From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B504C05027 for ; Mon, 23 Jan 2023 09:10:15 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 62A886B0071; Mon, 23 Jan 2023 04:10:14 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 5BD906B0072; Mon, 23 Jan 2023 04:10:14 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4055E6B0073; Mon, 23 Jan 2023 04:10:14 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 2DCDD6B0071 for ; Mon, 23 Jan 2023 04:10:14 -0500 (EST) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id C331CC0434 for ; Mon, 23 Jan 2023 09:10:13 +0000 (UTC) X-FDA: 80385492306.13.9C347D4 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by imf13.hostedemail.com (Postfix) with ESMTP id 54C5B2001A for ; Mon, 23 Jan 2023 09:10:11 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b="Ial7/X4K"; spf=pass (imf13.hostedemail.com: domain of david@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=david@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1674465011; a=rsa-sha256; cv=none; b=fM5+R+oxgilL5DLvKKP2eVHUqaqIRKPM+E7dx9ZN7QcSK+MxEmDUu2Bd8kXIOZBu7fhddu W+/yPwc1jJ60pM7RMuHGtyz7FfnkfumgDQ+Er9Wf0aCjkBrmwzW/ypkN1tP8NU4ZQ4jBDs ZEshaTiBtfih3TpGMTuQor5OKUKpDKs= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b="Ial7/X4K"; spf=pass (imf13.hostedemail.com: domain of david@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=david@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1674465011; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=HKFAim2DBhl4LLObFEbUn52dRxvU/t8Jxw2IGTWhezY=; b=fkeVM5wE3gv/TTGDhzJE7wdv4KpwT8ZmaSnUhGGH/TPN7jMulukvnCgbW/hToAmlR79t/4 o0dWuskKGBWATPv4cGz0f7Cqqz/TcJJEZVa681FgLR5Q+31fgIlLyQsSJCZxHjUpF7+bQn XovGExC1Mp1sRamPMY2CKAQLoIV5PY4= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1674465010; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HKFAim2DBhl4LLObFEbUn52dRxvU/t8Jxw2IGTWhezY=; b=Ial7/X4KRhblIFSPr+km5DT/H5DKsz0UT/mPezJiCbdefUd2dS0HSc6VdCwOyKYcEe4wuS RrnGVEo3zJg7gaeYKkEYI+RWAe+dzK/wjmbyp99zx+tRGQFDFM3ld1K+4CdmpvvPLT9OfX xV5Ofp3M4vTCllAJJzvrPr1eNEyPysM= Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-262-3mOv7xr3PQWIgwicG7fguw-1; Mon, 23 Jan 2023 04:10:08 -0500 X-MC-Unique: 3mOv7xr3PQWIgwicG7fguw-1 Received: by mail-wr1-f71.google.com with SMTP id i28-20020adfa51c000000b002ba26dfcd08so1802239wrb.18 for ; Mon, 23 Jan 2023 01:10:08 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:in-reply-to:organization:from:references :to:content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=HKFAim2DBhl4LLObFEbUn52dRxvU/t8Jxw2IGTWhezY=; b=MB15/7dGS4CLGRbpMa34sir35mfZADd5l3qQnpAHic1/wZjFnISVOZ+HrQcE0sHS/2 m/hUd1J/QkQ4FN+j/YZnzwLLYw29zvn9Km9f7tASrgocUft0Atd7kzqHEcHu4+nMtDZK LNPzJzOxkHRwaOCpEJEN/Jm3mhna5wF0ZD22TMJDuXQdXuCGF84Tfiu3j7qVn8n4zfY6 NwI4zPfAuWuULiumZXoUp5z58unJ0ReTB2IqEE6d6JUevhiGqz4aOdeSN66bnTW+K9Rr OFOb+rGhQXBsAH6SyMkhBPe9eGus6ukC0gy0vL8KRKmffQEutEP9e/M4I/dEV01Z6D52 iJ4g== X-Gm-Message-State: AFqh2kpIHVcdMaUlu8Ez6FXiP9+nDz0Bd61XDzorBeATSu38eoz/Y979 qoMuFtC3DKtZ5/lu01E0D/VUAPxJzxozJicRooz1wutbOOiUhfcfAmjkOI7XvOSr4obMK/Qrjmb xXJLqjFAoKMw= X-Received: by 2002:a05:600c:202:b0:3da:f80d:7230 with SMTP id 2-20020a05600c020200b003daf80d7230mr23062524wmi.8.1674465007352; Mon, 23 Jan 2023 01:10:07 -0800 (PST) X-Google-Smtp-Source: AMrXdXuEFJD+GlVkgCsrARqGaqnmZGpYCMV5PdkCH/Ay9YKbnuBq7J8R+uYOVSo7km0aft3L1OOxkg== X-Received: by 2002:a05:600c:202:b0:3da:f80d:7230 with SMTP id 2-20020a05600c020200b003daf80d7230mr23062458wmi.8.1674465006917; Mon, 23 Jan 2023 01:10:06 -0800 (PST) Received: from ?IPV6:2003:cb:c704:1100:65a0:c03a:142a:f914? (p200300cbc704110065a0c03a142af914.dip0.t-ipconnect.de. [2003:cb:c704:1100:65a0:c03a:142a:f914]) by smtp.gmail.com with ESMTPSA id p21-20020a05600c359500b003c70191f267sm11195784wmq.39.2023.01.23.01.10.