linux-kernel - Re: [PATCH 09/14] x86/ibt: Implement IBT+

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240930082314.GE5594@noisy.programming.kicks-ass.net>
Date: Mon, 30 Sep 2024 10:23:14 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc: X86 ML <x86@...nel.org>, LKML <linux-kernel@...r.kernel.org>,
	alyssa.milburn@...el.com, scott.d.constable@...el.com,
	Joao Moreira <joao@...rdrivepizza.com>,
	Andrew Cooper <andrew.cooper3@...rix.com>,
	Josh Poimboeuf <jpoimboe@...nel.org>,
	"Jose E. Marchesi" <jose.marchesi@...cle.com>,
	"H.J. Lu" <hjl.tools@...il.com>,
	Nick Desaulniers <ndesaulniers@...gle.com>,
	Sami Tolvanen <samitolvanen@...gle.com>,
	Nathan Chancellor <nathan@...nel.org>, ojeda@...nel.org,
	Kees Cook <kees@...nel.org>
Subject: Re: [PATCH 09/14] x86/ibt: Implement IBT+

On Sun, Sep 29, 2024 at 10:38:58AM -0700, Alexei Starovoitov wrote:
> On Fri, Sep 27, 2024 at 12:50 PM Peter Zijlstra <peterz@...radead.org> wrote:
> >
> > --- a/arch/x86/net/bpf_jit_comp.c
> > +++ b/arch/x86/net/bpf_jit_comp.c
> > @@ -555,6 +555,8 @@ static int emit_patch(u8 **pprog, void *
> >
> >  static int emit_call(u8 **pprog, void *func, void *ip)
> >  {
> > +       if (is_endbr(func))
> > +               func += ENDBR_INSN_SIZE;
> >         return emit_patch(pprog, func, ip, 0xE8);
> >  }
> >
> > @@ -562,11 +564,13 @@ static int emit_rsb_call(u8 **pprog, voi
> >  {
> >         OPTIMIZER_HIDE_VAR(func);
> >         ip += x86_call_depth_emit_accounting(pprog, func, ip);
> > -       return emit_patch(pprog, func, ip, 0xE8);
> > +       return emit_call(pprog, func, ip);
> >  }
> >
> >  static int emit_jump(u8 **pprog, void *func, void *ip)
> >  {
> > +       if (is_endbr(func))
> > +               func += ENDBR_INSN_SIZE;
> >         return emit_patch(pprog, func, ip, 0xE9);
> >  }
> 
> Makes sense, but it feels like it's fixing the existing bug
> that we somehow didn't notice earlier?

Before all this func()+0 was a valid call address -- as it's been
forever.

While it is true that with the introduction of ENDBR some compilers will
do direct calls to func()+4 to avoid the ENDBR (less instructions, more
faster etc..) this was very much an optional thing.

Notably, up until this point we would use a 4 byte NOP to seal(*)
functions, specifically so that anybody doing direct calls to func()+0
would continue to work.

These patches however change all that by sealing with a 4 byte UD1
instruction, which makes direct calls to func()+0 fatal. As such, we
must guarantee all direct calls are to func()+4. So what used to be an
optimization is now a strict requirement.

Indirect calls still go to func()+0 (or func()-16 for FineIBT) and will
go *bang* if !ENDBR or UD1 (depending on the hardware having CET/IBT
support).

(*) with sealing we mean the explicit action of disallowing indirect
calls to a given function.