linux-kernel - Re: [PATCH v41 20/24] selftests/x86: Add a selftest for SGX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20201117213841.GB14833@kernel.org>
Date:   Tue, 17 Nov 2020 23:38:41 +0200
From:   Jarkko Sakkinen <jarkko@...nel.org>
To:     Borislav Petkov <bp@...en8.de>
Cc:     x86@...nel.org, linux-sgx@...r.kernel.org,
        linux-kernel@...r.kernel.org, Shuah Khan <shuah@...nel.org>,
        linux-kselftest@...r.kernel.org,
        Jethro Beekman <jethro@...tanix.com>,
        akpm@...ux-foundation.org, andriy.shevchenko@...ux.intel.com,
        asapek@...gle.com, cedric.xing@...el.com, chenalexchen@...gle.com,
        conradparker@...gle.com, cyhanish@...gle.com,
        dave.hansen@...el.com, haitao.huang@...el.com, kai.huang@...el.com,
        kai.svahn@...el.com, kmoy@...gle.com, ludloff@...gle.com,
        luto@...nel.org, nhorman@...hat.com, npmccallum@...hat.com,
        puiterwijk@...hat.com, rientjes@...gle.com,
        sean.j.christopherson@...el.com, tglx@...utronix.de,
        yaozhangx@...gle.com, mikko.ylinen@...el.com
Subject: Re: [PATCH v41 20/24] selftests/x86: Add a selftest for SGX

On Tue, Nov 17, 2020 at 06:26:50PM +0100, Borislav Petkov wrote:
> On Fri, Nov 13, 2020 at 12:01:31AM +0200, Jarkko Sakkinen wrote:
> > +bool encl_load(const char *path, struct encl *encl)
> > +{
> > +	Elf64_Phdr *phdr_tbl;
> > +	off_t src_offset;
> > +	Elf64_Ehdr *ehdr;
> > +	int i, j;
> > +	int ret;
> > +
> > +	memset(encl, 0, sizeof(*encl));
> > +
> > +	ret = open("/dev/sgx_enclave", O_RDWR);
> > +	if (ret < 0) {
> > +		fprintf(stderr, "Unable to open /dev/sgx_enclave\n");
> > +		goto err;
> > +	}
> > +
> > +	encl->fd = ret;
> > +
> > +	if (!encl_map_bin(path, encl))
> > +		goto err;
> > +
> > +	ehdr = encl->bin;
> > +	phdr_tbl = encl->bin + ehdr->e_phoff;
> > +
> > +	for (i = 0; i < ehdr->e_phnum; i++) {
> > +		Elf64_Phdr *phdr = &phdr_tbl[i];
> > +
> > +		if (phdr->p_type == PT_LOAD)
> > +			encl->nr_segments++;
> > +	}
> > +
> > +	encl->segment_tbl = calloc(encl->nr_segments,
> > +				   sizeof(struct encl_segment));
> > +	if (!encl->segment_tbl)
> > +		goto err;
> > +
> > +	for (i = 0, j = 0; i < ehdr->e_phnum; i++) {
> > +		Elf64_Phdr *phdr = &phdr_tbl[i];
> > +		unsigned int flags = phdr->p_flags;
> > +		struct encl_segment *seg;
> > +
> > +		if (phdr->p_type != PT_LOAD)
> > +			continue;
> > +
> > +		seg = &encl->segment_tbl[j];
> > +
> > +		if (!!(flags & ~(PF_R | PF_W | PF_X))) {
> > +			fprintf(stderr,
> > +				"%d has invalid segment flags 0x%02x.\n", i,
> > +				phdr->p_flags);
> > +			goto err;
> > +		}
> > +
> > +		if (j == 0 && flags != (PF_R | PF_W)) {
> > +			fprintf(stderr,
> > +				"TCS has invalid segment flags 0x%02x.\n",
> > +				phdr->p_flags);
> > +			goto err;
> > +		}
> > +
> > +		if (j == 0) {
> > +			src_offset = (phdr->p_offset & PAGE_MASK) - src_offset;
> > +
> > +			seg->prot = PROT_READ | PROT_WRITE;
> > +			seg->flags = SGX_PAGE_TYPE_TCS << 8;
> > +		} else  {
> > +			seg->prot = (phdr->p_flags & PF_R) ? PROT_READ : 0;
> > +			seg->prot |= (phdr->p_flags & PF_W) ? PROT_WRITE : 0;
> > +			seg->prot |= (phdr->p_flags & PF_X) ? PROT_EXEC : 0;
> > +			seg->flags = (SGX_PAGE_TYPE_REG << 8) | seg->prot;
> > +		}
> > +
> > +		seg->offset = (phdr->p_offset & PAGE_MASK) - src_offset;
> > +		seg->size = (phdr->p_filesz + PAGE_SIZE - 1) & PAGE_MASK;
> > +
> > +		printf("0x%016lx 0x%016lx 0x%02x\n", seg->offset, seg->size,
> > +		       seg->prot);
> > +
> > +		j++;
> > +	}
> > +
> > +	assert(j == encl->nr_segments);
> > +
> > +	encl->src = encl->bin + src_offset;
> > +	encl->src_size = encl->segment_tbl[j - 1].offset +
> > +			 encl->segment_tbl[j - 1].size;
> > +
> > +	for (encl->encl_size = 4096; encl->encl_size < encl->src_size; )
> > +		encl->encl_size <<= 1;
> 
> Something's fishy. That selftest fails with
> 
> mmap: Cannot allocate memory
> 
> I sprinkled some printfs at this size computation above and here's what
> it says:
> 
> 0x00007fdd3b4ca190 0x0000000000002000 0x03
> 0x00007fdd3b4cc190 0x0000000000001000 0x05
> 0x00007fdd3b4cd190 0x0000000000003000 0x03
> encl_load: encl->nr_segments: 3
> encl_load: seg2 offset: 0x7fdd3b4cd190, seg2 size: 12288
> encl_load: encl_size: 140737488355328, src_size: 140588159402384
> encl_map_area: encl_size: 140737488355328
> mmap: Cannot allocate memory

In my machine, with the current version:

➜  sgx (master) ✗ ./test_sgx
0x0000000000000000 0x0000000000002000 0x03
0x0000000000002000 0x0000000000001000 0x05
0x0000000000003000 0x0000000000003000 0x03
SUCCESS

This the bug, src_offset initialization:

diff --git a/tools/testing/selftests/sgx/load.c b/tools/testing/selftests/sgx/load.c
index 07988de6b767..9d43b75aaa55 100644
--- a/tools/testing/selftests/sgx/load.c
+++ b/tools/testing/selftests/sgx/load.c
@@ -185,7 +185,7 @@ bool encl_load(const char *path, struct encl *encl)
                }
 
                if (j == 0) {
-                       src_offset = (phdr->p_offset & PAGE_MASK) - src_offset;
+                       src_offset = phdr->p_offset & PAGE_MASK;
 
                        seg->prot = PROT_READ | PROT_WRITE;
                        seg->flags = SGX_PAGE_TYPE_TCS << 8;

This was introduced when moving from converting elf to bin to load
directly from elf. In my case 'src_offset' happened to be zero and
I have not thus noticed this before.

/Jarkko