linux-kernel - Re: [PATCH v2] selftests/x86: Add a selftest for SYSRET to noncanonical addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170103151155.GA17319@node.shutemov.name>
Date:   Tue, 3 Jan 2017 18:11:55 +0300
From:   "Kirill A. Shutemov" <kirill@...temov.name>
To:     Andy Lutomirski <luto@...nel.org>
Cc:     x86@...nel.org, Borislav Petkov <bp@...en8.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
Subject: Re: [PATCH v2] selftests/x86: Add a selftest for SYSRET to
 noncanonical addresses

On Mon, Dec 26, 2016 at 07:20:50PM -0800, Andy Lutomirski wrote:
> SYSRET to a noncanonical address will blow up on Intel CPUs.  Linux
> needs to prevent this from happening in two major cases, and the
> criteria will become more complicated when support for larger virtual
> address spaces is added.
> 
> A fast-path SYSCALL will fallthrough to the following instruction
> using SYSRET without any particular checking.  To prevent fallthrough
> to a noncanonical address, Linux prevents the highest canonical page
> from being mapped.  This test case checks a variety of possible maximum
> addresses to make sure that either we can't map code there or that
> SYSCALL fallthrough works.
> 
> A slow-path system call can return anywhere.  Linux needs to make sure
> that, if the return address is non-canonical, it won't use SYSRET.
> This test cases causes sigreturn() to return to a variety of addresses
> (with RCX == RIP) and makes sure that nothing explodes.
> 
> Some of this code comes from Kirill Shutemov.
> 
> Changes from v1:
>  - Get rid of some extra parentheses.
>  - Test more corner cases.
>  - Get rid of some duplicate '0x' printout.
> 
> Cc: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
> Signed-off-by: Andy Lutomirski <luto@...nel.org>

Acked-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>

Output with 5-level paging enabled:

[RUN]   sigreturn to 0x800000000000
[OK]    Got SIGSEGV at RIP=0x800000000000
[RUN]   sigreturn to 0x1000000000000
[OK]    Got SIGSEGV at RIP=0x1000000000000
[RUN]   sigreturn to 0x2000000000000
[OK]    Got SIGSEGV at RIP=0x2000000000000
[RUN]   sigreturn to 0x4000000000000
[OK]    Got SIGSEGV at RIP=0x4000000000000
[RUN]   sigreturn to 0x8000000000000
[OK]    Got SIGSEGV at RIP=0x8000000000000
[RUN]   sigreturn to 0x10000000000000
[OK]    Got SIGSEGV at RIP=0x10000000000000
[RUN]   sigreturn to 0x20000000000000
[OK]    Got SIGSEGV at RIP=0x20000000000000
[RUN]   sigreturn to 0x40000000000000
[OK]    Got SIGSEGV at RIP=0x40000000000000
[RUN]   sigreturn to 0x80000000000000
[OK]    Got SIGSEGV at RIP=0x80000000000000
[RUN]   sigreturn to 0x100000000000000
[OK]    Got SIGSEGV at RIP=0x100000000000000
[RUN]   sigreturn to 0x200000000000000
[OK]    Got SIGSEGV at RIP=0x200000000000000
[RUN]   sigreturn to 0x400000000000000
[OK]    Got SIGSEGV at RIP=0x400000000000000
[RUN]   sigreturn to 0x800000000000000
[OK]    Got SIGSEGV at RIP=0x800000000000000
[RUN]   sigreturn to 0x1000000000000000
[OK]    Got SIGSEGV at RIP=0x1000000000000000
[RUN]   sigreturn to 0x2000000000000000
[OK]    Got SIGSEGV at RIP=0x2000000000000000
[RUN]   sigreturn to 0x4000000000000000
[OK]    Got SIGSEGV at RIP=0x4000000000000000
[RUN]   sigreturn to 0x8000000000000000
[OK]    Got SIGSEGV at RIP=0x8000000000000000
[RUN]   Trying a SYSCALL that falls through to 0x7fffffffe000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x7ffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x800000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0xfffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x1000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x1fffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x2000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x3fffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x4000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x7fffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x8000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0xffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x10000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x1ffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x20000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x3ffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x40000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x7ffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x80000000000000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0xfffffffffff000
[OK]    We survived
[RUN]   Trying a SYSCALL that falls through to 0x100000000000000
[OK]    mremap to 0xfffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x1fffffffffff000
[OK]    mremap to 0x1ffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x200000000000000
[OK]    mremap to 0x1fffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x3fffffffffff000
[OK]    mremap to 0x3ffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x400000000000000
[OK]    mremap to 0x3fffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x7fffffffffff000
[OK]    mremap to 0x7ffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x800000000000000
[OK]    mremap to 0x7fffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0xffffffffffff000
[OK]    mremap to 0xfffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x1000000000000000
[OK]    mremap to 0xffffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x1ffffffffffff000
[OK]    mremap to 0x1fffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x2000000000000000
[OK]    mremap to 0x1ffffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x3ffffffffffff000
[OK]    mremap to 0x3fffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x4000000000000000
[OK]    mremap to 0x3ffffffffffff000 failed
[RUN]   Trying a SYSCALL that falls through to 0x7ffffffffffff000
[OK]    mremap to 0x7fffffffffffe000 failed
[RUN]   Trying a SYSCALL that falls through to 0x8000000000000000
[OK]    mremap to 0x7ffffffffffff000 failed

-- 
 Kirill A. Shutemov