linux-kernel - Re: [RFC] x86_64: A real proposal for iret-less return to kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 21 May 2014 15:39:11 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	"Luck, Tony" <tony.luck@...el.com>
Cc:	Borislav Petkov <bp@...en8.de>, Jiri Kosina <jkosina@...e.cz>,
	Thomas Gleixner <tglx@...utronix.de>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Andi Kleen <andi@...stfloor.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"H. Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...nel.org>
Subject: Re: [RFC] x86_64: A real proposal for iret-less return to kernel

On Wed, May 21, 2014 at 3:32 PM, Luck, Tony <tony.luck@...el.com> wrote:
>>> The recovery path has to do more than just send a signal - it needs to walk processes and
>>> "mm"s to see which have mapped the physical address that the h/w told us has gone bad.
>>
>> I still feel like I'm missing something.  If we interrupted user space
>> code, then the context we're in should be identical to the context
>> we'll get when we're about to return to userspace.
>
> True. And this far along in do_machine_check() we have set all the other cpus
> free, so the are heading back to whatever context we interrupted them in. So
> we might be able to do all that other stuff inline here ... we interrupted user
> mode, so we know we don't hold any locks. Other cpus are running, so they can
> complete what they are doing to release any locks we might need.
>
> But it will take a while (to scan all those processes). And we haven't yet
> cleared MCG_STATUS ... so another machine check before we do that
> would be fatal (x86 doesn't allow nesting).  Even if we moved the work
> after the clear of MCG_STATUS we'd still be vulnerable to a new machine
> check on x86_64 because we are sitting on the one & only machine check
> stack.

But if we get a new MCE in here, it will be an MCE from kernel context
and it's fatal.  So, yes, we'll clobber the stack, but we'll never
return (unless tolerant is set to something insane), so who cares?

Anyway, I care less about this now that I don't have to worry about it
re: IRET :)

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/