linux-kernel - Re: [PATCH v7 20/36] function_graph: Improve push operation for several interrupts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 18 Feb 2024 00:53:59 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: Alexei Starovoitov <alexei.starovoitov@...il.com>, Florent Revest
 <revest@...omium.org>, linux-trace-kernel@...r.kernel.org, LKML
 <linux-kernel@...r.kernel.org>, Martin KaFai Lau <martin.lau@...ux.dev>,
 bpf <bpf@...r.kernel.org>, Sven Schnelle <svens@...ux.ibm.com>, Alexei
 Starovoitov <ast@...nel.org>, Jiri Olsa <jolsa@...nel.org>, Arnaldo
 Carvalho de Melo <acme@...nel.org>, Daniel Borkmann <daniel@...earbox.net>,
 Alan Maguire <alan.maguire@...cle.com>, Mark Rutland
 <mark.rutland@....com>, Peter Zijlstra <peterz@...radead.org>, Thomas
 Gleixner <tglx@...utronix.de>, Guo Ren <guoren@...nel.org>
Subject: Re: [PATCH v7 20/36] function_graph: Improve push operation for
 several interrupts

On Thu, 15 Feb 2024 09:57:39 -0500
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Wed,  7 Feb 2024 00:11:12 +0900
> "Masami Hiramatsu (Google)" <mhiramat@...nel.org> wrote:
> 
> > From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
> > 
> > Improve push and data reserve operation on the shadow stack for
> > several sequencial interrupts.
> > 
> > To push a ret_stack or data entry on the shadow stack, we need to
> > prepare an index (offset) entry before updating the stack pointer
> > (curr_ret_stack) so that unwinder from interrupts can find the
> > next return address from the shadow stack. Currently we do write index,
> > update the curr_ret_stack, and rewrite it again. But that is not enough
> > for the case if two interrupts happens and the first one breaks it.
> > For example,
> > 
> >  1. write reserved index entry at ret_stack[new_index - 1] and ret addr.
> >  2. interrupt comes.
> >     2.1. push new index and ret addr on ret_stack.
> >     2.2. pop it. (corrupt entries on new_index - 1)
> >  3. return from interrupt.
> >  4. update curr_ret_stack = new_index
> >  5. interrupt comes again.
> >     5.1. unwind <------ may not work.
> 
> I'm curious if you saw this happen?
> 
> That is, did you trigger this or only noticed it by inspection?

I just noticed this scenario while explaining why we write the same value
twice to Jiri.

https://lore.kernel.org/all/20231220004540.0af568c69ecaf9170430a383@kernel.org/

> 
> This code is already quite complex, I would like to simplify it more before
> we try to fix rare race conditions that only affect the unwinder.
> 
> Let's hold off on this change.

OK, then drop this until someone hits the actual problem, maybe that
should be rare case.

Thank you,

> 
> -- Steve
> 
> 
> > 
> > To avoid this issue, this introduces a new rsrv_ret_stack stack
> > reservation pointer and a new push code (slow path) to commit
> > previous reserved code forcibly.
> > 
> >  0. update rsrv_ret_stack = new_index.
> >  1. write reserved index entry at ret_stack[new_index - 1] and ret addr.
> >  2. interrupt comes.
> >     2.0. if rsrv_ret_stack != curr_ret_stack, add reserved index
> >         entry on ret_stack[rsrv_ret_stack - 1] to point the previous
> > 	ret_stack pointed by ret_stack[curr_ret_stack - 1]. and
> > 	update curr_ret_stack = rsrv_ret_stack.
> >     2.1. push new index and ret addr on ret_stack.
> >     2.2. pop it. (corrupt entries on new_index - 1)
> >  3. return from interrupt.
> >  4. update curr_ret_stack = new_index
> >  5. interrupt comes again.
> >     5.1. unwind works, because curr_ret_stack points the previously
> >         saved ret_stack.
> >     5.2. this can do push/pop operations too.
> > 6. return from interrupt.
> > 7. rewrite reserved index entry at ret_stack[new_index] again.
> > 
> > This maybe a bit heavier but safer.
> > 
> > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>


-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>