Message ID | 20230613001108.3040476-23-rick.p.edgecombe@intel.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp223260vqr; Mon, 12 Jun 2023 17:47:18 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6agxEFQy4DmujcLmJt3o+9oIzU2dDIPlfDoFI4qNCYNZ6PG5gd7DNVvLohRYjyGiPwjDjl X-Received: by 2002:a17:907:6d98:b0:973:d8c4:a4df with SMTP id sb24-20020a1709076d9800b00973d8c4a4dfmr11233721ejc.52.1686617238231; Mon, 12 Jun 2023 17:47:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686617238; cv=none; d=google.com; s=arc-20160816; b=g6quNRhEV9i+FYUv41E1GnpBAwXyzJCvC6PGzIlNXRdfnWLI7zzNunDOoP/VjJNTcW rrj45AAdmY1OYQ5/6GELsFUW1U/bHKkxciPPPeoliKg5i6KUosHjsrEhogLWYpgYfWun Z7tVFfXqd328AN8U7tEScXgapDhaosv1tqsXSuVeieLsCIrsJyEemXbIowgfSHRwaqJx X0uEPQTeqgOoPolpU9ZXqRvPfyYB9tsRXdkwwDITRkhAJsfGsDxkjdF0ZMCDWhsXaNG/ TSF/kaF2mhR7U6X4TLBCSeDv6Zqhrat8rfgxv2BTt1gjLo46peSFA+1DunL9Db9EChWJ 3DKw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=OTL6GqoGz5oweSC99z4UnMl2uF9TwgX18y0erkZrvzI=; b=Z1OE6dbvxd6uFTxzQcyGKsnfAguX9yeJxBdZxDWenosYVSWDuW9TSWD+iB8YnTjlZi OMVdrKizDpZLY08xvhIZgpuqDyw0u5Ha2rlMGN8DTEuqDGB0NjtmP6pDx4FxY0Co+mFr fITODEBwXIF5z4BAwaxwyeN0M/cJsBkhqF2ycUkMNZDx45d+JzWwG8bCE9355s/fW817 ECreN9wITwZtQt0lTiuZi53RnbRV2emBFyFjU0wD4xQbA3TQY6tGPUzphnBHP6aje4a/ v/BTWbC5OIUX/KVoxpQZnRt9ktxAiak0Ds5yOVBBX35ICOVLTw7LnmH35ibda8+GCNcs 9ouA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=VUA03PHE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id l4-20020a170906644400b0094f442c8a6dsi3305360ejn.291.2023.06.12.17.46.52; Mon, 12 Jun 2023 17:47:18 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=VUA03PHE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238920AbjFMAP5 (ORCPT <rfc822;rust.linux@gmail.com> + 99 others); Mon, 12 Jun 2023 20:15:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53202 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238630AbjFMAPO (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Mon, 12 Jun 2023 20:15:14 -0400 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 236E81FE5; Mon, 12 Jun 2023 17:12:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1686615179; x=1718151179; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=nq8FP2aUY00edE8aipvtg7A+Bog2Zlh3+3MlR+vKuX8=; b=VUA03PHEsKf7BGSuEYVz5E8l/PobAViMN6h/hju3XYNwYiRTtNZCV5AC x3LNNCJ13NUScqLV9UND5F2QFHvBf2/0O77HQrsBq7NF83s1B7jzlviKA G7yIGHLE/rXXSvj46HeXcd0JTRv8xmdNR8Rlq3md4QHaj3n0aFnzAzm+Y tgBDIPCs45SkOkTewLEkJHWRKWJU1nAY746E6y2ff/x46bFujzHEknfoh KdVA4n3jA1bkInpanNHtTZodo6mB1SrouubvfrLEArDgRgSMMpzX7MRAt aWp3omlLb1hLmZEf+7Eg7Qu4SfPLZP4rvp0FYOxggwz1OQp8jozOGkCJu g==; X-IronPort-AV: E=McAfee;i="6600,9927,10739"; a="361557169" X-IronPort-AV: E=Sophos;i="6.00,238,1681196400"; d="scan'208";a="361557169" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jun 2023 17:12:27 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10739"; a="835671056" X-IronPort-AV: E=Sophos;i="6.00,238,1681196400"; d="scan'208";a="835671056" Received: from almeisch-mobl1.amr.corp.intel.com (HELO rpedgeco-desk4.amr.corp.intel.com) ([10.209.42.242]) by orsmga004-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jun 2023 17:12:26 -0700 From: Rick Edgecombe <rick.p.edgecombe@intel.com> To: x86@kernel.org, "H . Peter Anvin" <hpa@zytor.com>, Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>, Andy Lutomirski <luto@kernel.org>, Balbir Singh <bsingharora@gmail.com>, Borislav Petkov <bp@alien8.de>, Cyrill Gorcunov <gorcunov@gmail.com>, Dave Hansen <dave.hansen@linux.intel.com>, Eugene Syromiatnikov <esyr@redhat.com>, Florian Weimer <fweimer@redhat.com>, "H . J . Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>, Jonathan Corbet <corbet@lwn.net>, Kees Cook <keescook@chromium.org>, Mike Kravetz <mike.kravetz@oracle.com>, Nadav Amit <nadav.amit@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>, Peter Zijlstra <peterz@infradead.org>, Randy Dunlap <rdunlap@infradead.org>, Weijiang Yang <weijiang.yang@intel.com>, "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>, John Allen <john.allen@amd.com>, kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com, szabolcs.nagy@arm.com, torvalds@linux-foundation.org, broonie@kernel.org Cc: rick.p.edgecombe@intel.com, Pengfei Xu <pengfei.xu@intel.com> Subject: [PATCH v9 22/42] mm: Don't allow write GUPs to shadow stack memory Date: Mon, 12 Jun 2023 17:10:48 -0700 Message-Id: <20230613001108.3040476-23-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230613001108.3040476-1-rick.p.edgecombe@intel.com> References: <20230613001108.3040476-1-rick.p.edgecombe@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768546357127373050?= X-GMAIL-MSGID: =?utf-8?q?1768546357127373050?= |
Series |
Shadow stacks for userspace
|
|
Commit Message
Edgecombe, Rick P
June 13, 2023, 12:10 a.m. UTC
The x86 Control-flow Enforcement Technology (CET) feature includes a new type of memory called shadow stack. This shadow stack memory has some unusual properties, which requires some core mm changes to function properly. In userspace, shadow stack memory is writable only in very specific, controlled ways. However, since userspace can, even in the limited ways, modify shadow stack contents, the kernel treats it as writable memory. As a result, without additional work there would remain many ways for userspace to trigger the kernel to write arbitrary data to shadow stacks via get_user_pages(, FOLL_WRITE) based operations. To help userspace protect their shadow stacks, make this a little less exposed by blocking writable get_user_pages() operations for shadow stack VMAs. Still allow FOLL_FORCE to write through shadow stack protections, as it does for read-only protections. This is required for debugging use cases. Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com> Reviewed-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Mike Rapoport (IBM) <rppt@kernel.org> Acked-by: David Hildenbrand <david@redhat.com> Tested-by: Pengfei Xu <pengfei.xu@intel.com> Tested-by: John Allen <john.allen@amd.com> Tested-by: Kees Cook <keescook@chromium.org> --- arch/x86/include/asm/pgtable.h | 5 +++++ mm/gup.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h index 5383f7282f89..fce35f5d4a4e 100644 --- a/arch/x86/include/asm/pgtable.h +++ b/arch/x86/include/asm/pgtable.h @@ -1630,6 +1630,11 @@ static inline bool __pte_access_permitted(unsigned long pteval, bool write) { unsigned long need_pte_bits = _PAGE_PRESENT|_PAGE_USER; + /* + * Write=0,Dirty=1 PTEs are shadow stack, which the kernel + * shouldn't generally allow access to, but since they + * are already Write=0, the below logic covers both cases. + */ if (write) need_pte_bits |= _PAGE_RW; diff --git a/mm/gup.c b/mm/gup.c index bbe416236593..cc0dd5267509 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -978,7 +978,7 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) return -EFAULT; if (write) { - if (!(vm_flags & VM_WRITE)) { + if (!(vm_flags & VM_WRITE) || (vm_flags & VM_SHADOW_STACK)) { if (!(gup_flags & FOLL_FORCE)) return -EFAULT; /* hugetlb does not support FOLL_FORCE|FOLL_WRITE. */