linux-kernel - Re: [PATCH] x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150427124854.GH6774@pd.tnic>
Date:	Mon, 27 Apr 2015 14:48:54 +0200
From:	Borislav Petkov <bp@...en8.de>
To:	Denys Vlasenko <dvlasenk@...hat.com>
Cc:	Andy Lutomirski <luto@...capital.net>,
	Andy Lutomirski <luto@...nel.org>, X86 ML <x86@...nel.org>,
	"H. Peter Anvin" <hpa@...or.com>,
	Denys Vlasenko <vda.linux@...glemail.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Brian Gerst <brgerst@...il.com>,
	Ingo Molnar <mingo@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Oleg Nesterov <oleg@...hat.com>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Alexei Starovoitov <ast@...mgrid.com>,
	Will Drewry <wad@...omium.org>,
	Kees Cook <keescook@...omium.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] x86_64, asm: Work around AMD SYSRET SS descriptor
 attribute issue

On Mon, Apr 27, 2015 at 02:08:40PM +0200, Denys Vlasenko wrote:
> > ffffffff819ef40c:       48 c1 e1 10             shl    $0x10,%rcx
> > ffffffff819ef410:       48 c1 f9 10             sar    $0x10,%rcx
> > ffffffff819ef414:       49 39 cb                cmp    %rcx,%r11
> > ffffffff819ef417:       0f 85 ff 9c bc ff       jne    ffffffff815b911c <opportunistic_sysret_failed>
> 
> This looks strange. opportunistic_sysret_failed label is just a few
> instructions below. Why are you getting "ff 9c bc ff" offset in JNE
> instead of short jump of 0x5f bytes I see without ALTERNATIVE?

Because the replacement instructions are placed far away in the section
.altinstr_replacement and since we have relative JMPs, gas generates
JMP from that section to opportunistic_sysret_failed. That's why it is
negative too.

And by looking at this more, I'm afraid even this current version won't
work because even after I added recompute_jump() recently which is
supposed to fixup the JMPs and even make them smaller, it won't work in
this case because it won't detect the JMP as it is the 4th instruction
and not the first byte. (And even if, it won't detect it still because
we're not looking at conditional JMPs yet, i.e. Jcc).

What we could do is something like this instead:

	jne opportunistic_sysret_failed - 1f
	1:

so that the offset is correct. Need to experiment with this a bit first
though, for the exact placement of the label but it should show the
idea.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/