linux-kernel - Re: [PATCH] x86: fix user address masking non-canonical speculation issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dak3d3rnzx5o6faogq3awougwateiwkf7a7o6el3iiwlghjxgf@dn2dxxg4ttfb>
Date: Fri, 25 Oct 2024 16:15:56 +0200
From: Maciej Wieczor-Retman <maciej.wieczor-retman@...el.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>
CC: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	<x86@...nel.org>, Andrew Cooper <andrew.cooper3@...rix.com>, Josh Poimboeuf
	<jpoimboe@...nel.org>, Borislav Petkov <bp@...en8.de>
Subject: Re: [PATCH] x86: fix user address masking non-canonical speculation
 issue

Hello!

On 2024-10-23 at 18:31:59 -0700, Linus Torvalds wrote:
> ...
> 	if (IS_ENABLED(CONFIG_X86_64)) {
>+		unsigned long USER_PTR_MAX = TASK_SIZE_MAX;
>+
>+		/*
>+		 * Enable this when LAM is gated on LASS support
>+		if (cpu_feature_enabled(X86_FEATURE_LAM))
>+			USER_PTR_MAX = (1ul << 63) - PAGE_SIZE;
>+		 */
>+		runtime_const_init(ptr, USER_PTR_MAX);
> ...

I tested the patch on a Sierra Forest Xeon that is LAM capable and I didn't find
any issues.

To test the LAM related portion I uncommented the above if statement
and enabled LAM_SUP during the boot process as well as enabled LAM for the user
process with a syscall.

I did the tests by writing a ioctl that calls get_user() on demand and prints
whatever the user passes. Then before calling the ioctl I modified the pointer
to the variable in a few different ways:

- 5 level pointer on 4 level system
[root@...1 ~]# ./test_get_user
[  603.531778] Running get_user on address : 0xff007ffdfce791bc
[  603.538225] Value received from user is : 0
Enabling LAM...
LAM enable syscall ret = 0, errno = 0
Int pointer before tagging : 0x7ffdfce791bc
Int pointer after tagging : 0xff007ffdfce791bc
IOCTL ret : -1, errno : 14

- Cleared top bit
[root@...1 ~]# ./test_get_user
[  625.543365] Running get_user on address : 0x7fffffff4ddb3d4c
[  625.549828] Value received from user is : 0
Enabling LAM...
LAM enable syscall ret = 0, errno =  0
Int pointer before tagging : 0x7fff4ddb3d4c
Int pointer after tagging : 0x7fffffff4ddb3d4c
IOCTL ret : -1, errno : 14

- Cleared bit 48
[root@...1 ~]# ./test_get_user
[  686.801259] Running get_user on address : 0xffff7ffcdc2691ac
[  686.807724] Value received from user is : 0
Enabling LAM...
LAM enable syscall ret = 0, errno =  0
Int pointer before tagging : 0x7ffcdc2691ac
Int pointer after tagging : 0xffff7ffcdc2691ac
IOCTL ret : -1, errno : 14

- Normal kernel address
[root@...1 ~]# ./test_get_user
[ 1047.074342] Running get_user on address : 0xffffffff17bfed1c
[ 1047.080801] Value received from user is : 0
Enabling LAM...
LAM enable syscall ret = 0, errno =  0
Int pointer before tagging : 0x7fff17bfed1c
Int pointer after tagging : 0xffffffff17bfed1c
IOCTL ret : -1, errno : 14

- Control group with properly tagged pointer
[root@...1 ~]# ./test_get_user
[  767.464666] Running get_user on address : 0x7a007ffe6c9dac3c
[  767.472644] Value received from user is : 12345
Enabling LAM...
LAM enable syscall ret = 0, errno =  0
Int pointer before tagging : 0x7ffe6c9dac3c
Int pointer after tagging : 0x7a007ffe6c9dac3c
IOCTL ret : 0, errno : 0

Tested-by: Maciej Wieczor-Retman <maciej.wieczor-retman@...el.com>

-- 
Kind regards
Maciej Wieczór-Retman