linux-kernel - Re: 32-bit PTI with THP = userspace corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180911114927.gikd3uf3otxn2ekq@suse.de>
Date:   Tue, 11 Sep 2018 13:49:27 +0200
From:   Joerg Roedel <jroedel@...e.de>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Meelis Roos <mroos@...ux.ee>,
        Linux Kernel list <linux-kernel@...r.kernel.org>,
        linux-mm@...ck.org, Andrea Arcangeli <aarcange@...hat.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: 32-bit PTI with THP = userspace corruption

Hi,

[
  Andrea, maybe you can have a quick look here too, please? Maybe I am
  overlooking a simple way to fix the issue. Problem description is
  below.
]

On Sat, Sep 08, 2018 at 12:24:10PM +0200, Thomas Gleixner wrote:
> > I'll try to reproduce and work on a fix.
> 
> Any progress on this?

Yes, but slower than I hoped because an infection sent me to bed for a
couple of days :/

So I can reproduce the issue, and the core problem is that with 32-bit
legacy paging the PGD level is also the huge-page level. This means that
we have two huge PTEs for every mapping and also two places where we
have to look for A/D bits. The problem now is that the kernel only looks
at the huge PTE in the kernel page-table when it evaluates A/D bits.
This causes data corruption when it misses an A/D bit.

I had a look into the THP and the HugeTLBfs code, and that is not
really easy to fix there. As I can see it now, there are a few options
to fix that, but most of them are ugly:

	1) Use Software A/D bits for 2-level legacy paging (ugly because
	   we need separate PAGE_* macros for that paging mode then)

	2) Update all the places in THP and HugeTLBfs code that
	   evaluate A/D bits to take both PTEs into account (ugly too
	   for obvious reasons)

	3) Disable THP and HugeTLBfs on 2-level paging kernels when PTI
	   is enabled (ugly because it breaks userspace expectations)

	4) Disable PTI support on 2-level paging by making it dependent
	   on CONFIG_X86_PAE. This is, imho, the least ugly option
	   because the machines that do not support PAE are most likely
	   too old to be affected my Meltdown anyway. We might also
	   consider switching i386_defconfig to PAE?

I am not a THP or HugeTLBfs expert and maybe I am overlooking a simpler
way to fix this issue. But as it stands now I am in favour for option
number 4.

Any other thoughts?

Thanks,

	Joerg