linux-kernel - Re: [PATCH] x86/mm: determine whether the fault address is canonical

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191006022941.pvwldrjyhl4z5inu@mail.google.com>
Date:   Sun, 6 Oct 2019 10:29:43 +0800
From:   Changbin Du <changbin.du@...il.com>
To:     Dave Hansen <dave.hansen@...el.com>
Cc:     Andy Lutomirski <luto@...nel.org>,
        Changbin Du <changbin.du@...il.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        X86 ML <x86@...nel.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] x86/mm: determine whether the fault address is canonical

On Fri, Oct 04, 2019 at 08:14:25AM -0700, Dave Hansen wrote:
> On 10/4/19 7:59 AM, Andy Lutomirski wrote:
> >> @@ -123,7 +125,8 @@ __visible bool ex_handler_uaccess(const struct exception_table_entry *fixup,
> >>                                   unsigned long error_code,
> >>                                   unsigned long fault_addr)
> >>  {
> >> -       WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault in user access. Non-canonical address?");
> >> +       WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault at %s address in user access.",
> >> +                 is_canonical_addr(fault_addr) ? "canonical" : "non-canonical");
> > Unless the hardware behaves rather differently from the way I think it
> > does, fault_addr is garbage for anything other than #PF and sometimes
> > for #DF.  (And maybe the virtualization faults?)  I don't believe that
> > #GP fills in CR2.
> 
> For #GP, we do:
> 
> do_general_protection(struct pt_regs *regs, long error_code)
> {
> ...
>         if (!user_mode(regs)) {
>                 if (fixup_exception(regs, X86_TRAP_GP, error_code, 0))
>                         return;
> 
> Where the 0 is 'fault_addr'.  I'm not sure any other way that
> ex_handler_uaccess() can get called with trapnr == X86_TRAP_GP.  0 is
> canonical last I checked, which would make this patch a bit academic. :)
My fault. I thought the 'fault_addr' is filled with a valid value. So we really
don't know the answer without decoding the instruction which causes this #GP. :)

-- 
Cheers,
Changbin Du