Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753061AbbDBRhN (ORCPT ); Thu, 2 Apr 2015 13:37:13 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34386 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751215AbbDBRhJ (ORCPT ); Thu, 2 Apr 2015 13:37:09 -0400 Message-ID: <551D7E43.7030904@redhat.com> Date: Thu, 02 Apr 2015 19:37:07 +0200 From: Denys Vlasenko User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Andy Lutomirski CC: Denys Vlasenko , Borislav Petkov , x86@kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] x86/asm/entry/64: better check for canonical address References: <1427373731-13056-1-git-send-email-dvlasenk@redhat.com> In-Reply-To: <1427373731-13056-1-git-send-email-dvlasenk@redhat.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1843 Lines: 48 On 03/26/2015 01:42 PM, Denys Vlasenko wrote: > This change makes the check exact (no more false positives > on kernel addresses). > > It isn't really important to be fully correct here - > almost all addresses we'll ever see will be userspace ones, > but OTOH it looks to be cheap enough: > the new code uses two more ALU ops but preserves %rcx, > allowing to not reload it from pt_regs->cx again. > On disassembly level, the changes are: > > cmp %rcx,0x80(%rsp) -> mov 0x80(%rsp),%r11; cmp %rcx,%r11 > shr $0x2f,%rcx -> shl $0x10,%rcx; sar $0x10,%rcx; cmp %rcx,%r11 > mov 0x58(%rsp),%rcx -> (eliminated) > .ifne __VIRTUAL_MASK_SHIFT - 47 > .error "virtual address width changed -- sysret checks need update" > .endif > - shr $__VIRTUAL_MASK_SHIFT, %rcx > - jnz opportunistic_sysret_failed > + /* Change top 16 bits to be a sign-extension of the rest */ > + shl $(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx > + sar $(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx > + /* If this changed %rcx, it was not canonical */ > + cmpq %rcx, %r11 > + jne opportunistic_sysret_failed Another thing we can do here is to just canonicalize the address. IOW: same code as above but without last two insns. The difference would be that if userspace gives us bogus, noncanonical return address, we would return to a different address instead of SIGSEGV. There is no security implications in doing this as far as I can see, and no sane program uses noncanonical addresses. Apart from not having any legitimate need to do so, it's also quite complicated to achieve. So it should not break any real-world cases. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/