linux-kernel - Re: [PATCH] x86/xen: Delay get_cpu_cap until stack canary is established

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 31 Mar 2018 14:29:49 -0400
From:   Jason Andryuk <jandryuk@...il.com>
To:     Boris Ostrovsky <boris.ostrovsky@...cle.com>
Cc:     Juergen Gross <jgross@...e.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        xen-devel@...ts.xenproject.org,
        open list <linux-kernel@...r.kernel.org>,
        stable@...r.kernel.org
Subject: Re: [PATCH] x86/xen: Delay get_cpu_cap until stack canary is established

On Sat, Mar 31, 2018 at 2:10 PM, Boris Ostrovsky
<boris.ostrovsky@...cle.com> wrote:
> On 03/31/2018 01:38 PM, Jason Andryuk wrote:
>> On Wed, Mar 21, 2018, 5:12 PM Boris Ostrovsky <boris.ostrovsky@...cle.com
>> <mailto:boris.ostrovsky@...cle.com>> wrote:
>>
>>     On 03/19/2018 12:58 PM, Jason Andryuk wrote:
>>      > Commit 2cc42bac1c79 ("x86-64/Xen: eliminate W+X mappings")
>>     introduced a
>>      > call to get_cpu_cap, which is fstack-protected.  This is works on
>>     x86-64
>>      > as commit 4f277295e54c ("x86/xen: init %gs very early to avoid page
>>      > faults with stack protector") ensures the stack protector is
>>     configured,
>>      > but it it did not cover x86-32.
>>      >
>>      > Delay calling get_cpu_cap until after xen_setup_gdt has
>>     initialized the
>>      > stack canary.  Without this, a 32bit PV machine crashes early
>>      > in boot.
>>      > (XEN) Domain 0 (vcpu#0) crashed on cpu#0:
>>      > (XEN) ----[ Xen-4.6.6-xc  x86_64  debug=n  Tainted:    C ]----
>>      > (XEN) CPU:    0
>>      > (XEN) RIP:    e019:[<00000000c10362f8>]
>>      >
>>      > And the PV kernel IP corresponds to init_scattered_cpuid_features
>>      >    0xc10362f8 <+24>:    mov    %gs:0x14,%eax
>>      >
>>      > Fixes 2cc42bac1c79 ("x86-64/Xen: eliminate W+X mappings")
>>      >
>>      > Signed-off-by: Jason Andryuk <jandryuk@...il.com
>>     <mailto:jandryuk@...il.com>>
>>      >
>>
>>
>>     Applied to for-linus-4.17
>>
>>
>> Thanks. If it's not too late, can this be cc: stable?
>
> We can always try ;-)
>
> This is 4.15 and 4.16 only, I believe.

I'm using this patch on 4.14, so there as well.

-Jason