linux-kernel - [PATCH 0/3] x86/kasan: Populate shadow for read-only IDT mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri,  4 Nov 2022 18:32:44 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Andrey Ryabinin <ryabinin.a.a@...il.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        x86@...nel.org
Cc:     Alexander Potapenko <glider@...gle.com>,
        Andrey Konovalov <andreyknvl@...il.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Vincenzo Frascino <vincenzo.frascino@....com>,
        "H. Peter Anvin" <hpa@...or.com>, kasan-dev@...glegroups.com,
        linux-kernel@...r.kernel.org,
        Sean Christopherson <seanjc@...gle.com>,
        syzbot+8cdd16fd5a6c0565e227@...kaller.appspotmail.com
Subject: [PATCH 0/3] x86/kasan: Populate shadow for read-only IDT mapping

Fix a regression introduced by mapping shadows for the per-cpu portions of
the CPU entry area on-demand.  The read-only IDT mapping is also shoved
into the CPU entry area, but since it's shared, no CPU creates a shadow
for it.  KVM on Intel does an IDT lookup in software when handling host
IRQs that arrived in the guest, which results in KASAN dereferencing an
unmapped shadow.

The first two patches are cleanups to make the fix (and code in general)
less ugly.

Side topic, KASAN should really decide whether it wants to use "void *"
or "unsigned long", e.g. kasan_populate_shadow() takes "unsigned long" but
kasan_populate_early_shadow() takes "void *".  And the amount of casting
throughout the code is bonkers.

Sean Christopherson (3):
  x86/kasan: Rename local CPU_ENTRY_AREA variables to shorten names
  x86/kasan: Add helpers to align shadow addresses up and down
  x86/kasan: Populate shadow for shared chunk of the CPU entry area

 arch/x86/mm/kasan_init_64.c | 50 ++++++++++++++++++++++++-------------
 1 file changed, 32 insertions(+), 18 deletions(-)

base-commit: 3301badde43dee7c2a013fbd6479c258366519da
-- 
2.38.1.431.g37b22c650d-goog