Received: by 10.223.185.116 with SMTP id b49csp3987748wrg; Tue, 6 Mar 2018 08:06:40 -0800 (PST) X-Google-Smtp-Source: AG47ELvGV4unfJHRVf+EGz/XQMgZpVTrGJ3f7uWYmvLr7JZahd/jUHhdQVOQ2arEiGD60iM26pch X-Received: by 10.101.101.78 with SMTP id a14mr15341346pgw.368.1520352399924; Tue, 06 Mar 2018 08:06:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1520352399; cv=none; d=google.com; s=arc-20160816; b=nWbBJfIwfrvtWobwggPveinctNjaqU7rOgA8wAjvjpEB+OgnlWdB+3kuxkF47gbLhI cWq5JLxodKRGbFqdMvBTGv6/AZfoxLPtdyPJ9NaJrwXRUs6PSMYLUJmL6xTA+m2VJbut ArE0BCT14jSY43GYLgKRXQ0JAqru72iD9hrg9cPt+mk4DwakO8TE1ndEUCQOvGIa2k9k jS1JFO5tCfqU6NZWKVhuE9m57nP9DdbEWgLLqjMb5YAZzNxFGa87PKZpqWlu4WDBbLgP jhu8L2nEN9fhMK6OVbm66NyGFw8aWjqA64mf5Fm5PXDpU4puvUet8y9ujceq5iCbcXfe lpFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:references:cc:to:from:subject:arc-authentication-results; bh=rMg+gzp5o/W/Dnf/es0As+0fP7dRHX2adm0bwx5BJS8=; b=d3NV+sM/TUH7BRM9nhsodpMjn4USijttTUynpIJATEQUHNHyvzkGvay3Sx317dBlOx oTshlSZu0KB175Ezrpqnty0mzM9OHCzf+X7NbekLYel3evz7lDla9I/BdXs9DITmTDgx Ueh8GTSOPnPyRi0YM31u26XUSclq3wV92En7mODKgVj9+qNxERAzDr7tY46DX/Hq7NdJ skOEtJQpQzaHWobzFzUpSMpeV93+rybr4BWWkREccfgIeq1uabqb/qZK2wqjobyNXPnU iya7jsMkSaf9vCWJIQfNSGg0ZfkY71CvnstZxGdcmUbTu4JjESiqeOprBNICVSC5L/XC QoGw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v3-v6si11360296plb.522.2018.03.06.08.06.25; Tue, 06 Mar 2018 08:06:39 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753864AbeCFQCq (ORCPT + 99 others); Tue, 6 Mar 2018 11:02:46 -0500 Received: from mail-wm0-f68.google.com ([74.125.82.68]:34469 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752055AbeCFQCn (ORCPT ); Tue, 6 Mar 2018 11:02:43 -0500 Received: by mail-wm0-f68.google.com with SMTP id a20so18672844wmd.1; Tue, 06 Mar 2018 08:02:43 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:cc:references:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=rMg+gzp5o/W/Dnf/es0As+0fP7dRHX2adm0bwx5BJS8=; b=slPqyku3THjc2zmDmv6snGGwoUA8l1r5rjKVUfDjF9NUUkY1xfZ6qgmOcvdMpbZ+8q oZs2k+24umSdzDwE8TFQAQgLTQzEoTCPCLko6N5Wjt30ubvPEVHV/yKXOsQx5LP6Lz/8 qLbEuGQNq1fxUVc93KpQtQaB0CNbEzPpBjU/Os29ovUaBMv2YxGus4VVCNidXSk0Da2k q5/bp4hXgUWVFeAsCBQJzMGNJGMpvSbZkt77I7fyUms5YbfYHNjTOggTxZm89OSE+Y11 Qn8iA716RUb+jNJdSAenZnbiJNZpTBGO5GxkOinXvEDYMviUX0aXg2eCiIvfQylOABL2 +xtA== X-Gm-Message-State: AElRT7EhKA9Ri6cKqR0NUdjt78L7rUEeLUR2/jN1teIW3s5Dj/4vS3F1 2uzcqZzROtKRgSiEappKwPU= X-Received: by 10.28.19.206 with SMTP id 197mr12687629wmt.89.1520352162428; Tue, 06 Mar 2018 08:02:42 -0800 (PST) Received: from ?IPv6:2a01:4240:2e27:ad85:aaaa::19f? (f.9.1.0.0.0.0.0.0.0.0.0.a.a.a.a.5.8.d.a.7.2.e.2.0.4.2.4.1.0.a.2.v6.cust.nbox.cz. [2a01:4240:2e27:ad85:aaaa::19f]) by smtp.gmail.com with ESMTPSA id 41sm13312099wrc.33.2018.03.06.08.02.