linux-kernel - Re: [PATCH v10 00/18] Enable FSGSBASE instructions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d7111932-6ba5-1484-4347-210d9e80316f@oracle.com>
Date:   Sun, 10 May 2020 10:29:47 +0200
From:   Vegard Nossum <vegard.nossum@...cle.com>
To:     Sasha Levin <sashal@...nel.org>, linux-kernel@...r.kernel.org,
        tglx@...utronix.de, luto@...nel.org
Cc:     tony.luck@...el.com, ak@...ux.intel.com, chang.seok.bae@...el.com
Subject: Re: [PATCH v10 00/18] Enable FSGSBASE instructions


On 5/10/20 10:09 AM, Vegard Nossum wrote:
> 
> On 4/24/20 1:21 AM, Sasha Levin wrote:
>> Benefits:
>> Currently a user process that wishes to read or write the FS/GS base must
>> make a system call. But recent X86 processors have added new instructions
>> for use in 64-bit mode that allow direct access to the FS and GS segment
>> base addresses.  The operating system controls whether applications can
>> use these instructions with a %cr4 control bit.
[...]
> So FWIW I've done some overnight fuzz testing of this patch set and
> haven't seen any problems. Will try a couple of other kernel configs too.

I spoke a few minutes too soon. Just hit this, if anybody wants to have
a look:

[ 6402.786418] ------------[ cut here ]------------
[ 6402.787769] WARNING: CPU: 0 PID: 13802 at arch/x86/kernel/traps.c:811 
do_debug+0x16c/0x210
[ 6402.790042] CPU: 0 PID: 13802 Comm: init Not tainted 5.7.0-rc4+ #194
[ 6402.791779] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 6402.793365] RIP: 0010:do_debug+0x16c/0x210
[ 6402.794496] Code: ef e8 f8 fb 00 00 f6 85 91 00 00 00 02 74 b9 fa 66 
66 90 66 66 90 e8 c3 f5 11 00 eb ab f6 85 88 00 00 00 03 0f 85 6e ff ff 
ff <0f> 0b 80 e4 bf 49 89 84 24 58 0a 00 00 f0 41 80 0c 24 10 48 81 a5
[ 6402.799557] RSP: 0000:fffffe0000011f20 EFLAGS: 00010046
[ 6402.800995] RAX: 0000000000004002 RBX: 0000000000000000 RCX: 
00000000ffffffff
[ 6402.802959] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 
ffffffff82471e60
[ 6402.804891] RBP: fffffe0000011f58 R08: 0000000000000000 R09: 
0000000000000005
[ 6402.806836] R10: 0000000000000000 R11: 0000000000000000 R12: 
ffff88803e739a00
[ 6402.808775] R13: 0000000000000000 R14: 000000003ce24000 R15: 
0000000000000000
[ 6402.810723] FS:  000000000097a8c0(0000) GS:ffff88803ec00000(0000) 
knlGS:0000000000000000
[ 6402.812933] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6402.814509] CR2: 0000000040000010 CR3: 000000003ce24000 CR4: 
00000000000006f0
[ 6402.816468] DR0: 0000000000000001 DR1: 0000000040006070 DR2: 
00007ffff7ffd000
[ 6402.818406] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 
0000000003b3062a
[ 6402.820353] Call Trace:
[ 6402.821043]  <#DB>
[ 6402.821622]  debug+0x37/0x70
[ 6402.822449] RIP: 0010:arch_stack_walk_user+0x79/0x110
[ 6402.823851] Code: b8 f0 ff ff bf be f0 df ff ff 48 0f 44 c6 48 39 d0 
0f 82 94 00 00 00 41 83 87 b8 09 00 00 01 66 66 90 0f ae e8 31 c0 48 8b 
1a <66> 66 90 85 c0 75 72 66 66 90 0f ae e8 48 8b 72 08 66 66 90 85 c0
[ 6402.828923] RSP: 0000:ffffc90003807d80 EFLAGS: 00000046
[ 6402.830346] RAX: 0000000000000000 RBX: 0040001000bf4800 RCX: 
0000000000000001
[ 6402.832288] RDX: 0000000040006073 RSI: 00000000400060dd RDI: 
ffffc90003807db8
[ 6402.834250] RBP: ffffc90003807f58 R08: 0000000000000001 R09: 
ffff88803e444400
[ 6402.836203] R10: 000000000000054c R11: ffff88803d2d955c R12: 
ffff88803e739a00
[ 6402.838139] R13: ffffffff810f16a0 R14: ffffc90003807db8 R15: 
ffff88803e739a00
[ 6402.840083]  ? profile_setup.cold+0xa1/0xa1
[ 6402.841235]  </#DB>
[ 6402.841836]  stack_trace_save_user+0x8c/0xd4
[ 6402.843045]  trace_buffer_unlock_commit_regs+0x122/0x1a0
[ 6402.844501]  trace_event_buffer_commit+0x6d/0x240
[ 6402.845799]  trace_event_raw_event_preemptirq_template+0x75/0xc0
[ 6402.847441]  ? debug+0x53/0x70
[ 6402.848299]  ? trace_hardirqs_off_thunk+0x1a/0x33
[ 6402.849593]  trace_hardirqs_off_caller+0xa6/0xd0
[ 6402.850862]  ? debug+0x4e/0x70
[ 6402.851727]  trace_hardirqs_off_thunk+0x1a/0x33
[ 6402.852983]  debug+0x53/0x70
[ 6402.853785] RIP: 0033:0x400060dd
[ 6402.854681] Code: 7a 1e 9e 91 de 4c 65 49 be 00 d0 ff f7 ff 7f 00 00 
49 bf de a7 b3 e8 d7 21 3c 15 9c 48 81 0c 24 00 01 00 00 9d b8 62 00 00 
00 <8e> c0 0f 05 66 8c c8 9c 48 81 24 24 ff fe ff ff 9d 48 89 04 25 40
[ 6402.859689] RSP: 002b:000000004000aea0 EFLAGS: 00000317
[ 6402.861116] RAX: 0000000000000062 RBX: 0000000040001000 RCX: 
ffffffffffffffff
[ 6402.863097] RDX: 0000000040003000 RSI: 0000000040004000 RDI: 
0000000040001000
[ 6402.866199] RBP: 0000000040006073 R08: 0000000000000001 R09: 
0000000000000001
[ 6402.868142] R10: ffffffffef080df2 R11: 1000000000000000 R12: 
fdffffffffffffff
[ 6402.870083] R13: 654cde919e1e7ab5 R14: 00007ffff7ffd000 R15: 
153c21d7e8b3a7de
[ 6402.872049] ---[ end trace 91a3039d0fd63799 ]---

It might not be related to the patch set, mind.


Vegard