LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Jiri Kosina <jkosina@suse.cz>
To: "H. Peter Anvin" <hpa@zytor.com>
Cc: Borislav Petkov <bp@suse.de>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>,
	x86@kernel.org, linux-kernel@vger.kernel.org, jroedel@suse.de
Subject: Re: [PATCH] x86: be more helpful with SMEP faults
Date: Tue, 10 Jun 2014 22:49:31 +0200 (CEST)
Message-ID: <alpine.LNX.2.00.1406102248490.1321@pobox.suse.cz> (raw)
In-Reply-To: <53976984.4030301@zytor.com>

On Tue, 10 Jun 2014, H. Peter Anvin wrote:

> >> @@ -594,6 +596,11 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
> >>  
> >>  		if (pte && pte_present(*pte) && !pte_exec(*pte))
> >>  			printk(nx_warning, from_kuid(&init_user_ns, current_uid()));
> >> +		if (pte && pte_present(*pte) && pte_exec(*pte) &&
> >> +				(pgd_flags(*pgd) & _PAGE_USER) &&
> >> +				static_cpu_has(X86_FEATURE_SMEP) &&
> > 
> > Btw, we could probably save us this line as CR4 reserved bits should be
> > Must-Be-Zero and setting any of those should #GP. And I'm talking about
> > pre-SMEP Intel, and AMD machines.
> > 
> > IOW, if CR4.SMEP is set, it definitely means SMEP is present and
> > enabled.
> > 
> > hpa, that true?
> 
> Yes.  Also, the Linux kernel will set or clear X86_FEATURE_SMEP to
> match, so the two are redundant.




From: Jiri Kosina <jkosina@suse.cz>
Subject: [PATCH v2] x86: be more helpful with SMEP faults

If pagefault triggers due to SMEP triggering, it can't be really easily
distinguished from any other oops-causing pagefault, which might lead to quite
some confusion when trying to understand the reason for the oops.

Print an explanatory message in case the fault happened during instruction
fetch for _PAGE_USER page which is present and executable on SMEP-enabled CPUs.

This is consistent with what we are doing for NX already; in addition to
immediately seeing from the oops what might be happening, it can even easily
give a good indication to sysadmins who are carefully monitoring their kernel
logs that someone might be trying to pwn them.

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
---
 arch/x86/mm/fault.c | 6 ++++++
 1 file changed, 6 insertions(+)

- v1 -> v2: removed redundant X86_FEATURE_SMEP check

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 8e57229..6f6b0e8 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -574,6 +574,8 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
 
 static const char nx_warning[] = KERN_CRIT
 "kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
+static const char smep_warning[] = KERN_CRIT
+"unable to execute userspace code (SMEP?) (uid: %d)\n";
 
 static void
 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
@@ -594,6 +596,10 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
 
 		if (pte && pte_present(*pte) && !pte_exec(*pte))
 			printk(nx_warning, from_kuid(&init_user_ns, current_uid()));
+		if (pte && pte_present(*pte) && pte_exec(*pte) &&
+				(pgd_flags(*pgd) & _PAGE_USER) &&
+				(read_cr4() & X86_CR4_SMEP))
+			printk(smep_warning, from_kuid(&init_user_ns, current_uid()));
 	}
 
 	printk(KERN_ALERT "BUG: unable to handle kernel ");

-- 
Jiri Kosina
SUSE Labs

  reply index

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-06-10 19:08 Jiri Kosina
2014-06-10 20:18 ` Borislav Petkov
2014-06-10 20:24   ` H. Peter Anvin
2014-06-10 20:49     ` Jiri Kosina [this message]
2014-06-12  0:58       ` [tip:x86/mm] x86/smep: Be more informative when signalling an SMEP fault tip-bot for Jiri Kosina

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.LNX.2.00.1406102248490.1321@pobox.suse.cz \
    --to=jkosina@suse.cz \
    --cc=bp@suse.de \
    --cc=hpa@zytor.com \
    --cc=jroedel@suse.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git
	git clone --mirror https://lore.kernel.org/lkml/10 lkml/git/10.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git