linux-kernel - [PATCH v6 31/33] x86/fred: BUG() when ERETU with %rsp not equal to that when the ring 3 event was just delivered

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230327075838.5403-32-xin3.li@intel.com>
Date:   Mon, 27 Mar 2023 00:58:36 -0700
From:   Xin Li <xin3.li@...el.com>
To:     linux-kernel@...r.kernel.org, x86@...nel.org, kvm@...r.kernel.org
Cc:     tglx@...utronix.de, mingo@...hat.com, bp@...en8.de,
        dave.hansen@...ux.intel.com, hpa@...or.com, peterz@...radead.org,
        andrew.cooper3@...rix.com, seanjc@...gle.com, pbonzini@...hat.com,
        ravi.v.shankar@...el.com, jiangshanlai@...il.com,
        shan.kang@...el.com
Subject: [PATCH v6 31/33] x86/fred: BUG() when ERETU with %rsp not equal to that when the ring 3 event was just delivered

A FRED stack frame generated by a ring 3 event should never be messed up, and
the first thing we must make sure is that at the time an ERETU instruction is
executed, %rsp must have the same address as that when the user level event
was just delivered.

However we don't want to bother the normal code path of ERETU because it's on
the hotest code path, a good choice is to do this check when ERETU faults.

Suggested-by: H. Peter Anvin (Intel) <hpa@...or.com>
Tested-by: Shan Kang <shan.kang@...el.com>
Signed-off-by: Xin Li <xin3.li@...el.com>
---
 arch/x86/mm/extable.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index a5d75b27a993..bf8005558935 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -204,6 +204,14 @@ static bool ex_handler_eretu(const struct exception_table_entry *fixup,
 	unsigned short ss = uregs->ss;
 	unsigned short cs = uregs->cs;
 
+	/*
+	 * A FRED stack frame generated by a ring 3 event should never be
+	 * messed up, and the first thing we must make sure is that at the
+	 * time an ERETU instruction is executed, %rsp must have the same
+	 * address as that when the user level event was just delivered.
+	 */
+	BUG_ON(uregs != current->thread_info.user_pt_regs);
+
 	/*
 	 * Move the NMI bit from the invalid stack frame, which caused ERETU
 	 * to fault, to the fault handler's stack frame, thus to unblock NMI
-- 
2.34.1