Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42177C64EC4 for ; Mon, 6 Mar 2023 18:58:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230304AbjCFS6a (ORCPT ); Mon, 6 Mar 2023 13:58:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40682 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229758AbjCFS6E (ORCPT ); Mon, 6 Mar 2023 13:58:04 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DC737D8E for ; Mon, 6 Mar 2023 10:57:32 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 43E1F61058 for ; Mon, 6 Mar 2023 18:57:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 93735C4339E; Mon, 6 Mar 2023 18:57:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1678129050; bh=6vXrvt7y3pSV5UzVc45cU2dXI063yro0+EDdwbCQfnU=; h=In-Reply-To:References:Date:From:To:Cc:Subject:From; b=oTQSZEZgHcfYMEKuFyrO+0WbZv9W+W+iIfSFWSVUsjZRI1P86YeZim1S3X6MRab5s 8WMGKLgSS2Jf7xVMkKCMcYYWq0BMvdT+LvXeDKxwENDftxflzdjx55Ebwh6Thqr5Mk vqA1twovNE7Khq55t/YdVKVGl1PiCEjLiaufAVGp8FSdXulPlnV4Hh/ic9KfLtW8C2 TUHB0U7rb/UH0AMb2QdnQuZgd9Lf0uAlyvMNbFsgAkMzXFS97lURf0X4wZ1lHWjdtQ qFmfHv8UaF5rZXrLqgcsxCdZ+VCRxvY8SSUqBrWGUoz16tXpgW7pZLVBqeZIqRXXjJ 9ZXbyKKGvRg0Q== Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailauth.nyi.internal (Postfix) with ESMTP id 7654827C0054; Mon, 6 Mar 2023 13:57:28 -0500 (EST) Received: from imap48 ([10.202.2.98]) by compute3.internal (MEProxy); Mon, 06 Mar 2023 13:57:28 -0500 X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrvddtkedgleduucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepofgfggfkjghffffhvfevufgtgfesthhqredtreerjeenucfhrhhomhepfdet nhguhicunfhuthhomhhirhhskhhifdcuoehluhhtoheskhgvrhhnvghlrdhorhhgqeenuc ggtffrrghtthgvrhhnpeeiteejleegjeekleegveeujeejvdehjeekveegudduudffueek jefffeeujeekhfenucffohhmrghinhepkhgvrhhnvghlrdhorhhgnecuvehluhhsthgvrh fuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheprghnugihodhmvghsmhhtphgr uhhthhhpvghrshhonhgrlhhithihqdduudeiudekheeifedvqddvieefudeiiedtkedqlh huthhopeepkhgvrhhnvghlrdhorhhgsehlihhnuhigrdhluhhtohdruhhs X-ME-Proxy: Feedback-ID: ieff94742:Fastmail Received: by mailuser.nyi.internal (Postfix, from userid 501) id B80BE31A0063; Mon, 6 Mar 2023 13:57:26 -0500 (EST) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.9.0-alpha0-206-g57c8fdedf8-fm-20230227.001-g57c8fded Mime-Version: 1.0 Message-Id: <2361d4e2-c8c9-4dc4-b925-ab6543ba3404@app.fastmail.com> In-Reply-To: References: <20230227222957.24501-1-rick.p.edgecombe@intel.com> <20230227222957.24501-25-rick.p.edgecombe@intel.com> Date: Mon, 06 Mar 2023 10:57:06 -0800 From: "Andy Lutomirski" To: "Rick P Edgecombe" , "Borislav Petkov" Cc: "David Hildenbrand" , "Balbir Singh" , "H. Peter Anvin" , "Eugene Syromiatnikov" , "Peter Zijlstra (Intel)" , "Randy Dunlap" , "Kees Cook" , "Dave Hansen" , "Kirill A. Shutemov" , "Eranian, Stephane" , "linux-mm@kvack.org" , "Florian Weimer" , "Nadav Amit" , "Jann Horn" , "dethoma@microsoft.com" , "kcc@google.com" , "linux-arch@vger.kernel.org" , "Pavel Machek" , "Oleg Nesterov" , "H.J. Lu" , "Weijiang Yang" , "linux-doc@vger.kernel.org" , "Arnd Bergmann" , "jamorris@linux.microsoft.com" , "Thomas Gleixner" , "Schimpe, Christina" , "Mike Kravetz" , "the arch/x86 maintainers" , "Andrew Morton" , "debug@rivosinc.com" , "Andrew Cooper" , "Mike Rapoport" , "john.allen@amd.com" , "Ingo Molnar" , "Jonathan Corbet" , "Linux Kernel Mailing List" , "Linux API" , "Cyrill Gorcunov" Subject: Re: [PATCH v7 24/41] mm: Don't allow write GUPs to shadow stack memory Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Mar 6, 2023, at 10:33 AM, Edgecombe, Rick P wrote: > On Mon, 2023-03-06 at 10:15 -0800, Andy Lutomirski wrote: >> On Mon, Mar 6, 2023 at 5:10=E2=80=AFAM Borislav Petkov = wrote: >> >=20 >> > On Mon, Feb 27, 2023 at 02:29:40PM -0800, Rick Edgecombe wrote: >> > > The x86 Control-flow Enforcement Technology (CET) feature >> > > includes a new >> > > type of memory called shadow stack. This shadow stack memory has >> > > some >> > > unusual properties, which requires some core mm changes to >> > > function >> > > properly. >> > >=20 >> > > Shadow stack memory is writable only in very specific, controlled >> > > ways. >> > > However, since it is writable, the kernel treats it as such. As a >> > > result >> >=20 >> > =20 >> > ^ >> > =20 >> > , >> >=20 >> > > there remain many ways for userspace to trigger the kernel to >> > > write to >> > > shadow stack's via get_user_pages(, FOLL_WRITE) operations. To >> > > make this a >>=20 >> Is there an alternate mechanism, or do we still want to allow >> FOLL_FORCE so that debuggers can write it? > > Yes, GDB shadow stack support uses it via both ptrace poke and > /proc/pid/mem apparently. So some ability to write through is needed > for debuggers. But not CRIU actually. It uses WRSS. > > There was also some discussion[0] previously about how apps might > prefer to block /proc/self/mem for general security reasons. Blocking > shadow stack writes while you allow text writes is probably not that > impactful security-wise. So I thought it would be better to leave the > logic simpler. Then when /proc/self/mem could be locked down per the > discussion, shadow stack can be locked down the same way. Ah, I am guilty of reading your changelog but not the code. You said: Shadow stack memory is writable only in very specific, controlled ways. However, since it is writable, the kernel treats it as such. As a result there remain many ways for userspace to trigger the kernel to write to shadow stack's via get_user_pages(, FOLL_WRITE) operations. To make this= a little less exposed, block writable GUPs for shadow stack VMAs. I read that as *denying* FOLL_FORCE. Maybe clarify the changelog? > > [0]=20 > https://lore.kernel.org/lkml/E857CF98-EEB2-4F83-8305-0A52B463A661@kern= el.org/