linux-kernel - Re: [PATCH v3 3/5] arch/x86/mm: Refactor cond

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87pnc5xgff.fsf@nanos.tec.linutronix.de>
Date:   Sat, 18 Apr 2020 11:59:48 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     "Singh\, Balbir" <sblbir@...zon.com>,
        "linux-kernel\@vger.kernel.org" <linux-kernel@...r.kernel.org>
Cc:     "keescook\@chromium.org" <keescook@...omium.org>,
        "tony.luck\@intel.com" <tony.luck@...el.com>,
        "benh\@kernel.crashing.org" <benh@...nel.crashing.org>,
        "jpoimboe\@redhat.com" <jpoimboe@...hat.com>,
        "x86\@kernel.org" <x86@...nel.org>,
        "dave.hansen\@intel.com" <dave.hansen@...el.com>
Subject: Re: [PATCH v3 3/5] arch/x86/mm: Refactor cond_ibpb() to support other use cases

"Singh, Balbir" <sblbir@...zon.com> writes:
> On Fri, 2020-04-17 at 15:07 +0200, Thomas Gleixner wrote:
>> 
>> Balbir Singh <sblbir@...zon.com> writes:
>> > 
>> >  /*
>> > - * Use bit 0 to mangle the TIF_SPEC_IB state into the mm pointer which is
>> > - * stored in cpu_tlb_state.last_user_mm_ibpb.
>> > + * Bits to mangle the TIF_SPEC_IB state into the mm pointer which is
>> > + * stored in cpu_tlb_state.last_user_mm_spec.
>> >   */
>> >  #define LAST_USER_MM_IBPB    0x1UL
>> > +#define LAST_USER_MM_SPEC_MASK       (LAST_USER_MM_IBPB)
>> > 
>> >       /* Reinitialize tlbstate. */
>> > -     this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, LAST_USER_MM_IBPB);
>> > +     this_cpu_write(cpu_tlbstate.last_user_mm_spec, LAST_USER_MM_IBPB);
>> 
>> Shouldn't that be LAST_USER_MM_MASK?
>> 
> No, that crashes the system for SW flushes, because it tries to flush the L1D
> via the software loop and early enough we don't have the l1d_flush_pages
> allocated. LAST_USER_MM_MASK has LAST_USER_MM_FLUSH_L1D bit set.

You can trivially prevent this by checking l1d_flush_pages != NULL.

Thanks,

        tglx