From: Andy Lutomirski <luto@kernel.org>
To: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>, X86 ML <x86@kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Al Viro <viro@zeniv.linux.org.uk>, Will Deacon <will@kernel.org>,
Dan Williams <dan.j.williams@intel.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Waiman Long <longman@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
Thomas Gleixner <tglx@linutronix.de>,
Andrew Cooper <andrew.cooper3@citrix.com>,
Christoph Hellwig <hch@lst.de>
Subject: Re: [PATCH] x86/uaccess: Use pointer masking to limit uaccess speculation
Date: Wed, 19 Aug 2020 17:18:19 -0700 [thread overview]
Message-ID: <CALCETrXeTqkGry=Rbccn9EP1=YAqkYBt7wywrFohUyG-6A_udA@mail.gmail.com> (raw)
In-Reply-To: <20200819170223.nmv7dekvpc5yk4rm@treble>
On Wed, Aug 19, 2020 at 10:02 AM Josh Poimboeuf <jpoimboe@redhat.com> wrote:
>
> On Wed, Aug 19, 2020 at 09:39:10AM -0700, Andy Lutomirski wrote:
> > On Wed, Aug 19, 2020 at 7:50 AM Josh Poimboeuf <jpoimboe@redhat.com> wrote:
> > > +/*
> > > + * Sanitize a uaccess pointer such that it becomes NULL if it's not a valid
> > > + * user pointer. This blocks speculative dereferences of user-controlled
> > > + * pointers.
> > > + */
> > > +#define uaccess_mask_ptr(ptr) \
> > > + (__typeof__(ptr)) array_index_nospec((__force unsigned long)ptr, user_addr_max())
> > > +
> >
> > If I dug through all the macros correctly, this is generating a fairly
> > complex pile of math to account for the fact that user_addr_max() is
> > variable and that it's a nasty number.
>
> The math is actually pretty simple. It's identical to what getuser.S is
> doing:
>
> cmp TASK_addr_limit(%_ASM_DX),%_ASM_AX
> sbb %_ASM_DX, %_ASM_DX
> and %_ASM_DX, %_ASM_AX
>
> > But I don't think there's any particular need to use the real maximum
> > user address here. Allowing a mis-speculated user access to a
> > non-canonical address or to the top guard page of the lower canonical
> > region is harmless. With current kernels, a sequence like:
> >
> > if (likely((long)addr > 0) {
> > masked_addr = addr & 0x7FFFFFFFFFFFFFFFUL;
> > } else {
> > if (kernel fs) {
> > masked_addr = addr;
> > } else {
> > EFAULT;
> > }
> > }
>
> The masking has to be done without conditional branches, otherwise it
> defeats the point.
Ugh. Fair enough.
> Yeah, we could do that. Though in the meantime, the simple merge
> conflict resolution with Christoph's patches would be
> s/user_addr_max/TASK_SIZE_MAX/ in my uaccess_mask_ptr() macro.
Okay. I will try to help remember :)
--Andy
next prev parent reply other threads:[~2020-08-20 0:18 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-19 14:50 [PATCH] x86/uaccess: Use pointer masking to limit uaccess speculation Josh Poimboeuf
2020-08-19 16:39 ` Andy Lutomirski
2020-08-19 17:02 ` Josh Poimboeuf
2020-08-19 21:30 ` David Laight
2020-08-20 0:18 ` Andy Lutomirski [this message]
2020-08-28 19:29 ` Josh Poimboeuf
2020-08-29 13:21 ` David Laight
2020-08-29 19:31 ` David Laight
2020-08-31 17:31 ` Josh Poimboeuf
2020-09-01 8:32 ` David Laight
2020-09-01 14:26 ` Josh Poimboeuf
2020-09-01 15:00 ` David Laight
2020-09-01 15:24 ` Josh Poimboeuf
2020-09-01 14:02 ` Mark Rutland
2020-09-01 14:21 ` Josh Poimboeuf
2020-09-01 14:52 ` Mark Rutland
2020-09-01 14:46 ` Christoph Hellwig
2020-09-01 14:54 ` Mark Rutland
2020-09-01 15:05 ` Christoph Hellwig
2020-09-01 15:46 ` Christoph Hellwig
2020-09-02 11:43 ` Mark Rutland
2020-09-02 13:32 ` Christoph Hellwig
2020-09-02 17:23 ` Mark Rutland
2020-09-03 6:56 ` Christoph Hellwig
2020-09-04 16:00 ` Mark Rutland
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CALCETrXeTqkGry=Rbccn9EP1=YAqkYBt7wywrFohUyG-6A_udA@mail.gmail.com' \
--to=luto@kernel.org \
--cc=aarcange@redhat.com \
--cc=andrew.cooper3@citrix.com \
--cc=dan.j.williams@intel.com \
--cc=hch@lst.de \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=longman@redhat.com \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
--cc=will@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).