linux-kernel - Re: [PATCH RFC v2 03/29] mm: asi: Introduce ASI core API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5aa114f7-3efb-4dab-8579-cb9af4abd3c0@google.com>
Date: Fri, 14 Mar 2025 18:34:32 -0700
From: Junaid Shahid <junaids@...gle.com>
To: Borislav Petkov <bp@...en8.de>, Brendan Jackman <jackmanb@...gle.com>
Cc: akpm@...ux-foundation.org, dave.hansen@...ux.intel.com,
 yosryahmed@...gle.com, kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-mm@...ck.org, peterz@...radead.org, seanjc@...gle.com,
 tglx@...utronix.de, x86@...nel.org
Subject: Re: [PATCH RFC v2 03/29] mm: asi: Introduce ASI core API

On 3/14/25 6:14 AM, Borislav Petkov wrote:
> On Fri, Feb 28, 2025 at 08:43:55AM +0000, Brendan Jackman wrote:
>> (otherwise if we get an NMI between asi_enter() and
>> asi_start_critical(), and that causes a #PF, we will start the
>> critical section in the wrong address space and ASI won't do its job).
>> So, we are somewhat forced to mix up a. and b. from above.
> 
> I don't understand: asi_enter() can be interrupted by an NMI at any random
> point. How is the current, imbalanced interface not vulnerable to this
> scenario?
> 

The reason this isn't a problem with the current asi_enter() is because there 
the equivalent of asi_start_critical() happens _before_ the address space 
switch. That ensures that even if an NMI arrives in the middle of asi_enter(), 
the NMI epilog will switch to the restricted address space and there is no 
window where an NMI (or any other interrupt/exception for that matter) would 
result in going into vmenter with an unrestricted address space.

So
	asi_enter();
	asi_start_critical();
	vmenter();
	asi_end_critical();

is broken as there is a problematic window between asi_enter() and 
asi_start_critical() as Brendan pointed out.

However,
	asi_start_critical();
	asi_enter();
	vmenter();
	asi_end_critical();

would work perfectly fine.

Perhaps that might be the way to refactor the API?

Thanks,
Junaid