linux-kernel - Re: [PATCHv2] x86/mm: Fix VDSO and VVAR placement on 5-level paging machines

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1b847f492924a4ae3172fe83c1e259e6a2869149.camel@intel.com>
Date:   Sat, 5 Aug 2023 00:13:19 +0000
From:   "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
To:     "kirill.shutemov@...ux.intel.com" <kirill.shutemov@...ux.intel.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "Hansen, Dave" <dave.hansen@...el.com>,
        "bp@...en8.de" <bp@...en8.de>
CC:     "Wu, Yingcong" <yingcong.wu@...el.com>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>
Subject: Re: [PATCHv2] x86/mm: Fix VDSO and VVAR placement on 5-level paging
 machines

On Thu, 2023-08-03 at 18:16 +0300, Kirill A. Shutemov wrote:
> Yingcong has noticed that on the 5-level paging machine, VDSO and
> VVAR
> VMAs are placed above the 47-bit border:
> 
> 8000001a9000-8000001ad000 r--p 00000000 00:00
> 0                          [vvar]
> 8000001ad000-8000001af000 r-xp 00000000 00:00
> 0                          [vdso]
> 
> This might confuse users who are not aware of 5-level paging and
> expect
> all userspace addresses to be under the 47-bit border.
> 
> So far problem has only been triggered with ASLR disabled, although
> it
> may also occur with ASLR enabled if the layout is randomized in a
> just
> right way.
> 
> The problem happens due to custom placement for the VMAs in the VDSO
> code: vdso_addr() tries to place them above the stack and checks the
> result against TASK_SIZE_MAX, which is wrong. TASK_SIZE_MAX is set to
> the 56-bit border on 5-level paging machines. Use DEFAULT_MAP_WINDOW
> instead.
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
> Reported-by: Yingcong Wu <yingcong.wu@...el.com>
> Fixes: b569bab78d8d ("x86/mm: Prepare to expose larger address space
> to userspace")

Reviewed-by: Rick Edgecombe <rick.p.edgecombe@...el.com>