linux-kernel - Re: [PATCH v6 5/8] KVM: arm64: Detect and handle hypervisor stack overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+EHjTxkug-92zR5sr7icry8KWuksAt6PBt95QTjtkYonF7-Ng@mail.gmail.com>
Date:   Tue, 29 Mar 2022 09:51:05 +0100
From:   Fuad Tabba <tabba@...gle.com>
To:     Kalesh Singh <kaleshsingh@...gle.com>
Cc:     will@...nel.org, maz@...nel.org, qperret@...gle.com,
        surenb@...gle.com, kernel-team@...roid.com,
        James Morse <james.morse@....com>,
        Alexandru Elisei <alexandru.elisei@....com>,
        Suzuki K Poulose <suzuki.poulose@....com>,
        Catalin Marinas <catalin.marinas@....com>,
        Mark Rutland <mark.rutland@....com>,
        Mark Brown <broonie@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Peter Collingbourne <pcc@...gle.com>,
        "Madhavan T. Venkataraman" <madvenka@...ux.microsoft.com>,
        Andrew Walbran <qwandor@...gle.com>,
        Andrew Scull <ascull@...gle.com>,
        linux-arm-kernel@...ts.infradead.org, kvmarm@...ts.cs.columbia.edu,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v6 5/8] KVM: arm64: Detect and handle hypervisor stack overflows

Hi Kalesh,


On Mon, Mar 14, 2022 at 8:05 PM Kalesh Singh <kaleshsingh@...gle.com> wrote:
>
> The hypervisor stacks (for both nVHE Hyp mode and nVHE protected mode)
> are aligned such  that any valid stack address has PAGE_SHIFT bit as 1.
> This allows us to conveniently check for overflow in the exception entry
> without corrupting any GPRs. We won't recover from a stack overflow so
> panic the hypervisor.
>
> Signed-off-by: Kalesh Singh <kaleshsingh@...gle.com>

Tested-by: Fuad Tabba <tabba@...gle.com>
Reviewed-by: Fuad Tabba <tabba@...gle.com>

Thanks,
/fuad


> ---
>
> Changes in v5:
>   - Valid stack addresses now have PAGE_SHIFT bit as 1 instead of 0
>
> Changes in v3:
>   - Remove test_sp_overflow macro, per Mark
>   - Add asmlinkage attribute for hyp_panic, hyp_panic_bad_stack, per Ard
>
>
>  arch/arm64/kvm/hyp/nvhe/host.S   | 24 ++++++++++++++++++++++++
>  arch/arm64/kvm/hyp/nvhe/switch.c |  7 ++++++-
>  2 files changed, 30 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm64/kvm/hyp/nvhe/host.S b/arch/arm64/kvm/hyp/nvhe/host.S
> index 3d613e721a75..be6d844279b1 100644
> --- a/arch/arm64/kvm/hyp/nvhe/host.S
> +++ b/arch/arm64/kvm/hyp/nvhe/host.S
> @@ -153,6 +153,18 @@ SYM_FUNC_END(__host_hvc)
>
>  .macro invalid_host_el2_vect
>         .align 7
> +
> +       /*
> +        * Test whether the SP has overflowed, without corrupting a GPR.
> +        * nVHE hypervisor stacks are aligned so that the PAGE_SHIFT bit
> +        * of SP should always be 1.
> +        */
> +       add     sp, sp, x0                      // sp' = sp + x0
> +       sub     x0, sp, x0                      // x0' = sp' - x0 = (sp + x0) - x0 = sp
> +       tbz     x0, #PAGE_SHIFT, .L__hyp_sp_overflow\@
> +       sub     x0, sp, x0                      // x0'' = sp' - x0' = (sp + x0) - sp = x0
> +       sub     sp, sp, x0                      // sp'' = sp' - x0 = (sp + x0) - x0 = sp
> +
>         /* If a guest is loaded, panic out of it. */
>         stp     x0, x1, [sp, #-16]!
>         get_loaded_vcpu x0, x1
> @@ -165,6 +177,18 @@ SYM_FUNC_END(__host_hvc)
>          * been partially clobbered by __host_enter.
>          */
>         b       hyp_panic
> +
> +.L__hyp_sp_overflow\@:
> +       /*
> +        * Reset SP to the top of the stack, to allow handling the hyp_panic.
> +        * This corrupts the stack but is ok, since we won't be attempting
> +        * any unwinding here.
> +        */
> +       ldr_this_cpu    x0, kvm_init_params + NVHE_INIT_STACK_HYP_VA, x1
> +       mov     sp, x0
> +
> +       bl      hyp_panic_bad_stack
> +       ASM_BUG()
>  .endm
>
>  .macro invalid_host_el1_vect
> diff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c
> index 6410d21d8695..703a5d3f611b 100644
> --- a/arch/arm64/kvm/hyp/nvhe/switch.c
> +++ b/arch/arm64/kvm/hyp/nvhe/switch.c
> @@ -347,7 +347,7 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
>         return exit_code;
>  }
>
> -void __noreturn hyp_panic(void)
> +asmlinkage void __noreturn hyp_panic(void)
>  {
>         u64 spsr = read_sysreg_el2(SYS_SPSR);
>         u64 elr = read_sysreg_el2(SYS_ELR);
> @@ -369,6 +369,11 @@ void __noreturn hyp_panic(void)
>         unreachable();
>  }
>
> +asmlinkage void __noreturn hyp_panic_bad_stack(void)
> +{
> +       hyp_panic();
> +}
> +
>  asmlinkage void kvm_unexpected_el2_exception(void)
>  {
>         return __kvm_unexpected_el2_exception();
> --
> 2.35.1.723.g4982287a31-goog
>