linux-kernel - Re: [PATCH] x86/mm: determine whether the fault address is canonical

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Oct 2019 08:14:25 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Andy Lutomirski <luto@...nel.org>,
        Changbin Du <changbin.du@...il.com>
Cc:     Dave Hansen <dave.hansen@...ux.intel.com>, X86 ML <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] x86/mm: determine whether the fault address is canonical

On 10/4/19 7:59 AM, Andy Lutomirski wrote:
>> @@ -123,7 +125,8 @@ __visible bool ex_handler_uaccess(const struct exception_table_entry *fixup,
>>                                   unsigned long error_code,
>>                                   unsigned long fault_addr)
>>  {
>> -       WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault in user access. Non-canonical address?");
>> +       WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault at %s address in user access.",
>> +                 is_canonical_addr(fault_addr) ? "canonical" : "non-canonical");
> Unless the hardware behaves rather differently from the way I think it
> does, fault_addr is garbage for anything other than #PF and sometimes
> for #DF.  (And maybe the virtualization faults?)  I don't believe that
> #GP fills in CR2.

For #GP, we do:

do_general_protection(struct pt_regs *regs, long error_code)
{
...
        if (!user_mode(regs)) {
                if (fixup_exception(regs, X86_TRAP_GP, error_code, 0))
                        return;

Where the 0 is 'fault_addr'.  I'm not sure any other way that
ex_handler_uaccess() can get called with trapnr == X86_TRAP_GP.  0 is
canonical last I checked, which would make this patch a bit academic. :)