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 06 Mar 2018 08:02:40 -0800 (PST) Subject: Re: [PATCH 4.4 178/193] x86/syscall: Sanitize syscall table de-references under speculation From: Jiri Slaby To: Greg Kroah-Hartman , linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org, Linus Torvalds , Dan Williams , Thomas Gleixner , linux-arch@vger.kernel.org, kernel-hardening@lists.openwall.com, Andy Lutomirski , alan@linux.intel.com, David Woodhouse , Jack Wang , Jan Beulich References: <20180223170325.997716448@linuxfoundation.org> <20180223170354.028619665@linuxfoundation.org> <0a95efad-1a3d-4aab-6d94-58dd583d275a@suse.cz> Message-ID: <10c08ff1-ba52-24a1-c915-42dd0eb175aa@suse.cz> Date: Tue, 6 Mar 2018 17:02:39 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <0a95efad-1a3d-4aab-6d94-58dd583d275a@suse.cz> Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/06/2018, 03:21 PM, Jiri Slaby wrote: > On 02/23/2018, 07:26 PM, Greg Kroah-Hartman wrote: >> 4.4-stable review patch. If anyone has any objections, please let me know. >> >> ------------------ >> >> From: Dan Williams >> >> (cherry picked from commit 2fbd7af5af8665d18bcefae3e9700be07e22b681) >> >> The syscall table base is a user controlled function pointer in kernel >> space. Use array_index_nospec() to prevent any out of bounds speculation. >> >> While retpoline prevents speculating into a userspace directed target it >> does not stop the pointer de-reference, the concern is leaking memory >> relative to the syscall table base, by observing instruction cache >> behavior. >> >> Reported-by: Linus Torvalds >> Signed-off-by: Dan Williams >> Signed-off-by: Thomas Gleixner >> Cc: linux-arch@vger.kernel.org >> Cc: kernel-hardening@lists.openwall.com >> Cc: gregkh@linuxfoundation.org >> Cc: Andy Lutomirski >> Cc: alan@linux.intel.com >> Link: https://lkml.kernel.org/r/151727417984.33451.1216731042505722161.stgit@dwillia2-desk3.amr.corp.intel.com >> Signed-off-by: David Woodhouse >> [jwang: port to 4.4, no syscall_64] > > This is not complete IMO, the syscall is indeed there, only written in > assembly in 4.4 yet. > > So this patch looks like it is missing these two hunks (from my > SLE12-SP2 backport): > >> --- a/arch/x86/entry/entry_64.S >> +++ b/arch/x86/entry/entry_64.S >> @@ -184,6 +184,8 @@ entry_SYSCALL_64_fastpath: >> cmpl $__NR_syscall_max, %eax >> #endif >> ja 1f /* return -ENOSYS (already in pt_regs->ax) */ >> + sbb %rcx, %rcx /* array_index_mask_nospec() */ >> + and %rcx, %rax Which is not completely correct either. The preceding comparison should write: cmpl $NR_syscalls, %eax jae 1f to have sbb correctly working even on the last syscall number. thanks, -- js suse labs