linux-kernel - Re: [tip:x86/pti] x86/asm: Pad assembly functions with INT3 instructions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1529242717.4472.3.camel@gmx.de>
Date:   Sun, 17 Jun 2018 15:38:37 +0200
From:   Mike Galbraith <efault@....de>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Alexey Dobriyan <adobriyan@...il.com>,
        torvalds@...ux-foundation.org, tglx@...utronix.de,
        mingo@...nel.org, jpoimboe@...hat.com, luto@...nel.org,
        peterz@...radead.org, brgerst@...il.com, hpa@...or.com,
        linux-kernel@...r.kernel.org, dvlasenk@...hat.com,
        h.peter.anvin@...el.com,
        linux-tip-commits <linux-tip-commits@...r.kernel.org>
Subject: Re: [tip:x86/pti] x86/asm: Pad assembly functions with INT3
 instructions

On Sun, 2018-06-17 at 14:00 +0200, Borislav Petkov wrote:
> On Sun, Jun 17, 2018 at 01:40:13PM +0200, Mike Galbraith wrote:
> > On Mon, 2018-05-14 at 05:53 -0700, tip-bot for Alexey Dobriyan wrote:
> > > Commit-ID:  51bad67ffbce0aaa44579f84ef5d05597054ec6a
> > > Gitweb:     https://git.kernel.org/tip/51bad67ffbce0aaa44579f84ef5d05597054ec6a
> > > Author:     Alexey Dobriyan <adobriyan@...il.com>
> > > AuthorDate: Tue, 8 May 2018 00:37:55 +0300
> > > Committer:  Ingo Molnar <mingo@...nel.org>
> > > CommitDate: Mon, 14 May 2018 11:43:03 +0200
> > > 
> > > x86/asm: Pad assembly functions with INT3 instructions
> > > 
> > > Use INT3 instead of NOP. All that padding between functions is
> > > an illegal area, no legitimate code should jump into it.
> > 
> > Is dinky patchlet suggesting cryptomgr is being naughty?
> > 
> > (revert silences spew, but..)
> > 
> > ...
> > [   21.041608] int3: 0000 [#1] SMP PTI
> > [   21.041754] CPU: 3 PID: 935 Comm: cryptomgr_test Tainted: G            E     4.17.0.g075a1d3-tip-default #146
> > [   21.041888] Hardware name: MEDION MS-7848/MS-7848, BIOS M7848W08.20C 09/23/2013
> > [   21.042035] RIP: 0010:crypto_aegis128_aesni_enc_tail+0x74/0x80 [aegis128_aesni]
> > [   21.042171] Code: 38 dc ca 66 0f 38 dc d3 66 0f 38 dc de 66 0f ef e5 f3 0f 7f 27 f3 0f 7f 47 10 f3 0f 7f 4f 20 f3 0f 7f 57 30 f3 0f 7f 5f 40 cc <cc> cc cc cc cc cc cc cc cc cc cc cc 48 83 fe 10 0f 82 c3 03 00 00
> 
> Looks like it misses a RET:

Bingo.

[   28.751069] RIP: 0010:crypto_aegis128l_aesni_enc_tail+0xcd/0xd0 [aegis128l_aesni]

Next next next..

> ---
> From 6ac281ee69f4cb5b581d5f49662fb56b6326155a Mon Sep 17 00:00:00 2001
> From: Borislav Petkov <bp@...e.de>
> Date: Sun, 17 Jun 2018 13:57:42 +0200
> Subject: [PATCH] x86/crypto: Add a missing RET
> 
> crypto_aegis128_aesni_enc_tail() needs to return too.
> 
> Signed-off-by: Borislav Petkov <bp@...e.de>
> ---
>  arch/x86/crypto/aegis128-aesni-asm.S | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/x86/crypto/aegis128-aesni-asm.S b/arch/x86/crypto/aegis128-aesni-asm.S
> index 9254e0b6cc06..717bf0776421 100644
> --- a/arch/x86/crypto/aegis128-aesni-asm.S
> +++ b/arch/x86/crypto/aegis128-aesni-asm.S
> @@ -535,6 +535,7 @@ ENTRY(crypto_aegis128_aesni_enc_tail)
>  	movdqu STATE3, 0x40(STATEP)
>  
>  	FRAME_END
> +	ret
>  ENDPROC(crypto_aegis128_aesni_enc_tail)
>  
>  .macro decrypt_block a s0 s1 s2 s3 s4 i
> -- 
> 2.17.0.582.gccdcbd54c
>