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 23 Jan 2023 01:10:06 -0800 (PST) Message-ID: Date: Mon, 23 Jan 2023 10:10:04 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.6.0 Subject: Re: [PATCH v5 23/39] mm: Don't allow write GUPs to shadow stack memory To: Rick Edgecombe , x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com References: <20230119212317.8324-1-rick.p.edgecombe@intel.com> <20230119212317.8324-24-rick.p.edgecombe@intel.com> From: David Hildenbrand Organization: Red Hat In-Reply-To: <20230119212317.8324-24-rick.p.edgecombe@intel.com> X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspam-User: X-Rspamd-Queue-Id: 54C5B2001A X-Rspamd-Server: rspam01 X-Stat-Signature: imgp8j9ektaefderq9nu7srwezsd8cyj X-HE-Tag: 1674465011-278675 X-HE-Meta: U2FsdGVkX19kMiMwtZkGYJhKv6LIHGOed6vOfL+td6Cy5tjgJQyaz7BVtkOJssckXMjb3sgy9Xjn8qa3kCJc/tCDjhVJzj/ddkZ1Jsa4YnghSr8kKxL9jg1ZrE3p2si6vSc5+WqXNUDHfI2Jy5c7npnFxE+88hKml+MGe/NH0GYq0mn+qQERgjZY2dVuGtOABYkaEIRTFUdEdKCN6Z5OqZQ+MA+rtdVh9vMMrhYGaCKtqeJtggHw/DPfkIU7vYkTdVjtqolmnx7TUDRWG7Ldyj3fMVVSp4Hgv/i2FVyzehPJt4CvUXXhpK2HGVs8CWTeH2EtL+QYyztoUHT+MGbN4vyXrIQYqs8f5s1M7zV7TOhV+qxt372Lda6TplEDqGgmY2BlOeIpkAtIVNCuOdcVYnV3/wnCJJ+N/lFLA8HAwZ39VzXaseO7AgQnwU8Meizjm7j3PqA2kD/9QoxpyQadOAF1SVFdx4SoZ6J2EOG2KCd4b86rLXKvA6fKHqHLOtkPFV8OZ4fCEJfuHGNM0lgFG3K1maSK0Yrpg4AqPBGZbrDfVfjxAByMl5zOw0qdQoURHueWxnhk5CgDCswQLKryQF8VJoN2M99gPJtDED5Glul1WUUzKIBGnwum+B82R0fx+XtpsL36/8Zw4mSPE98TjrkptK4WKgB39PRTVA6Bmo8tzG1aKFCb/Jgig/VvE2WJ5ru1MHu2XLPMon5pzb1sNdCuN14vdVCJQa/jx5c4BXCpzkYR6a/A3eCW4nRsLpQBWgxHM4hQ1aMuoI+ONDPNFBJRY/blSIdG540XqNrWWgWF/lKyhZKy8nPOwmsXynKjnozkgZsK12GlynSnkUcWHE0SZXMabI7nfJNKogzU+nNLKdlSrifZU6AOQhujVRv4W5MLQ9rJkTOXKVlWum+dvJBcy+9ymXCOFCb1vCUJilFm0xJMrcuQqNaStqRzDXS7JHRUTJjGY/4Td3W1Gs1 4PWx/SjU vyTKwsZPNjFK5RwhZRGjrc5wUdYafWaVFG+MsKQHlvzfcrlUreKCBe41gZ+yscLDedwEYZT/SXcsIqsRrSEng+oy28Z0WqAbURdAFMw1sW1+w00WLPysRySAjDDizWI7HJmiUrSqBxo46wUMxv/rXVle1aFpO+E3vf1Al2zmDVUBtkMujInM4AydXa55OoQJQaI+w6gSHPMJvXinzz2COv3xo/rfgSW8F30Ufo2llxD4ry35i+dK9NeUZtxGlIp6FcA1rpeAOXvFxjhxsD+0gCICVCW8hFaiPwkVH9w+HSB6HUZ9+HbnOX9jWFCyIfbr2ZcTegVZO/C5llZNXGmcvQkMITHWUQj8r9VdiZyXQTluLWUq8mWA5E9VCZQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 19.01.23 22:23, Rick Edgecombe wrote: > The x86 Control-flow Enforcement Technology (CET) feature includes a new > type of memory called shadow stack. This shadow stack memory has some > unusual properties, which requires some core mm changes to function > properly. > > Shadow stack memory is writable only in very specific, controlled ways. > However, since it is writable, the kernel treats it as such. As a result > there remain many ways for userspace to trigger the kernel to write to > shadow stack's via get_user_pages(, FOLL_WRITE) operations. To make this a > little less exposed, block writable GUPs for shadow stack VMAs. > > Still allow FOLL_FORCE to write through shadow stack protections, as it > does for read-only protections. So an app can simply modify the shadow stack itself by writing to /proc/self/mem ? Is that really intended? Looks like security hole to me at first sight, but maybe I am missing something important. -- Thanks, David / dhildenb