From patchwork Wed Aug 2 22:19:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 130235 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f41:0:b0:3e4:2afc:c1 with SMTP id v1csp808955vqx; Wed, 2 Aug 2023 17:11:17 -0700 (PDT) X-Google-Smtp-Source: APBJJlFiPdIkyORu1OQGtTy7dhOqACjDSBQ+zE/MdbLvPq7xuCkelBJqi45wdaQXpu265Fi5TtF0 X-Received: by 2002:a17:903:1c7:b0:1b8:b55d:4cff with SMTP id e7-20020a17090301c700b001b8b55d4cffmr18072907plh.2.1691021476745; Wed, 02 Aug 2023 17:11:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1691021476; cv=none; d=google.com; s=arc-20160816; b=UCo6f+OTGsgPH0ehB2NeGfWwG7jI3BVnwr/tnvuolw/9af+a3H8vhopVvn5RG0uI1y FTDgXXCFcPa/AeRB6bGcMBZG/EOkLmj5HNWQKCWYdaEFv+Ov6lQXj9bo7ziHSuWLcdzS u5YVRZf3yd5af9C1sA4+uj6EGlYgtOt0nm7k3BH1HcfNL6PAIn+fwPc4cPLIN+Cz/T/4 RaYBnjuuTsLDTQ7jiJjJr1Fa8B2M2iU1BZBd6BcRHzmrWNhuwEFTVl6brjyI8swwtsrh 5UquHD5E1iMYy/4XbbuTnDKbYYbfgsdpMBw5+YTp7CZrwqlZyhuhlVp5KLlXPqPH1GoU 3QZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:robot-unsubscribe :robot-id:message-id:mime-version:cc:subject:to:reply-to:sender:from :dkim-signature:dkim-signature:date; bh=YYSeP3oTtOgkXh3frpkRHENndWycgT3hC5KKAYr/xc4=; fh=DErNX+FP1i15oz3qs87i1gR330nFAaK00aIY9hllqPU=; b=NhY75eAtD6TwLoe4bKBaZhFuRpVDLoKHirSSgTvbvJiPIUep13uSS9u8IfivvsK7Ho 3IZv7j7dMAcfpuFVwwKpA2szvWucojdxE/uFnyK7qtogqil+iGAwsEetBCh96csEe7my UuGefuTOAjnWeqMxCLcPDUZ12xe4PpAttyJN9r2RsNOijJGgVs/yn5GJCfV9gTnCLWKL Xa48Vnap2lqs9Qzq64L2/WAvZrNdzyTlG/b/mTQ7MeD1xpQ2pZaues7OLuvITxtdX9M6 4nmvUDMHbCYOo4OiS/txs5paJwTzLqU0LNeFrwI5ewR5QJDy2T6KqdagoYjpg0b8QBUJ E9Yg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=aUyktOCo; dkim=neutral (no key) header.i=@linutronix.de; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id jg14-20020a17090326ce00b001b831d26f32si2130932plb.590.2023.08.02.17.11.03; Wed, 02 Aug 2023 17:11:16 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=aUyktOCo; dkim=neutral (no key) header.i=@linutronix.de; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233991AbjHBWUa (ORCPT + 99 others); Wed, 2 Aug 2023 18:20:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60330 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232949AbjHBWTh (ORCPT ); Wed, 2 Aug 2023 18:19:37 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9BF5B273B; Wed, 2 Aug 2023 15:19:35 -0700 (PDT) Date: Wed, 02 Aug 2023 22:19:32 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1691014773; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YYSeP3oTtOgkXh3frpkRHENndWycgT3hC5KKAYr/xc4=; b=aUyktOCoWVy2dkudEpDzUOpJ+B1vEhiDi51hFRuFBkXsWHTiDd3bXySxAFrU5bkZlCNWU/ otyQEf3zGG2+i582aCWTzRI6uxTbTUyLlHcLFTjTGasta7cVwiTyCwdFQbZRkmVBgYzigk 7/eljzA5aINn/TZRn/t1vSIeNaxYR/h2oxQXt893KV0poimcGKUtgQHfkUcl6TnHcPgpSB cKxi0bC3Z53hu3QuQDf0b5cEPS0HtMKQpW3Aso2Oku0xJ8iJgHk4S56AZ5/LfOi90SCbpg s/3fxW9sUO7m7E6DYIuAb/+1aTwF8KJZBATgAjPwt/7XSSp/8qGFAunOiMV6qw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1691014773; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YYSeP3oTtOgkXh3frpkRHENndWycgT3hC5KKAYr/xc4=; b=XPkSbV8ouVr3q++gx0Hhc3gxNZR/dzq5W6quyNcwbGnK6n50Ltt9QphxxIvmlmEMJXjPvB 4Br5odGD8qxLGkCQ== From: "tip-bot2 for Rick Edgecombe" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/shstk] x86/shstk: Check that SSP is aligned on sigreturn Cc: Rick Edgecombe , Dave Hansen , x86@kernel.org, linux-kernel@vger.kernel.org MIME-Version: 1.0 Message-ID: <169101477238.28540.7777670713206141397.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1773164535853641343 X-GMAIL-MSGID: 1773164535853641343 The following commit has been merged into the x86/shstk branch of tip: Commit-ID: b93d6c78829ad1e22486ccc93d04bf77e45597df Gitweb: https://git.kernel.org/tip/b93d6c78829ad1e22486ccc93d04bf77e45597df Author: Rick Edgecombe AuthorDate: Mon, 12 Jun 2023 17:10:58 -07:00 Committer: Dave Hansen CommitterDate: Wed, 02 Aug 2023 15:01:50 -07:00 x86/shstk: Check that SSP is aligned on sigreturn The shadow stack signal frame is read by the kernel on sigreturn. It relies on shadow stack memory protections to prevent forgeries of this signal frame (which included the pre-signal SSP). It also relies on the shadow stack signal frame to have bit 63 set. Since this bit would not be set via typical shadow stack operations, so the kernel can assume it was a value it placed there. However, in order to support 32 bit shadow stack, the INCSSPD instruction can increment the shadow stack by 4 bytes. In this case SSP might be pointing to a region spanning two 8 byte shadow stack frames. It could confuse the checks described above. Since the kernel only supports shadow stack in 64 bit, just check that the SSP is 8 byte aligned in the sigreturn path. Signed-off-by: Rick Edgecombe Signed-off-by: Dave Hansen Link: https://lore.kernel.org/all/20230613001108.3040476-33-rick.p.edgecombe%40intel.com --- arch/x86/kernel/shstk.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c index f02e8ea..a8705f7 100644 --- a/arch/x86/kernel/shstk.c +++ b/arch/x86/kernel/shstk.c @@ -252,6 +252,9 @@ static int shstk_pop_sigframe(unsigned long *ssp) unsigned long token_addr; int err; + if (!IS_ALIGNED(*ssp, 8)) + return -EINVAL; + err = get_shstk_data(&token_addr, (unsigned long __user *)*ssp); if (unlikely(err)) return err;