linux-kernel - [PATCH] x86/vsyscall: Do not require X86_PF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250624145918.2720487-1-kirill.shutemov@linux.intel.com>
Date: Tue, 24 Jun 2025 17:59:18 +0300
From: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
To: dave.hansen@...el.com
Cc: acme@...hat.com,
	aik@....com,
	akpm@...ux-foundation.org,
	alexander.shishkin@...ux.intel.com,
	andrew.cooper3@...rix.com,
	ardb@...nel.org,
	ast@...nel.org,
	bp@...en8.de,
	brijesh.singh@....com,
	changbin.du@...wei.com,
	christophe.leroy@...roup.eu,
	corbet@....net,
	daniel.sneddon@...ux.intel.com,
	dave.hansen@...ux.intel.com,
	ebiggers@...gle.com,
	geert+renesas@...der.be,
	houtao1@...wei.com,
	hpa@...or.com,
	jgg@...pe.ca,
	jgross@...e.com,
	jpoimboe@...nel.org,
	kai.huang@...el.com,
	kees@...nel.org,
	kirill.shutemov@...ux.intel.com,
	leitao@...ian.org,
	linux-doc@...r.kernel.org,
	linux-efi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	linux-mm@...ck.org,
	linux@...musvillemoes.dk,
	luto@...nel.org,
	mcgrof@...nel.org,
	mhiramat@...nel.org,
	michael.roth@....com,
	mingo@...nel.org,
	mingo@...hat.com,
	namhyung@...nel.org,
	paulmck@...nel.org,
	pawan.kumar.gupta@...ux.intel.com,
	peterz@...radead.org,
	rick.p.edgecombe@...el.com,
	rppt@...nel.org,
	sandipan.das@....com,
	shijie@...amperecomputing.com,
	sohil.mehta@...el.com,
	tglx@...utronix.de,
	tj@...nel.org,
	tony.luck@...el.com,
	vegard.nossum@...cle.com,
	x86@...nel.org,
	xin3.li@...el.com,
	xiongwei.song@...driver.com,
	ytcoode@...il.com
Subject: [PATCH] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall

emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
page fault, but the CPU does not report X86_PF_INSTR if neither
X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.

X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
early P4 processors that did not support this feature.

Instead of explicitly checking for X86_PF_INSTR, compare the fault
address to RIP.

On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
to fault address but X86_PF_INSTR is absent.

Originally-by: Dave Hansen <dave.hansen@...el.com>
Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
Reported-by: Andrew Cooper <andrew.cooper3@...rix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@...rix.com>
---
 arch/x86/entry/vsyscall/vsyscall_64.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index c9103a6fa06e..0b0e0283994f 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -124,7 +124,8 @@ bool emulate_vsyscall(unsigned long error_code,
 	if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
 		return false;
 
-	if (!(error_code & X86_PF_INSTR)) {
+	/* Avoid emulation unless userspace was executing from vsyscall page: */
+	if (address != regs->ip) {
 		/* Failed vsyscall read */
 		if (vsyscall_mode == EMULATE)
 			return false;
@@ -136,13 +137,16 @@ bool emulate_vsyscall(unsigned long error_code,
 		return false;
 	}
 
+
+	/* X86_PF_INSTR is only set when NX is supported: */
+	if (cpu_feature_enabled(X86_FEATURE_NX))
+		WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
+
 	/*
 	 * No point in checking CS -- the only way to get here is a user mode
 	 * trap to a high address, which means that we're in 64-bit user code.
 	 */
 
-	WARN_ON_ONCE(address != regs->ip);
-
 	if (vsyscall_mode == NONE) {
 		warn_bad_vsyscall(KERN_INFO, regs,
 				  "vsyscall attempted with vsyscall=none");
-- 
2.47.2