linux-kernel - Re: [PATCH PTI v3 03/10] x86/pti/64: Fix ESPFIX64 user mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrUwfVOFMpU+YN0BKkmToOHC9+02QbLWP+h7mQvHATYd=Q@mail.gmail.com>
Date:   Thu, 14 Dec 2017 08:18:27 -0800
From:   Andy Lutomirski <luto@...nel.org>
To:     "Kirill A. Shutemov" <kirill@...temov.name>
Cc:     Andy Lutomirski <luto@...nel.org>, X86 ML <x86@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Borislav Petkov <bp@...en8.de>,
        Brian Gerst <brgerst@...il.com>,
        David Laight <David.Laight@...lab.com>,
        Kees Cook <keescook@...omium.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH PTI v3 03/10] x86/pti/64: Fix ESPFIX64 user mapping

On Thu, Dec 14, 2017 at 6:10 AM, Kirill A. Shutemov
<kirill@...temov.name> wrote:
> On Wed, Dec 13, 2017 at 09:01:50AM -0800, Andy Lutomirski wrote:
>> On Wed, Dec 13, 2017 at 5:12 AM, Kirill A. Shutemov
>> <kirill@...temov.name> wrote:
>> > On Tue, Dec 12, 2017 at 07:56:38AM -0800, Andy Lutomirski wrote:
>> >> The ESPFIX64 user mapping belongs in pti.c just like all the other
>> >> user mappings.  Move it there and make it work correctly while we're
>> >> at it.
>> >>
>> >> Signed-off-by: Andy Lutomirski <luto@...nel.org>
>> >
>> > Acked-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
>> >
>> > BTW, why do we open-code p?d_alloc() in pti_user_pagetable_walk_*()?
>> > It seems unnecessary and potentially bogus: see smp_wmb() in __p?d_alloc()
>> > helpers.
>>
>> The helpers won't work -- we're allocating kernel-owned tables in the
>> usermode part of init_mm.  The p?d_alloc() helpers allocate
>> user-accounted tables in the kernelmode part of the mm.
>
> What's wrong to account them against init_mm?
>

Nothing.  But the other parts are showstoppers: the helpers won't set
_PAGE_USER in the higher level entries and they will put the pgds in
the wrong place.