linux-kernel - Re: [PATCH v10 08/15] x86/vsyscall: Reorganize the page fault emulation code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3e3d2426-6296-4a61-beae-4e3ff5d60f2c@intel.com>
Date: Tue, 7 Oct 2025 11:48:05 -0700
From: Dave Hansen <dave.hansen@...el.com>
To: "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>,
 "Mehta, Sohil" <sohil.mehta@...el.com>,
 "tglx@...utronix.de" <tglx@...utronix.de>,
 "mingo@...hat.com" <mingo@...hat.com>, "bp@...en8.de" <bp@...en8.de>,
 "x86@...nel.org" <x86@...nel.org>,
 "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>
Cc: "corbet@....net" <corbet@....net>, "ardb@...nel.org" <ardb@...nel.org>,
 "david.laight.linux@...il.com" <david.laight.linux@...il.com>,
 "luto@...nel.org" <luto@...nel.org>,
 "jpoimboe@...nel.org" <jpoimboe@...nel.org>,
 "andrew.cooper3@...rix.com" <andrew.cooper3@...rix.com>,
 "Luck, Tony" <tony.luck@...el.com>,
 "alexander.shishkin@...ux.intel.com" <alexander.shishkin@...ux.intel.com>,
 "kas@...nel.org" <kas@...nel.org>, "seanjc@...gle.com" <seanjc@...gle.com>,
 "rdunlap@...radead.org" <rdunlap@...radead.org>,
 "dwmw@...zon.co.uk" <dwmw@...zon.co.uk>,
 "vegard.nossum@...cle.com" <vegard.nossum@...cle.com>,
 "xin@...or.com" <xin@...or.com>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
 "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
 "kees@...nel.org" <kees@...nel.org>, "hpa@...or.com" <hpa@...or.com>,
 "peterz@...radead.org" <peterz@...radead.org>,
 "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
 "geert@...ux-m68k.org" <geert@...ux-m68k.org>
Subject: Re: [PATCH v10 08/15] x86/vsyscall: Reorganize the page fault
 emulation code

On 10/7/25 11:37, Edgecombe, Rick P wrote:
>>  	/*
>>  	 * No point in checking CS -- the only way to get here is a user mode
>>  	 * trap to a high address, which means that we're in 64-bit user code.
> I don't know. Is this as true any more? We are now sometimes guessing based on
> regs->ip of a #GP. What if the kernel accidentally tries to jump to the vsyscall
> address? Then we are reading the kernel stack and strange things. Maybe it's
> worth replacing the comment with a check? Feel free to call this paranoid.

The first check in emulate_vsyscall() is:

       /* Write faults or kernel-privilege faults never get fixed up. */
       if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
               return false;

If the kernel jumped to the vsyscall page, it would end up there, return
false, and never reach the code near the "No point in checking CS" comment.

Right? Or am I misunderstanding the scenario you're calling out?

If I'm understanding it right, I'd be a bit reluctant to add a CS check
as well.