linux-kernel - Re: [PATCH v20 21/25] x86/cet/shstk: Handle signals for shadow stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202102101805.0B98ACA743@keescook>
Date:   Wed, 10 Feb 2021 18:05:48 -0800
From:   Kees Cook <keescook@...omium.org>
To:     "Yu, Yu-cheng" <yu-cheng.yu@...el.com>
Cc:     x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
        linux-doc@...r.kernel.org, linux-mm@...ck.org,
        linux-arch@...r.kernel.org, linux-api@...r.kernel.org,
        Arnd Bergmann <arnd@...db.de>,
        Andy Lutomirski <luto@...nel.org>,
        Balbir Singh <bsingharora@...il.com>,
        Borislav Petkov <bp@...en8.de>,
        Cyrill Gorcunov <gorcunov@...il.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Eugene Syromiatnikov <esyr@...hat.com>,
        Florian Weimer <fweimer@...hat.com>,
        "H.J. Lu" <hjl.tools@...il.com>, Jann Horn <jannh@...gle.com>,
        Jonathan Corbet <corbet@....net>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        Nadav Amit <nadav.amit@...il.com>,
        Oleg Nesterov <oleg@...hat.com>, Pavel Machek <pavel@....cz>,
        Peter Zijlstra <peterz@...radead.org>,
        Randy Dunlap <rdunlap@...radead.org>,
        "Ravi V. Shankar" <ravi.v.shankar@...el.com>,
        Vedvyas Shanbhogue <vedvyas.shanbhogue@...el.com>,
        Dave Martin <Dave.Martin@....com>,
        Weijiang Yang <weijiang.yang@...el.com>,
        Pengfei Xu <pengfei.xu@...el.com>, haitao.huang@...el.com
Subject: Re: [PATCH v20 21/25] x86/cet/shstk: Handle signals for shadow stack

On Wed, Feb 10, 2021 at 01:38:10PM -0800, Yu, Yu-cheng wrote:
> On 2/10/2021 11:58 AM, Kees Cook wrote:
> > On Wed, Feb 10, 2021 at 09:56:59AM -0800, Yu-cheng Yu wrote:
> > > To deliver a signal, create a shadow stack restore token and put the token
> > > and the signal restorer address on the shadow stack.  For sigreturn, verify
> > > the token and restore from it the shadow stack pointer.
> > > 
> > > A shadow stack restore token marks a restore point of the shadow stack.
> > > The token is distinctively different from any shadow stack address.
> > 
> > How is it different? It seems like it just has the last 2 bits
> > masked/set?
> > 
> 
> For example, for 64-bit apps,
> 
> A shadow stack pointer value (*ssp) has to be in some code area, but for a
> token, (*ptr_of_token) = (ptr_of_token + 8), which has to be within the same
> shadow stack area.  In cet_verify_rstor_token(), this is checked.
> 
> > > In sigreturn, restoring from a token ensures the target address is the
> > > location pointed by the token.
> > 
> > As in, a token (real stack address with 2-bit mask) is checked against
> > the real stack address? I don't see a comparison -- it only checks that
> > it is < TASK_SIZE.
> > 
> > How does cet_restore_signal() figure into this? (As in, the MSR writes?)
> > 
> 
> The kernel takes the restore address from the token.  It will not mistakenly
> take a wrong address from the shadow stack.  I will put this in my commit
> logs.

Ah-ha, okay, got it now. Thank you!

Reviewed-by: Kees Cook <keescook@...omium.org>

-- 
Kees Cook