linux-kernel - [PATCH] x86/entry: fix AC assertion when !CONFIG_X86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  4 Oct 2021 00:34:23 +0200
From:   Vegard Nossum <vegard.nossum@...cle.com>
To:     x86@...nel.org, Peter Zijlstra <peterz@...radead.org>,
        Andy Lutomirski <luto@...nel.org>
Cc:     linux-kernel@...r.kernel.org,
        Vegard Nossum <vegard.nossum@...cle.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Daniel Thompson <daniel.thompson@...aro.org>,
        stable@...r.kernel.org
Subject: [PATCH] x86/entry: fix AC assertion when !CONFIG_X86_SMAP

Commit 3c73b81a9164 ("x86/entry, selftests: Further improve user entry
sanity checks") added a warning if AC is set when in the kernel.

Commit 662a0221893a3d ("x86/entry: Fix AC assertion") changed the warning
to only fire if the CPU supports SMAP.

However, the warning can still trigger on a machine that supports SMAP but
where it's disabled in the kernel config:

    [   T49] ------------[ cut here ]------------
    [   T49] WARNING: CPU: 0 PID: 49 at irqentry_enter_from_user_mode+0x88/0xc0
    [   T49] CPU: 0 PID: 49 Comm: init Tainted: G                T 5.15.0-rc4+ #98 e6202628ee053b4f310759978284bd8bb0ce6905
    [   T49] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
    [   T49] RIP: 0010:irqentry_enter_from_user_mode+0x88/0xc0
    [   T49] Code: eb 11 eb 03 90 90 c3 bf 01 00 00 00 e8 91 02 00 00 eb f1 eb 06 90 0f 0b 90 eb e7 65 8b 05 d8 22 b3 7e 83 f8 01 75 ee eb d9 90 <0f> 0b 90 f6 87 88 00 00 00 03 75 9b 90 0f 0b 90 eb 95 90 0f 0b 90
    [   T49] RSP: 0000:ffff888004267eb0 EFLAGS: 00050006
    [   T49] RAX: 0000000000044400 RBX: 0000000000000000 RCX: 0000000000000000
    [   T49] RDX: 0000000000040006 RSI: 0000000000000008 RDI: ffff888004267f58
    [   T49] RBP: ffff888004267f58 R08: ffff888004267f58 R09: 0000000000000000
    [   T49] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff81600a15
    [   T49] R13: 0000000000000000 R14: 0000000000000008 R15: 0000000000000000
    [   T49] FS:  0000000000800000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
    [   T49] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   T49] CR2: 00000000414bd008 CR3: 000000000426e003 CR4: 00000000001706f0
    [   T49] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [   T49] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    [   T49] Call Trace:
    [   T49]  ? irqentry_enter+0x27/0x40
    [   T49]  ? exc_general_protection+0x2b/0x2c0
    [   T49]  ? asm_exc_general_protection+0x5/0x20
    [   T49]  ? asm_exc_general_protection+0x1b/0x20
    [   T49] ---[ end trace 9345e3548045cf79 ]---

We could add IS_ENABLED(CONFIG_X86_SMAP) to the warning condition, but
even this would not be enough in case SMAP is disabled at boot time with
the "nosmap" parameter.

To be consistent with "nosmap" behaviour, let's clear X86_FEATURE_SMAP
when !CONFIG_X86_SMAP.

I'm not sure if we should clear X86_CR4_SMAP when !CONFIG_X86_SMAP --
that's what the code currently does, so I've preserved that behaviour,
even though it seems a bit odd.

Found using entry-fuzz + satrandconfig.

Fixes: 3c73b81a9164 ("x86/entry, selftests: Further improve user entry sanity checks")
Fixes: 662a0221893a ("x86/entry: Fix AC assertion")
Cc: Peter Zijlstra (Intel) <peterz@...radead.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Daniel Thompson <daniel.thompson@...aro.org>
Cc: Andy Lutomirski <luto@...nel.org>
Cc: stable@...r.kernel.org
Signed-off-by: Vegard Nossum <vegard.nossum@...cle.com>
---
 arch/x86/kernel/cpu/common.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 0f8885949e8c4..b3410f1ac2175 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -326,6 +326,7 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
 #ifdef CONFIG_X86_SMAP
 		cr4_set_bits(X86_CR4_SMAP);
 #else
+		clear_cpu_cap(c, X86_FEATURE_SMAP);
 		cr4_clear_bits(X86_CR4_SMAP);
 #endif
 	}
-- 
2.23.0.718.g5ad94255a8