From: Ard Biesheuvel <ardb@kernel.org>
To: stable@vger.kernel.org
Cc: linus.walleij@linaro.org, rmk+kernel@armlinux.org.uk,
Julien Thierry <julien.thierry@arm.com>,
Ard Biesheuvel <ardb@kernel.org>
Subject: [PATCH for-stable-4.4 42/50] ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
Date: Fri, 8 Nov 2019 13:35:46 +0100 [thread overview]
Message-ID: <20191108123554.29004-43-ardb@kernel.org> (raw)
In-Reply-To: <20191108123554.29004-1-ardb@kernel.org>
From: Julien Thierry <julien.thierry@arm.com>
Commit afaf6838f4bc896a711180b702b388b8cfa638fc upstream.
Introduce C and asm helpers to sanitize user address, taking the
address range they target into account.
Use asm helper for existing sanitization in __copy_from_user().
Signed-off-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David A. Long <dave.long@linaro.org>
Reviewed-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm/include/asm/assembler.h | 11 +++++++++
arch/arm/include/asm/uaccess.h | 26 ++++++++++++++++++++
arch/arm/lib/copy_from_user.S | 6 +----
3 files changed, 38 insertions(+), 5 deletions(-)
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 483481c6937e..f2624fbd0336 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -461,6 +461,17 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
#endif
.endm
+ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
+#ifdef CONFIG_CPU_SPECTRE
+ sub \tmp, \limit, #1
+ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
+ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
+ subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) }
+ movlo \addr, #0 @ if (tmp < 0) addr = NULL
+ csdb
+#endif
+ .endm
+
.macro uaccess_disable, tmp, isb=1
#ifdef CONFIG_CPU_SW_DOMAIN_PAN
/*
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 98bbf89763a6..9ae610bf5234 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -137,6 +137,32 @@ static inline void set_fs(mm_segment_t fs)
#define __inttype(x) \
__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+/*
+ * Sanitise a uaccess pointer such that it becomes NULL if addr+size
+ * is above the current addr_limit.
+ */
+#define uaccess_mask_range_ptr(ptr, size) \
+ ((__typeof__(ptr))__uaccess_mask_range_ptr(ptr, size))
+static inline void __user *__uaccess_mask_range_ptr(const void __user *ptr,
+ size_t size)
+{
+ void __user *safe_ptr = (void __user *)ptr;
+ unsigned long tmp;
+
+ asm volatile(
+ " sub %1, %3, #1\n"
+ " subs %1, %1, %0\n"
+ " addhs %1, %1, #1\n"
+ " subhss %1, %1, %2\n"
+ " movlo %0, #0\n"
+ : "+r" (safe_ptr), "=&r" (tmp)
+ : "r" (size), "r" (current_thread_info()->addr_limit)
+ : "cc");
+
+ csdb();
+ return safe_ptr;
+}
+
/*
* Single-value transfer routines. They automatically use the right
* size if we just have the right pointer type. Note that the functions
diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
index d36329cefedc..e32b51838439 100644
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -93,11 +93,7 @@ ENTRY(arm_copy_from_user)
#ifdef CONFIG_CPU_SPECTRE
get_thread_info r3
ldr r3, [r3, #TI_ADDR_LIMIT]
- adds ip, r1, r2 @ ip=addr+size
- sub r3, r3, #1 @ addr_limit - 1
- cmpcc ip, r3 @ if (addr+size > addr_limit - 1)
- movcs r1, #0 @ addr = NULL
- csdb
+ uaccess_mask_range_ptr r1, r2, r3, ip
#endif
#include "copy_template.S"
--
2.20.1
next prev parent reply other threads:[~2019-11-08 12:37 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-08 12:35 [PATCH for-stable-4.4 00/50] ARM: spectre v1/v2 mitigations Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 01/50] ARM: 8051/1: put_user: fix possible data corruption in put_user Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 02/50] ARM: 8478/2: arm/arm64: add arm-smccc Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 03/50] ARM: 8479/2: add implementation for arm-smccc Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 04/50] ARM: 8480/2: arm64: " Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 05/50] ARM: 8481/2: drivers: psci: replace psci firmware calls Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 06/50] ARM: uaccess: remove put_user() code duplication Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 07/50] ARM: Move system register accessors to asm/cp15.h Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 08/50] arm/arm64: KVM: Advertise SMCCC v1.1 Ard Biesheuvel
2019-11-08 13:11 ` Greg KH
2019-11-08 13:29 ` Ard Biesheuvel
2019-11-08 13:39 ` Greg KH
2019-11-08 13:39 ` Russell King - ARM Linux admin
2019-11-08 13:48 ` Mark Rutland
