 GWOis0LDDRz38wpt3vXjiP5vWrZlAlriuAbRtXR1xg== X-Google-Smtp-Source: ABdhPJz8+wjcR1Xd7cJT/xzMQ5Y823qmYExTDDQnf50+Oxufxdq2wRFjnFMC9Lbm2uLY6O2u6ua5c+9MahX9wVjYQZA= X-Received: by 2002:a1c:740c:: with SMTP id p12mr291853wmc.176.1601314675297; Mon, 28 Sep 2020 10:37:55 -0700 (PDT) MIME-Version: 1.0 References: <99B32E59-CFF2-4756-89BD-AEA0021F355F@amacapital.net> In-Reply-To: From: Andy Lutomirski Date: Mon, 28 Sep 2020 10:37:42 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH v13 8/8] x86/vsyscall/64: Fixup Shadow Stack and Indirect Branch Tracking for vsyscall emulation To: Yu-cheng Yu Cc: Andy Lutomirski , X86 ML , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , LKML , "open list:DOCUMENTATION" , Linux-MM , linux-arch , Linux API , Arnd Bergmann , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , Weijiang Yang , Pengfei Xu Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Sep 28, 2020 at 9:59 AM Yu-cheng Yu wrote: > > On Fri, 2020-09-25 at 09:51 -0700, Andy Lutomirski wrote: > > > On Sep 25, 2020, at 9:48 AM, Yu, Yu-cheng wrote: > + > + cet = get_xsave_addr(&fpu->state.xsave, XFEATURE_CET_USER); > + if (!cet) { > + /* > + * This is an unlikely case where the task is > + * CET-enabled, but CET xstate is in INIT. > + */ > + WARN_ONCE(1, "CET is enabled, but no xstates"); "unlikely" doesn't really cover this. > + fpregs_unlock(); > + goto sigsegv; > + } > + > + if (cet->user_ssp && ((cet->user_ssp + 8) < TASK_SIZE_MAX)) > + cet->user_ssp += 8; This looks buggy. The condition should be "if SHSTK is on, then add 8 to user_ssp". If the result is noncanonical, then some appropriate exception should be generated, probably by the FPU restore code -- see below. You should be checking the SHSTK_EN bit, not SSP. Also, can you point me to where any of these canonicality rules are documented in the SDM? I looked and I can't find them. This reminds me: this code in extable.c needs to change. __visible bool ex_handler_fprestore(const struct exception_table_entry *fixup, struct pt_regs *regs, int trapnr, unsigned long error_code, unsigned long fault_addr) { regs->ip = ex_fixup_addr(fixup); WARN_ONCE(1, "Bad FPU state detected at %pB, reinitializing FPU registers.", (void *)instruction_pointer(regs)); __copy_kernel_to_fpregs(&init_fpstate, -1); Now that we have supervisor states like CET, this is buggy. This should do something intelligent like initializing all the *user* state and trying again. If that succeeds, a signal should be sent rather than just corrupting the task. And if it fails, then perhaps some actual intelligence is needed. We certainly should not just disable CET because something is wrong with the CET MSRs.