lkml.org 
[lkml]   [2020]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] x86/uaccess: Use pointer masking to limit uaccess speculation
On Wed, Aug 19, 2020 at 10:02 AM Josh Poimboeuf <jpoimboe@redhat.com> wrote:
>
> On Wed, Aug 19, 2020 at 09:39:10AM -0700, Andy Lutomirski wrote:
> > On Wed, Aug 19, 2020 at 7:50 AM Josh Poimboeuf <jpoimboe@redhat.com> wrote:
> > > +/*
> > > + * Sanitize a uaccess pointer such that it becomes NULL if it's not a valid
> > > + * user pointer. This blocks speculative dereferences of user-controlled
> > > + * pointers.
> > > + */
> > > +#define uaccess_mask_ptr(ptr) \
> > > + (__typeof__(ptr)) array_index_nospec((__force unsigned long)ptr, user_addr_max())
> > > +
> >
> > If I dug through all the macros correctly, this is generating a fairly
> > complex pile of math to account for the fact that user_addr_max() is
> > variable and that it's a nasty number.
>
> The math is actually pretty simple. It's identical to what getuser.S is
> doing:
>
> cmp TASK_addr_limit(%_ASM_DX),%_ASM_AX
> sbb %_ASM_DX, %_ASM_DX
> and %_ASM_DX, %_ASM_AX
>
> > But I don't think there's any particular need to use the real maximum
> > user address here. Allowing a mis-speculated user access to a
> > non-canonical address or to the top guard page of the lower canonical
> > region is harmless. With current kernels, a sequence like:
> >
> > if (likely((long)addr > 0) {
> > masked_addr = addr & 0x7FFFFFFFFFFFFFFFUL;
> > } else {
> > if (kernel fs) {
> > masked_addr = addr;
> > } else {
> > EFAULT;
> > }
> > }
>
> The masking has to be done without conditional branches, otherwise it
> defeats the point.

Ugh. Fair enough.

> Yeah, we could do that. Though in the meantime, the simple merge
> conflict resolution with Christoph's patches would be
> s/user_addr_max/TASK_SIZE_MAX/ in my uaccess_mask_ptr() macro.

Okay. I will try to help remember :)

--Andy

\
 
 \ /
  Last update: 2020-08-20 02:21    [W:0.081 / U:0.244 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site