linux-kernel - RE: [PATCH] x86/uaccess: Use pointer masking to limit uaccess speculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <93873def6ede46f89fa33b3fc78876f6@AcuMS.aculab.com>
Date:   Tue, 1 Sep 2020 08:32:20 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Josh Poimboeuf' <jpoimboe@...hat.com>
CC:     "'x86@...nel.org'" <x86@...nel.org>,
        "'linux-kernel@...r.kernel.org'" <linux-kernel@...r.kernel.org>,
        'Linus Torvalds' <torvalds@...ux-foundation.org>,
        'Al Viro' <viro@...iv.linux.org.uk>,
        "'Will Deacon'" <will@...nel.org>,
        'Dan Williams' <dan.j.williams@...el.com>,
        "'Andrea Arcangeli'" <aarcange@...hat.com>,
        'Waiman Long' <longman@...hat.com>,
        "'Peter Zijlstra'" <peterz@...radead.org>,
        'Thomas Gleixner' <tglx@...utronix.de>,
        'Andrew Cooper' <andrew.cooper3@...rix.com>,
        'Andy Lutomirski' <luto@...nel.org>,
        'Christoph Hellwig' <hch@....de>
Subject: RE: [PATCH] x86/uaccess: Use pointer masking to limit uaccess
 speculation

From: Josh Poimboeuf
> Sent: 31 August 2020 18:31
> On Sat, Aug 29, 2020 at 07:31:20PM +0000, David Laight wrote:
> > > Rereading the patch it looks like a lot of bloat (as well as a
> > > lot of changes).
> > > Does the array_mask even work on 32bit archs where the kernel
> > > base address is 0xc0000000?
> 
> Why wouldn't it on work on 32-bit?  My patch does have a minor compile
> bug on 32-bit, but otherwise it seems to work (i.e., the asm looks ok,
> and it boots).

As usual I hadn't looked closely enough into the masked_array internals.

...
> > Actually, thinking further, if:
> > 1) the access_ok() immediately precedes the user copy (as it should).
> > 2) the user-copies use a sensible 'increasing address' copy.
> > and
> > 3) there is a 'guard page' between valid user and kernel addresses.
> > Then access_ok() only need check the base address of the user buffer.
> 
> Yes, it would make sense to put the masking in access_ok() somehow.  But
> to do it properly, I think we'd first need to make access_ok() generic.
> Maybe that's do-able, but it would be a much bigger patch set.
> 
> First I'd prefer to just fix x86, like my patch does.  Then we could do
> an access_ok() rework.

If you do a modified access_ok() you get to (slowly) collect all
the important paths.
No point replicating the same test.

A lot of the access_ok() can be deleted - maybe remove some __
from the following functions.
Or change to the variants that enable user-space accesses.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)