linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Dan Williams <dan.j.williams@intel.com>
To: linux-kernel@vger.kernel.org
Cc: linux-arch@vger.kernel.org, Andi Kleen <ak@linux.intel.com>,
	Kees Cook <keescook@chromium.org>,
	kernel-hardening@lists.openwall.com, x86@kernel.org,
	Ingo Molnar <mingo@redhat.com>, Al Viro <viro@zeniv.linux.org.uk>,
	"H. Peter Anvin" <hpa@zytor.com>,
	tglx@linutronix.de, torvalds@linux-foundation.org,
	akpm@linux-foundation.org, alan@linux.intel.com
Subject: [PATCH v2 07/19] x86: introduce __uaccess_begin_nospec and ASM_IFENCE
Date: Thu, 11 Jan 2018 16:47:02 -0800	[thread overview]
Message-ID: <151571802258.27429.932636277047687877.stgit@dwillia2-desk3.amr.corp.intel.com> (raw)
In-Reply-To: <151571798296.27429.7166552848688034184.stgit@dwillia2-desk3.amr.corp.intel.com>

For 'get_user' paths, do not allow the kernel to speculate on the value
of a user controlled pointer. In addition to the 'stac' instruction for
Supervisor Mode Access Protection, an 'ifence' causes the 'access_ok'
result to resolve in the pipeline before the cpu might take any
speculative action on the pointer value.

Since this is a major kernel interface that deals with user controlled
data, the '__uaccess_begin_nospec' mechanism will prevent speculative
execution past an 'access_ok' permission check. While speculative
execution past 'access_ok' is not enough to lead to a kernel memory
leak, it is a necessary precondition.

To be clear, '__uaccess_begin_nospec' and ASM_IFENCE are not addressing
any known issues with 'get_user' they are addressing a class of
potential problems that could be near 'get_user' usages. In other words,
these helpers are for hygiene not clinical fixes.

There are no functional changes in this patch.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Suggested-by: Andi Kleen <ak@linux.intel.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Kees Cook <keescook@chromium.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: x86@kernel.org
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
 arch/x86/include/asm/smap.h    |    4 ++++
 arch/x86/include/asm/uaccess.h |   10 ++++++++++
 2 files changed, 14 insertions(+)

diff --git a/arch/x86/include/asm/smap.h b/arch/x86/include/asm/smap.h
index db333300bd4b..0b59707e0b46 100644
--- a/arch/x86/include/asm/smap.h
+++ b/arch/x86/include/asm/smap.h
@@ -40,6 +40,10 @@
 
 #endif /* CONFIG_X86_SMAP */
 
+#define ASM_IFENCE \
+	ALTERNATIVE_2 "", "mfence", X86_FEATURE_MFENCE_RDTSC, \
+			  "lfence", X86_FEATURE_LFENCE_RDTSC
+
 #else /* __ASSEMBLY__ */
 
 #include <asm/alternative.h>
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 574dff4d2913..a31fd4fc6483 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -124,6 +124,11 @@ extern int __get_user_bad(void);
 
 #define __uaccess_begin() stac()
 #define __uaccess_end()   clac()
+#define __uaccess_begin_nospec()	\
+({					\
+	stac();				\
+	ifence();			\
+})
 
 /*
  * This is a type: either unsigned long, if the argument fits into
@@ -487,6 +492,11 @@ struct __large_struct { unsigned long buf[100]; };
 	__uaccess_begin();						\
 	barrier();
 
+#define uaccess_try_nospec do {						\
+	current->thread.uaccess_err = 0;				\
+	__uaccess_begin_nospec();					\
+	barrier();
+
 #define uaccess_catch(err)						\
 	__uaccess_end();						\
 	(err) |= (current->thread.uaccess_err ? -EFAULT : 0);		\

  parent reply	other threads:[~2018-01-12  0:55 UTC|newest]

