linux-kernel - Re: [PATCH v3 3/3] x86/entry: Clear registers for compat syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 6 Feb 2018 08:26:08 +0100
From:   Ingo Molnar <mingo@...nel.org>
To:     Dan Williams <dan.j.williams@...el.com>
Cc:     tglx@...utronix.de, Andi Kleen <ak@...ux.intel.com>,
        x86@...nel.org, linux-kernel@...r.kernel.org,
        Ingo Molnar <mingo@...hat.com>, luto@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>, torvalds@...ux-foundation.org
Subject: Re: [PATCH v3 3/3] x86/entry: Clear registers for compat syscalls


* Dan Williams <dan.j.williams@...el.com> wrote:

> From: Andi Kleen <ak@...ux.intel.com>
> 
> At entry userspace may have populated registers with values that could
> be useful in a speculative execution attack. Clear them to minimize the
> kernel's attack surface.
> 
> [djbw: interleave the clearing with setting up the stack ]
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Ingo Molnar <mingo@...hat.com>
> Cc: "H. Peter Anvin" <hpa@...or.com>
> Cc: x86@...nel.org
> Cc: Andy Lutomirski <luto@...nel.org>
> Signed-off-by: Andi Kleen <ak@...ux.intel.com>
> Signed-off-by: Dan Williams <dan.j.williams@...el.com>
> ---
>  arch/x86/entry/entry_64_compat.S |   30 ++++++++++++++++++++++++++++++
>  1 file changed, 30 insertions(+)
> 
> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
> index 98d5358e4041..fd65e016e413 100644
> --- a/arch/x86/entry/entry_64_compat.S
> +++ b/arch/x86/entry/entry_64_compat.S
> @@ -85,15 +85,25 @@ ENTRY(entry_SYSENTER_compat)
>  	pushq	%rcx			/* pt_regs->cx */
>  	pushq	$-ENOSYS		/* pt_regs->ax */
>  	pushq   $0			/* pt_regs->r8  = 0 */
> +	xorq	%r8, %r8		/* nospec   r8 */
>  	pushq   $0			/* pt_regs->r9  = 0 */
> +	xorq	%r9, %r9		/* nospec   r9 */
>  	pushq   $0			/* pt_regs->r10 = 0 */
> +	xorq	%r10, %r10		/* nospec   r10 */
>  	pushq   $0			/* pt_regs->r11 = 0 */
> +	xorq	%r11, %r11		/* nospec   r11 */
>  	pushq   %rbx                    /* pt_regs->rbx */
> +	xorl	%ebx, %ebx		/* nospec   rbx */
>  	pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
> +	xorl	%ebp, %ebp		/* nospec   rbp */
>  	pushq   $0			/* pt_regs->r12 = 0 */
> +	xorq	%r12, %r12		/* nospec   r12 */
>  	pushq   $0			/* pt_regs->r13 = 0 */
> +	xorq	%r13, %r13		/* nospec   r13 */
>  	pushq   $0			/* pt_regs->r14 = 0 */
> +	xorq	%r14, %r14		/* nospec   r14 */
>  	pushq   $0			/* pt_regs->r15 = 0 */
> +	xorq	%r15, %r15		/* nospec   r15 */
>  	cld
>  
>  	/*
> @@ -214,15 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
>  	pushq	%rbp			/* pt_regs->cx (stashed in bp) */
>  	pushq	$-ENOSYS		/* pt_regs->ax */
>  	pushq   $0			/* pt_regs->r8  = 0 */
> +	xorq	%r8, %r8		/* nospec   r8 */
>  	pushq   $0			/* pt_regs->r9  = 0 */
> +	xorq	%r9, %r9		/* nospec   r9 */
>  	pushq   $0			/* pt_regs->r10 = 0 */
> +	xorq	%r10, %r10		/* nospec   r10 */
>  	pushq   $0			/* pt_regs->r11 = 0 */
> +	xorq	%r11, %r11		/* nospec   r11 */
>  	pushq   %rbx                    /* pt_regs->rbx */
> +	xorl	%ebx, %ebx		/* nospec   rbx */
>  	pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
> +	xorl	%ebp, %ebp		/* nospec   rbp */
>  	pushq   $0			/* pt_regs->r12 = 0 */
> +	xorq	%r12, %r12		/* nospec   r12 */
>  	pushq   $0			/* pt_regs->r13 = 0 */
> +	xorq	%r13, %r13		/* nospec   r13 */
>  	pushq   $0			/* pt_regs->r14 = 0 */
> +	xorq	%r14, %r14		/* nospec   r14 */
>  	pushq   $0			/* pt_regs->r15 = 0 */
> +	xorq	%r15, %r15		/* nospec   r15 */

I really love it how you've aligned the comment fields vertically - nice!

>  	/*
>  	 * User mode is traced as though IRQs are on, and SYSENTER
> @@ -338,15 +358,25 @@ ENTRY(entry_INT80_compat)
>  	pushq	%rcx			/* pt_regs->cx */
>  	pushq	$-ENOSYS		/* pt_regs->ax */
>  	pushq   $0			/* pt_regs->r8  = 0 */
> +	xorq	%r8, %r8		/* nospec   r8 */
>  	pushq   $0			/* pt_regs->r9  = 0 */
> +	xorq	%r9, %r9		/* nospec   r9 */
>  	pushq   $0			/* pt_regs->r10 = 0 */
> +	xorq	%r10, %r10		/* nospec   r10 */
>  	pushq   $0			/* pt_regs->r11 = 0 */
> +	xorq	%r11, %r11		/* nospec   r11 */
>  	pushq   %rbx                    /* pt_regs->rbx */
> +	xorl	%ebx, %ebx		/* nospec   rbx */
>  	pushq   %rbp                    /* pt_regs->rbp */
> +	xorl	%ebp, %ebp		/* nospec   rbp */
>  	pushq   %r12                    /* pt_regs->r12 */
> +	xorq	%r12, %r12		/* nospec   r12 */
>  	pushq   %r13                    /* pt_regs->r13 */
> +	xorq	%r13, %r13		/* nospec   r13 */
>  	pushq   %r14                    /* pt_regs->r14 */
> +	xorq	%r14, %r14		/* nospec   r14 */
>  	pushq   %r15                    /* pt_regs->r15 */
> +	xorq	%r15, %r15		/* nospec   r15 */
>  	cld

BTW., these last two patches have changed *significantly* from Andi's original 
patches that were submitted originally, so I changed them over to:

  From: Dan Williams <dan.j.williams@...el.com>
  ...
  Originally-From: Andi Kleen <ak@...ux.intel.com>
  Signed-off-by: Dan Williams <dan.j.williams@...el.com>

... to better show authorship history.

Please let me know if that's not OK.

Thanks,

	Ingo