linux-kernel - Re: [RFC PATCH v9 14/27] mm: Handle Shadow Stack page fault

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 08 Apr 2020 11:18:40 -0700
From:   Yu-cheng Yu <yu-cheng.yu@...el.com>
To:     Dave Hansen <dave.hansen@...el.com>, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
        linux-doc@...r.kernel.org, linux-mm@...ck.org,
        linux-arch@...r.kernel.org, linux-api@...r.kernel.org,
        Arnd Bergmann <arnd@...db.de>,
        Andy Lutomirski <luto@...nel.org>,
        Balbir Singh <bsingharora@...il.com>,
        Borislav Petkov <bp@...en8.de>,
        Cyrill Gorcunov <gorcunov@...il.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Eugene Syromiatnikov <esyr@...hat.com>,
        Florian Weimer <fweimer@...hat.com>,
        "H.J. Lu" <hjl.tools@...il.com>, Jann Horn <jannh@...gle.com>,
        Jonathan Corbet <corbet@....net>,
        Kees Cook <keescook@...omium.org>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        Nadav Amit <nadav.amit@...il.com>,
        Oleg Nesterov <oleg@...hat.com>, Pavel Machek <pavel@....cz>,
        Peter Zijlstra <peterz@...radead.org>,
        Randy Dunlap <rdunlap@...radead.org>,
        "Ravi V. Shankar" <ravi.v.shankar@...el.com>,
        Vedvyas Shanbhogue <vedvyas.shanbhogue@...el.com>,
        Dave Martin <Dave.Martin@....com>, x86-patch-review@...el.com
Subject: Re: [RFC PATCH v9 14/27] mm: Handle Shadow Stack page fault

On Tue, 2020-04-07 at 15:21 -0700, Dave Hansen wrote:
> On 4/7/20 11:14 AM, Yu-cheng Yu wrote:
> > On Wed, 2020-02-26 at 16:08 -0800, Dave Hansen wrote:
> > > > diff --git a/mm/memory.c b/mm/memory.c
> > > > index 45442d9a4f52..6daa28614327 100644
> > > > --- a/mm/memory.c
> > > > +++ b/mm/memory.c
> > > > @@ -772,7 +772,8 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
> > > >  	 * If it's a COW mapping, write protect it both
> > > >  	 * in the parent and the child
> > > >  	 */
> > > > -	if (is_cow_mapping(vm_flags) && pte_write(pte)) {
> > > > +	if ((is_cow_mapping(vm_flags) && pte_write(pte)) ||
> > > > +	    arch_copy_pte_mapping(vm_flags)) {
> > > >  		ptep_set_wrprotect(src_mm, addr, src_pte);
> > > >  		pte = pte_wrprotect(pte);
> > > >  	}
> > > 
> > > You have to modify this because pte_write()==0 for shadow stack PTEs, right?
> > > 
> > > Aren't shadow stack ptes *logically* writable, even if they don't have
> > > the write bit set?  What would happen if we made pte_write()==1 for them?
> > 
> > Here the vm_flags needs to have VM_MAYWRITE, and the PTE needs to have
> > _PAGE_WRITE.  A shadow stack does not have either.
> 
> I literally mean taking pte_write(), and doing something l
> 
> static inline int pte_write(pte_t pte)
> {
> 	if (pte_present(pte) && pte_is_shadow_stack(pte))
> 		return 1;
> 
>         return pte_flags(pte) & _PAGE_RW;
> }
> 
> Then if is_cow_mapping() returns true for shadow stack VMAs, the above
> code doesn't need to change.

One benefit of this change is can_follow_write_pte() does not need any changes. 
A shadow stack PTE not in copy-on-write status is pte_write().

However, there are places that use pte_write() to determine if the PTE can be
made _PAGE_RW.  One such case is in change_pte_range(), where

	preserve_write = prot_numa && pte_write(oldpte);

and later,

	if (preserve_write)
		ptent = pte_mk_savedwrite(ptent);

Currently, there are other checks and shadow stack PTEs won't become _PAGE_RW. 
I am wondering if this can be overlooked later when the code is modified.

Another potential issue is, because pte_write()==1, a shadow stack PTE is made a
write migration entry, and can later accidentally become _PAGE_RW.  I think the
page fault handler would catch that, but still call it out in case I miss
anything.

Yu-cheng