Received: by 10.223.185.116 with SMTP id b49csp1118706wrg; Fri, 23 Feb 2018 12:14:55 -0800 (PST) X-Google-Smtp-Source: AH8x226D/WLxTKvD7cVwnuD13beF1oWSDUxUUKXhk8yJ6e8nYd0HXQX8ST/3NqXVNMX4b3z0aC+L X-Received: by 2002:a17:902:10d:: with SMTP id 13-v6mr2737581plb.266.1519416895282; Fri, 23 Feb 2018 12:14:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519416895; cv=none; d=google.com; s=arc-20160816; b=NHjraO85yDt+3zR6W4xm9oSlj4vZShZ0amN/ODTjpiWRLaePWD0k8fiHbTsvm+77bE qjjwFMzo23Gr8ylLyRM0jizywOEnA9oNLjgo3rkR7li1dSs4TQ91uvQoYowvFZwy4kBM DRApxXYNGR6/9jTgWBxG7gvVeci+63I7XqoV+cmbp1Zom9Ndi6nywUDYCg9sP5RVZGHW RachVZjiaTb1BUy7dcZvNPA1J1Hefzw09Gecoi8lf57PxrOu2ZeJRHga0fD3z/0wmISn MFvvj5vf7dJD+WtQWTeLP3gQPXaikLVxJkCwTneGjxbKomVjrE08Kbp8S3KHAC2rRG0w Wl1w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=XevXD2OpLRdodDGnh0BWFnTtkioFhLyimr6BwFAdzX4=; b=W4Dymuug75SyCU1c7dPGBMl/PuZlGUxuVX2P59WeYthDzOf9B402nN61lVMKm+BsHk ozY2ferPoJ+HsNbe+tNBX5tneDlvdbVVhfTDuq+r5pVtkykvIcf6xJUa0m4uvpe2TD0Z UlYMAXsVv3dKXIOv5vd2lWC2bIeDgVE4QeTzSEBuVnPBxM6IzMb1HEeHWgzIokK+ON6k 8YDltmYOEJCW+u4kMFk1+Nk9x0W/nrxCqauWnHaKn/yNJX8lh25/EtWxfN0k8OQUqYq4 /Y/oCa4u3++ItGBwODf+MkW11nzb5NK5qweuF6wCMWGlOUTzXJk7PGPzuz0fVH5vdo24 q5ZA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l8-v6si2284128plt.146.2018.02.23.12.14.41; Fri, 23 Feb 2018 12:14:55 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932752AbeBWSlI (ORCPT + 99 others); Fri, 23 Feb 2018 13:41:08 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:40394 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753710AbeBWSlE (ORCPT ); Fri, 23 Feb 2018 13:41:04 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 0DDF8128B; Fri, 23 Feb 2018 18:41:03 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Williams , Thomas Gleixner , linux-arch@vger.kernel.org, Kees Cook , kernel-hardening@lists.openwall.com, Al Viro , Andy Lutomirski , torvalds@linux-foundation.org, alan@linux.intel.com, David Woodhouse , Jack Wang Subject: [PATCH 4.4 177/193] x86/get_user: Use pointer masking to limit speculation Date: Fri, 23 Feb 2018 19:26:50 +0100 Message-Id: <20180223170353.836877903@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170325.997716448@linuxfoundation.org> References: <20180223170325.997716448@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams (cherry picked from commit c7f631cb07e7da06ac1d231ca178452339e32a94) Quoting Linus: I do think that it would be a good idea to very expressly document the fact that it's not that the user access itself is unsafe. I do agree that things like "get_user()" want to be protected, but not because of any direct bugs or problems with get_user() and friends, but simply because get_user() is an excellent source of a pointer that is obviously controlled from a potentially attacking user space. So it's a prime candidate for then finding _subsequent_ accesses that can then be used to perturb the cache. Unlike the __get_user() case get_user() includes the address limit check near the pointer de-reference. With that locality the speculation can be mitigated with pointer narrowing rather than a barrier, i.e. array_index_nospec(). Where the narrowing is performed by: cmp %limit, %ptr sbb %mask, %mask and %mask, %ptr With respect to speculation the value of %ptr is either less than %limit or NULL. Co-developed-by: Linus Torvalds Signed-off-by: Dan Williams Signed-off-by: Thomas Gleixner Cc: linux-arch@vger.kernel.org Cc: Kees Cook Cc: kernel-hardening@lists.openwall.com Cc: gregkh@linuxfoundation.org Cc: Al Viro Cc: Andy Lutomirski Cc: torvalds@linux-foundation.org Cc: alan@linux.intel.com Link: https://lkml.kernel.org/r/151727417469.33451.11804043010080838495.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: David Woodhouse [jwang: port to 4.4] Signed-off-by: Jack Wang Signed-off-by: Greg Kroah-Hartman --- arch/x86/lib/getuser.S | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/arch/x86/lib/getuser.S +++ b/arch/x86/lib/getuser.S @@ -38,6 +38,8 @@ ENTRY(__get_user_1) GET_THREAD_INFO(%_ASM_DX) cmp TI_addr_limit(%_ASM_DX),%_ASM_AX jae bad_get_user + sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ + and %_ASM_DX, %_ASM_AX ASM_STAC 1: movzbl (%_ASM_AX),%edx xor %eax,%eax @@ -51,6 +53,8 @@ ENTRY(__get_user_2) GET_THREAD_INFO(%_ASM_DX) cmp TI_addr_limit(%_ASM_DX),%_ASM_AX jae bad_get_user + sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ + and %_ASM_DX, %_ASM_AX ASM_STAC 2: movzwl -1(%_ASM_AX),%edx xor %eax,%eax @@ -64,6 +68,8 @@ ENTRY(__get_user_4) GET_THREAD_INFO(%_ASM_DX) cmp TI_addr_limit(%_ASM_DX),%_ASM_AX jae bad_get_user + sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ + and %_ASM_DX, %_ASM_AX ASM_STAC 3: movl -3(%_ASM_AX),%edx xor %eax,%eax @@ -78,6 +84,8 @@ ENTRY(__get_user_8) GET_THREAD_INFO(%_ASM_DX) cmp TI_addr_limit(%_ASM_DX),%_ASM_AX jae bad_get_user + sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ + and %_ASM_DX, %_ASM_AX ASM_STAC 4: movq -7(%_ASM_AX),%rdx xor %eax,%eax @@ -89,6 +97,8 @@ ENTRY(__get_user_8) GET_THREAD_INFO(%_ASM_DX) cmp TI_addr_limit(%_ASM_DX),%_ASM_AX jae bad_get_user_8 + sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ + and %_ASM_DX, %_ASM_AX ASM_STAC 4: movl -7(%_ASM_AX),%edx 5: movl -3(%_ASM_AX),%ecx