linux-kernel - Re: Linux 4.9.93

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 9 Apr 2018 11:07:41 +0100
From:   Mark Rutland <mark.rutland@....com>
To:     Jean-Baptiste Theou <jb@...ential.com>
Cc:     Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        Greg KH <gregkh@...uxfoundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Will Deacon <will.deacon@....com>,
        Dan Rue <dan.rue@...aro.org>,
        Mark Brown <mark.brown@...aro.org>,
        Marc Zyngier <marc.zyngier@....com>,
        Greg Hackmann <ghackmann@...gle.com>
Subject: Re: Linux 4.9.93

On Mon, Apr 09, 2018 at 06:57:51PM +0900, Jean-Baptiste Theou wrote:
> On Mon, 9 Apr 2018 11:49:37 +0200
> Ard Biesheuvel <ard.biesheuvel@...aro.org> wrote:
> 
> > On 9 April 2018 at 11:30, Greg KH <gregkh@...uxfoundation.org> wrote:
> > > On Mon, Apr 09, 2018 at 06:05:34PM +0900, Jean-Baptiste Theou wrote:  
> > >> Hi,
> > >>
> > >> After this patchset, a kernel built with CFI fails. Disabling
> > >> UNMAP_KERNEL_AT_EL0 fix the issue obviously.  
> > 
> > How does one 'build a kernel with CFI' for arm64?
> 
> From Google work on Android-4.9
> 
> https://android.googlesource.com/kernel/common/+/00a195e7c0752ff5d65c9caadfbcc226270ca232
> 
> I am not sure what is the plan on their side to upstream (Greg?), but definitely
> useful to isolate actual issues.
> 
> > > Is this a "clean" 4.9.93 tree or a "4.9.93 merged into
> > > android-common-4.9?
> 
> It's a "clean 4.9.93" + whatever is needed for Clang/CFI support
> 
> My take is that CFI doesn't like 
> 
>  * void __kpti_install_ng_mappings(int cpu, int num_cpus, phys_addr_t swapper)
> 
> and 
> 
> remap_fn = (void *)__pa_symbol(idmap_kpti_install_ng_mappings);
> 
> Maybe just flag this function to not use CFI? I remember that Sami Tolvanen did
> similar changes.

>From a quick scan, it looks like CFI uses shadow memory for function
prologues. Since we're taking the PA of a function pointer, presumably
this no longer maps to valid shadow.

I'd expect the same to apply to uses of cpu_replace_ttbr1(), but it
looks like the only user of that is marked as __init, and that patch
adds __nocfi to __init functions.

So you probably need to mark kpti_install_ng_mappings() as __nocfi.
 
> I know it's a bit out of context since CFI support for ARM64 is not upstream yet,
> but unfortunate that an stable patchset trigger such failures.

This is simply the nature of out-of-tree code.

In future, it would be very helpful if you could provide context for
out-of-tree patches in the initial report.

Thanks,
Mark.