linux-kernel - Re: [PATCH 13/15] x86/fsgsbase/64: With FSGSBASE, compare GS bases on paranoid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <B96DA962-6278-4FDE-A8C6-020E789CE67F@intel.com>
Date:   Tue, 20 Mar 2018 16:33:42 +0000
From:   "Bae, Chang Seok" <chang.seok.bae@...el.com>
To:     Andy Lutomirski <luto@...nel.org>
CC:     X86 ML <x86@...nel.org>, Andi Kleen <ak@...ux.intel.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        "Metzger, Markus T" <markus.t.metzger@...el.com>,
        "Luck, Tony" <tony.luck@...el.com>,
        "Shankar, Ravi V" <ravi.v.shankar@...el.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>
Subject: Re: [PATCH 13/15] x86/fsgsbase/64: With FSGSBASE, compare GS bases
 on paranoid_entry

On 3/20/18, 07:58, "Andy Lutomirski" <luto@...nel.org> wrote:
 
>> On Mar 19, 2018, at 10:49 AM, Chang S. Bae <chang.seok.bae@...el.com> wrote:
>>
>> When FSGSBASE is enabled, SWAPGS needs if and only if (current)
>> GS base is not the kernel's.
>>
>> FSGSBASE instructions allow user to write any value on GS base;
>> even negative. Sign check on the current GS base is not
>> sufficient. Fortunately, reading GS base is fast. Kernel GS
>> base is also known from the offset table with the CPU number.
    
> The original version of these patches (mine and Andi’s) didn’t have
>  this comparison, didn’t need RDMSR, and didn’t allow malicious user
>  programs to cause the kernel to run decently large chunks of code with
>  the reverse of the expected GS convention. Why did you change it?
    
>    I really really don't like having a corner case like this that can and
>    will be triggered by malicious user code but that is hard to write a
>    self-test for because it involves guessing a 64-bit magic number.
>    Untestable corner cases in the x86 entry code are bad.

Originally, I took it. But since it keeps kernel GS base on the (IST) stack,
it is thought as fragile [1] AFAIK. If you really don't like this "comparison"
then GS base can be written (unconditionally) while the original GS
base stitched (like the original approach did) IMO.
    
[1] https://marc.info/?l=linux-kernel&m=151725088506036&w=3