Messages in this thread | | | From | David Laight <> | Subject | RE: [PATCH] x86/uaccess: Use pointer masking to limit uaccess speculation | Date | Wed, 19 Aug 2020 21:30:19 +0000 |
| |
From: Josh Poimboeuf > Sent: 19 August 2020 18:02 > > On Wed, Aug 19, 2020 at 09:39:10AM -0700, Andy Lutomirski wrote: > > On Wed, Aug 19, 2020 at 7:50 AM Josh Poimboeuf <jpoimboe@redhat.com> wrote: > > > +/* > > > + * Sanitize a uaccess pointer such that it becomes NULL if it's not a valid > > > + * user pointer. This blocks speculative dereferences of user-controlled > > > + * pointers. > > > + */ > > > +#define uaccess_mask_ptr(ptr) \ > > > + (__typeof__(ptr)) array_index_nospec((__force unsigned long)ptr, user_addr_max()) > > > + > > > > If I dug through all the macros correctly, this is generating a fairly > > complex pile of math to account for the fact that user_addr_max() is > > variable and that it's a nasty number. > > The math is actually pretty simple. It's identical to what getuser.S is > doing: > > cmp TASK_addr_limit(%_ASM_DX),%_ASM_AX > sbb %_ASM_DX, %_ASM_DX > and %_ASM_DX, %_ASM_AX > > > But I don't think there's any particular need to use the real maximum > > user address here. Allowing a mis-speculated user access to a > > non-canonical address or to the top guard page of the lower canonical > > region is harmless. With current kernels, a sequence like: > > > > if (likely((long)addr > 0) { > > masked_addr = addr & 0x7FFFFFFFFFFFFFFFUL; > > } else { > > if (kernel fs) { > > masked_addr = addr; > > } else { > > EFAULT; > > } > > } > > The masking has to be done without conditional branches, otherwise it > defeats the point. > > > could plausibly be better. But Christoph's series fixes this whole > > mess, and I think that this should be: > > > > #define uaccess_mask_ptr(ptr) ((__typeof___(ptr)) (__force unsigned > > long)ptr & USER_ADDR_MASK)) > > > > where USER_ADDR_MASK is the appropriate value for 32-bit or 64-bit. > > Yeah, we could do that. Though in the meantime, the simple merge > conflict resolution with Christoph's patches would be > s/user_addr_max/TASK_SIZE_MAX/ in my uaccess_mask_ptr() macro.
For access_ok(ptr, size) I think you can do: (ptr | (ptr + size)) & (64bit ? 1 << 63 : 3 << 30)
Masking on 32bit is harder, something like. Subtract 0xc0000000 (sets carry for user addresses) sbb reg,reg to generate 0 (kernel) or ~0 (user). And with the address - kernel addresses are now zero.
David
- Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
| |