linux-kernel - Re: [RFC PATCH 2/4] x86/fault: Attempt to fixup unhandled #PF in vDSO before signaling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 6 Dec 2018 10:46:44 -0800
From:   Andy Lutomirski <luto@...nel.org>
To:     Dave Hansen <dave.hansen@...el.com>
Cc:     "Christopherson, Sean J" <sean.j.christopherson@...el.com>,
        Andrew Lutomirski <luto@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        X86 ML <x86@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Peter Zijlstra <peterz@...radead.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        Josh Triplett <josh@...htriplett.org>
Subject: Re: [RFC PATCH 2/4] x86/fault: Attempt to fixup unhandled #PF in vDSO
 before signaling

On Thu, Dec 6, 2018 at 10:17 AM Dave Hansen <dave.hansen@...el.com> wrote:
>
> >  #define CREATE_TRACE_POINTS
> >  #include <asm/trace/exceptions.h>
> > @@ -928,6 +929,9 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
> >               if (address >= TASK_SIZE_MAX)
> >                       error_code |= X86_PF_PROT;
> >
> > +             if (fixup_vdso_exception(regs, X86_TRAP_PF, error_code, address))
> > +                     return;
> > +
> >               if (likely(show_unhandled_signals))
> >                       show_signal_msg(regs, error_code, address, tsk);
>
> I'd preferably like to get this plugged into the page fault code before
> we get to the "bad_area" handling.  This plugs it in near the erratum
> handling which seems really late to me.
>
> > @@ -1045,6 +1049,9 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
> >       if (is_prefetch(regs, error_code, address))
> >               return;
> >
> > +     if (fixup_vdso_exception(regs, X86_TRAP_PF, error_code, address))
> > +             return;
> > +
> >       set_signal_archinfo(address, error_code);
> >
> >  #ifdef CONFIG_MEMORY_FAILURE
>
> This *seems* really late to me.  We've already called into the mm fault
> handling code to try and handle the fault and they told us it was
> VM_FAULT_SIGBUS.  Shouldn't we have just detected that it was in the
> vDSO first and not even called the handling code?

I think we only want to do the fixup in cases where we would have
signalled.  I'm about 99.5% confident that if the page fault points to
valid user memory that just happened to have been swapped out, then we
want to swap it in and go straight to ERESUME rather than bailing out
of the vDSO.  What we really want is to IRET with a magic flag saying
"resume the enclave, silly", but we don't have any way to ask for
that.

--Andy