2019-11-08 12:35 ` [PATCH for-stable-4.4 09/50] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 10/50] firmware/psci: Expose PSCI conduit Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 11/50] firmware/psci: Expose SMCCC version through psci_ops Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 12/50] arm/arm64: smccc: Make function identifiers an unsigned quantity Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 13/50] arm/arm64: smccc: Implement SMCCC v1.1 inline primitive Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 14/50] arm/arm64: smccc: Add SMCCC-specific return codes Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 15/50] arm/arm64: smccc-1.1: Make return values unsigned long Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 16/50] arm/arm64: smccc-1.1: Handle function result as parameters Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 17/50] ARM: add more CPU part numbers for Cortex and Brahma B15 CPUs Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 18/50] ARM: bugs: prepare processor bug infrastructure Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 19/50] ARM: bugs: hook processor bug checking into SMP and suspend paths Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 20/50] ARM: bugs: add support for per-processor bug checking Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 21/50] ARM: spectre: add Kconfig symbol for CPUs vulnerable to Spectre Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 22/50] ARM: spectre-v2: harden branch predictor on context switches Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 23/50] ARM: spectre-v2: add Cortex A8 and A15 validation of the IBE bit Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 24/50] ARM: spectre-v2: harden user aborts in kernel space Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 25/50] ARM: spectre-v2: add firmware based hardening Ard Biesheuvel
2019-11-08 13:13 ` Greg KH
2019-11-08 12:35 ` [PATCH for-stable-4.4 26/50] ARM: spectre-v2: warn about incorrect context switching functions Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 27/50] ARM: spectre-v1: add speculation barrier (csdb) macros Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 28/50] ARM: spectre-v1: add array_index_mask_nospec() implementation Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 29/50] ARM: spectre-v1: fix syscall entry Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 30/50] ARM: signal: copy registers using __copy_from_user() Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 31/50] ARM: vfp: use __copy_from_user() when restoring VFP state Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 32/50] ARM: oabi-compat: copy semops using __copy_from_user() Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 33/50] ARM: use __inttype() in get_user() Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 34/50] ARM: spectre-v1: use get_user() for __get_user() Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 35/50] ARM: spectre-v1: mitigate user accesses Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 36/50] ARM: 8789/1: signal: copy registers using __copy_to_user() Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 37/50] ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 38/50] ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user() Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 39/50] ARM: 8793/1: signal: replace __put_user_error with __put_user Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 40/50] ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 41/50] ARM: 8795/1: spectre-v1.1: use put_user() for __put_user() Ard Biesheuvel
2019-11-08 12:35 ` Ard Biesheuvel [this message]
2019-11-08 12:35 ` [PATCH for-stable-4.4 43/50] ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 44/50] ARM: make lookup_processor_type() non-__init Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 45/50] ARM: split out processor lookup Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 46/50] ARM: clean up per-processor check_bugs method call Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 47/50] ARM: add PROC_VTABLE and PROC_TABLE macros Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 48/50] ARM: spectre-v2: per-CPU vtables to work around big.Little systems Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 49/50] ARM: ensure that processor vtables is not lost after boot Ard Biesheuvel
2019-11-08 12:35 ` [PATCH for-stable-4.4 50/50] ARM: fix the cockup in the previous patch Ard Biesheuvel
2019-11-08 13:15 ` [PATCH for-stable-4.4 00/50] ARM: spectre v1/v2 mitigations Greg KH
2019-11-08 15:43 ` Linus Walleij
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191108123554.29004-43-ardb@kernel.org \
--to=ardb@kernel.org \
--cc=julien.thierry@arm.com \
--cc=linus.walleij@linaro.org \
--cc=rmk+kernel@armlinux.org.uk \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).