Thread overview: 59+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-01-12  0:46 [PATCH v2 00/19] prevent bounds-check bypass via speculative execution Dan Williams
2018-01-12  0:46 ` [PATCH v2 01/19] Documentation: document array_ptr Dan Williams
2018-01-12 10:38   ` Geert Uytterhoeven
2018-01-16 21:01   ` Kees Cook
2018-01-12  0:46 ` [PATCH v2 02/19] arm64: implement ifence_array_ptr() Dan Williams
2018-01-12  0:46 ` [PATCH v2 03/19] arm: " Dan Williams
2018-01-12  0:46 ` [PATCH v2 04/19] x86: implement ifence() Dan Williams
2018-01-12  2:27   ` Eric W. Biederman
2018-01-12  3:39     ` Dan Williams
2018-01-12  0:46 ` [PATCH v2 05/19] x86: implement ifence_array_ptr() and array_ptr_mask() Dan Williams
2018-01-12  0:46 ` [PATCH v2 06/19] asm-generic/barrier: mask speculative execution flows Dan Williams
2018-01-12  2:42   ` Eric W. Biederman
2018-01-12  9:12   ` Peter Zijlstra
2018-01-13  0:41     ` Dan Williams
2018-01-15  8:46       ` Peter Zijlstra
2018-01-12  0:47 ` Dan Williams [this message]
2018-01-12 17:51   ` [PATCH v2 07/19] x86: introduce __uaccess_begin_nospec and ASM_IFENCE Josh Poimboeuf
2018-01-12 18:21     ` Dan Williams
2018-01-12 18:58       ` Josh Poimboeuf
2018-01-12 19:26         ` Dan Williams
2018-01-12 20:01           ` Linus Torvalds
2018-01-12 20:41             ` Josh Poimboeuf
2018-01-12  0:47 ` [PATCH v2 08/19] x86: use __uaccess_begin_nospec and ASM_IFENCE in get_user paths Dan Williams
2018-01-12  1:11   ` Linus Torvalds
2018-01-12  1:14     ` Dan Williams
2018-01-12  0:47 ` [PATCH v2 09/19] ipv6: prevent bounds-check bypass via speculative execution Dan Williams
2018-01-12  0:47 ` [PATCH v2 10/19] ipv4: " Dan Williams
2018-01-12  7:59   ` Greg KH
2018-01-12 18:47     ` Dan Williams
2018-01-13  8:56       ` Greg KH
2018-01-12  0:47 ` [PATCH v2 11/19] vfs, fdtable: " Dan Williams
2018-01-12  0:47 ` [PATCH v2 12/19] userns: " Dan Williams
2018-01-12  0:47 ` [PATCH v2 13/19] udf: " Dan Williams
2018-01-15 10:32   ` Jan Kara
2018-01-15 17:49     ` Dan Williams
2018-01-12  0:47 ` [PATCH v2 14/19] [media] uvcvideo: " Dan Williams
2018-08-06 21:40   ` Laurent Pinchart
2018-01-12  0:47 ` [PATCH v2 15/19] carl9170: " Dan Williams
2018-01-12 14:42   ` Christian Lamparter
2018-01-12 18:39     ` Dan Williams
2018-01-12 20:01       ` Christian Lamparter
2018-01-12 23:05         ` Dan Williams
2018-01-12  0:47 ` [PATCH v2 16/19] p54: " Dan Williams
2018-01-12  0:47 ` [PATCH v2 17/19] qla2xxx: " Dan Williams
2018-01-12  1:19   ` James Bottomley
2018-01-12  5:38     ` Dan Williams
2018-01-12  6:05       ` James Bottomley
2018-01-12  0:48 ` [PATCH v2 18/19] cw1200: " Dan Williams
2018-01-12  0:48 ` [PATCH v2 19/19] net: mpls: " Dan Williams
2018-01-12  1:19 ` [PATCH v2 00/19] " Linus Torvalds
2018-01-12  1:41   ` Dan Williams
2018-01-18 13:18     ` Will Deacon
2018-01-18 16:58       ` Dan Williams
2018-01-18 17:05         ` Will Deacon
2018-01-18 21:41           ` Laurent Pinchart
2018-01-13  0:15   ` Tony Luck
2018-01-13 18:51     ` Linus Torvalds
2018-01-16 19:21       ` Tony Luck
2018-01-12 10:02 ` Russell King - ARM Linux

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=151571802258.27429.932636277047687877.stgit@dwillia2-desk3.amr.corp.intel.com \
    --to=dan.j.williams@intel.com \
    --cc=ak@linux.intel.com \
    --cc=akpm@linux-foundation.org \
    --cc=alan@linux.intel.com \
    --cc=hpa@zytor.com \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-arch@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --cc=viro@zeniv.linux.org.uk \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).