LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Denys Vlasenko <dvlasenk@redhat.com>
To: Borislav Petkov <bp@alien8.de>, Ingo Molnar <mingo@kernel.org>
Cc: linux-tip-commits@vger.kernel.org, linux-kernel@vger.kernel.org,
	keescook@chromium.org, ast@plumgrid.com, fweisbec@gmail.com,
	oleg@redhat.com, tglx@linutronix.de,
	torvalds@linux-foundation.org, hpa@zytor.com, wad@chromium.org,
	rostedt@goodmis.org
Subject: Re: [tip:x86/asm] x86/asm/entry/64: Remove unused thread_struct::usersp
Date: Tue, 17 Mar 2015 13:22:05 +0100	[thread overview]
Message-ID: <55081C6D.6090609@redhat.com> (raw)
In-Reply-To: <20150317073901.GC19645@pd.tnic>

On 03/17/2015 08:39 AM, Borislav Petkov wrote:
> On Tue, Mar 17, 2015 at 08:21:18AM +0100, Ingo Molnar wrote:
>> Assuming this does not fix the regression, could you apply the minimal 
>> patch below - which reverts the old_rsp handling change.
>>
>> (The rest of the commit are in a third patch, but those are only 
>> comment changes.)
>>
>> So my theory is that this change is what will revert the regression.
> 
> Yep, it does. Below is the diff that works (it is the rough revert
> without the comments :-)):
> 
...
> @@ -395,6 +398,8 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
>  	/*
>  	 * Switch the PDA and FPU contexts.
>  	 */
> +	prev->usersp = this_cpu_read(old_rsp);
> +	this_cpu_write(old_rsp, next->usersp);

I have a theory. There is a time window when user's sp
is in PER_CPU_VAR(old_rsp) but not yet in pt_regs->sp,
and *interrupts are enabled*:

ENTRY(system_call)
        SWAPGS_UNSAFE_STACK
        movq    %rsp,PER_CPU_VAR(old_rsp)
        movq    PER_CPU_VAR(kernel_stack),%rsp
        ENABLE_INTERRUPTS(CLBR_NONE)
        ALLOC_PT_GPREGS_ON_STACK 8              /* +8: space for orig_ax */
        movq    %rcx,RIP(%rsp)
        movq    PER_CPU_VAR(old_rsp),%rcx
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        movq    %r11,EFLAGS(%rsp)
        movq    %rcx,RSP(%rsp)

Before indicated insn, interrupts are already enabled.
If preempt would hit now, next task can clobber PER_CPU_VAR(old_rsp).
Then, when we return to this task, a bogus user's sp will be stored
in pt_regs, restores on exit to userspace, and next attempt
to, say, execute RETQ will try to pop a bogus, likely noncanonical
address into RIP -> #GP -> SEGV!

The theory can be tested by just moving interrupt enable a bit down:

ENTRY(system_call)
        SWAPGS_UNSAFE_STACK
        movq    %rsp,PER_CPU_VAR(old_rsp)
        movq    PER_CPU_VAR(kernel_stack),%rsp
-       ENABLE_INTERRUPTS(CLBR_NONE)
        ALLOC_PT_GPREGS_ON_STACK 8              /* +8: space for orig_ax */
        movq    %rcx,RIP(%rsp)
        movq    PER_CPU_VAR(old_rsp),%rcx
        movq    %r11,EFLAGS(%rsp)
        movq    %rcx,RSP(%rsp)
+       ENABLE_INTERRUPTS(CLBR_NONE)

If I'm right, segfaults should be gone.
Borislav, can you try this?

  reply	other threads:[~2015-03-17 12:22 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-03-10 10:45 [PATCH 2/4] x86: entry_64.S: remove stub_iopl Denys Vlasenko
2015-03-10 10:45 ` [PATCH 4/4] x86: entry_64.S: remove unused thread_struct::usersp Denys Vlasenko
2015-03-11 12:55   ` Borislav Petkov
2015-03-11 15:19     ` Denys Vlasenko
2015-03-16 12:05   ` [tip:x86/asm] x86/asm/entry/64: Remove unused thread_struct:: usersp tip-bot for Denys Vlasenko
2015-03-16 16:47     ` Borislav Petkov
2015-03-16 22:20       ` [tip:x86/asm] x86/asm/entry/64: Remove unused thread_struct::usersp Denys Vlasenko
2015-03-17  7:08         ` Borislav Petkov
2015-03-17  7:13           ` Ingo Molnar
2015-03-17  7:21             ` Ingo Molnar
2015-03-17  7:39               ` Borislav Petkov
2015-03-17 12:22                 ` Denys Vlasenko [this message]
2015-03-17 12:51                   ` Denys Vlasenko
2015-03-17  7:51               ` Ingo Molnar
2015-03-17  8:06                 ` Borislav Petkov
2015-03-17  8:27                   ` Ingo Molnar
2015-03-17  9:01                     ` Borislav Petkov
2015-03-11 12:08 ` [PATCH 2/4] x86: entry_64.S: remove stub_iopl Borislav Petkov
2015-03-16 12:05 ` [tip:x86/asm] x86/asm/entry/64: Remove stub_iopl tip-bot for Denys Vlasenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=55081C6D.6090609@redhat.com \
    --to=dvlasenk@redhat.com \
    --cc=ast@plumgrid.com \
    --cc=bp@alien8.de \
    --cc=fweisbec@gmail.com \
    --cc=hpa@zytor.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-tip-commits@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=oleg@redhat.com \
    --cc=rostedt@goodmis.org \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --cc=wad@chromium.org \
    --subject='Re: [tip:x86/asm] x86/asm/entry/64: Remove unused thread_struct::usersp' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).