From patchwork Tue Jun 13 00:10:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 106992 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp223251vqr; Mon, 12 Jun 2023 17:47:18 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4jj9H/QGeS88L+jLvSFINii+othT+RPFdz7qBwA0v6uYQJp4FtBwIA7rJdz5TZFebEaJ9I X-Received: by 2002:a17:907:3687:b0:974:4f34:b04a with SMTP id bi7-20020a170907368700b009744f34b04amr10804749ejc.34.1686617238023; Mon, 12 Jun 2023 17:47:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686617238; cv=none; d=google.com; s=arc-20160816; b=vMZ62v1S4EnLOg0sInGXdPx6FnsfZRF+tmgoJqqpiGhKirAht34yP6opwKhvFrNeHI zPDvipdX3rAJ1fQ4lxhPpkJKTSm/YJ9bi1RAJ+3GqeXmwqFA3lhSvLrBlbl3RIzpohgU C+V3tEnUZsBVi2lO/d3pkhrzn/uGoA/YMaFfXyX7p4w+TlkDQc5pHykNgo0/KiuG1fU4 AII1G4tcrZmINmCzeXO0Tmhd623iQ5sVCt7O92aoLtZt4GACJsMCMjPDD18icif9w/Kk MvAQttWuqZDuthVPaWh040w6DtIlRsa4nv/uqld/XhfljswUuTSZJTCr6Zb2gokKV8Jy Ik5g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=VJQfD0Gy0U01zHXthnUY9VvfAHAiqWwVCIxa02ED0FQ=; b=0ItUGLHNCNd3pFTr3z0fIjs4LNOW3TWBrkwWK64rsTbSt0pAn02szDrtTUknKg6XNC sbkZIWjYEzu+T1cDcvQfh0mdlOhOZRwWca+RK0+q0gHkZtt2Wf0DR9CCAO6suFZBypT9 5SM4bDs5oc9BKF+fSLBVxOfCQB1jNjWG0EXh4VJ2lSiml9qs+MBwLDMbqCU8zzUluxBI KQnbt8sxR2gGefpKx6YHD495925MIqw9Wjf7/oYjOTkGtbf8Qp/ax1S8QuFcnUs/uLeQ BmPky9/cTdUaQVnzbGWXctIgdcjsSTw5BiekrFokdb9CjdI/tWqX7HL4D9d14CVX3G/3 yd8Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=JAetgpkg; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id u14-20020a170906950e00b00977c6d3303asi5969339ejx.570.2023.06.12.17.46.52; Mon, 12 Jun 2023 17:47:18 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=JAetgpkg; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239505AbjFMASA (ORCPT + 99 others); Mon, 12 Jun 2023 20:18:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238930AbjFMAQv (ORCPT ); Mon, 12 Jun 2023 20:16:51 -0400 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8C84830E6; Mon, 12 Jun 2023 17:13:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1686615228; x=1718151228; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=qj0G4UwqkNNGQlR4Z3X67pikfZ5WOGk4HokEGvo8sro=; b=JAetgpkgtOB33AnSsLsZ6l+U4GY9rrlYZYi4fpJkFOIa7Kr9KAjCNHBY SV/PxNHe8T509ZqE4kY6TLxDxCPSjnm+/PiboySFlE+BGU14sWnH+iyJ3 1kSvKqdatfafqbNOrVnumH79hDvXzDG/7IDRCytLvnR4L7L5iwPK/FrX7 tZ29VfZcOZwPBQTF4eYNNOCLV6AahxgWbIlwDwj7j89ccJFJm0wl9t9O1 lE8wFzjrGRhmeM3UfPl9kY8ZuzEd9opmzaCuybQJjdryPargw0Q7Srwiq puDrwQ0mc0+eCy5ThXSDfw8yLTgpJSz9TiulNRpfUpM9ng1hTGrunyRm0 Q==; X-IronPort-AV: E=McAfee;i="6600,9927,10739"; a="361557411" X-IronPort-AV: E=Sophos;i="6.00,238,1681196400"; d="scan'208";a="361557411" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jun 2023 17:12:36 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10739"; a="835671113" X-IronPort-AV: E=Sophos;i="6.00,238,1681196400"; d="scan'208";a="835671113" Received: from almeisch-mobl1.amr.corp.intel.com (HELO rpedgeco-desk4.amr.corp.intel.com) ([10.209.42.242]) by orsmga004-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jun 2023 17:12:35 -0700 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org, Andrew.Cooper3@citrix.com, christina.schimpe@intel.com, david@redhat.com, debug@rivosinc.com, szabolcs.nagy@arm.com, torvalds@linux-foundation.org, broonie@kernel.org Cc: rick.p.edgecombe@intel.com Subject: [PATCH v9 32/42] x86/shstk: Check that SSP is aligned on sigreturn Date: Mon, 12 Jun 2023 17:10:58 -0700 Message-Id: <20230613001108.3040476-33-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230613001108.3040476-1-rick.p.edgecombe@intel.com> References: <20230613001108.3040476-1-rick.p.edgecombe@intel.com> MIME-Version: 1.0 X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768546356733085233?= X-GMAIL-MSGID: =?utf-8?q?1768546356733085233?= The shadow stack signal frame is read by the kernel on sigreturn. It relies on shadow stack memory protections to prevent forgeries of this signal frame (which included the pre-signal SSP). It also relies on the shadow stack signal frame to have bit 63 set. Since this bit would not be set via typical shadow stack operations, so the kernel can assume it was a value it placed there. However, in order to support 32 bit shadow stack, the INCSSPD instruction can increment the shadow stack by 4 bytes. In this case SSP might be pointing to a region spanning two 8 byte shadow stack frames. It could confuse the checks described above. Since the kernel only supports shadow stack in 64 bit, just check that the SSP is 8 byte aligned in the sigreturn path. Signed-off-by: Rick Edgecombe --- v9: - New patch --- arch/x86/kernel/shstk.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c index f02e8ea4f1b5..a8705f7d966c 100644 --- a/arch/x86/kernel/shstk.c +++ b/arch/x86/kernel/shstk.c @@ -252,6 +252,9 @@ static int shstk_pop_sigframe(unsigned long *ssp) unsigned long token_addr; int err; + if (!IS_ALIGNED(*ssp, 8)) + return -EINVAL; + err = get_shstk_data(&token_addr, (unsigned long __user *)*ssp); if (unlikely(err)) return err;