linux-kernel - Re: [RFC 6/7] x86/asm: Remap the TSS into the cpu entry area

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrWGMq5F7D2daB9qw48Hp+WxF0gZeMbc+K-RnDt42hawTQ@mail.gmail.com>
Date:   Mon, 13 Nov 2017 18:27:54 -0800
From:   Andy Lutomirski <luto@...nel.org>
To:     Dave Hansen <dave.hansen@...el.com>
Cc:     Andy Lutomirski <luto@...nel.org>, X86 ML <x86@...nel.org>,
        Borislav Petkov <bpetkov@...e.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Brian Gerst <brgerst@...il.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [RFC 6/7] x86/asm: Remap the TSS into the cpu entry area

On Mon, Nov 13, 2017 at 11:22 AM, Dave Hansen <dave.hansen@...el.com> wrote:
> On 11/10/2017 08:05 PM, Andy Lutomirski wrote:
>> diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
>> index fbc9b7f4e35e..8a9ba5553cab 100644
>> --- a/arch/x86/include/asm/fixmap.h
>> +++ b/arch/x86/include/asm/fixmap.h
>> @@ -52,6 +52,13 @@ extern unsigned long __FIXADDR_TOP;
>>  struct cpu_entry_area
>>  {
>>       char gdt[PAGE_SIZE];
>> +
>> +     /*
>> +      * The gdt is just below cpu_tss and thus serves (on x86_64) as a
>> +      * a read-only guard page for the SYSENTER stack at the bottom
>> +      * of the TSS region.
>> +      */
>> +     struct tss_struct tss;
>>  };
>>
>
> Aha, and here's the place that you need sizeof(tss_struct) to be nice
> and page-aligned.
>
> But why don't we just do:
>
>         char tss_space[PAGE_SIZE*something];

The idea is to save some space.  The TSS plus IO bitmap is slightly
over a page, so, if we're giving it a dedicated block of pages, we
have almost a page of unused space.  I want to use some of that space
for the SYSENTER stack.  To reliably detect overflow, that space
should be at the beginning.

It turns out that using almost a page is way too *big*: it masks bugs.
I want anything nontrivial that accidentally runs on the SYSENTER
stack to overflow and crash very quickly rather than having a decent
chance of working or of causing nasty corruption with a crash down the
road.  So I'm going to make it much smaller and instead just add a
build-time assertion that we don't cross a page boundary.