From: Luis Henriques <lhenriques@suse.com>
To: Dan Williams <dan.j.williams@intel.com>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
linux-arch <linux-arch@vger.kernel.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>,
Greg KH <gregkh@linuxfoundation.org>, X86 ML <x86@kernel.org>,
Ingo Molnar <mingo@redhat.com>, Andy Lutomirski <luto@kernel.org>,
"H. Peter Anvin" <hpa@zytor.com>,
Thomas Gleixner <tglx@linutronix.de>,
Linus Torvalds <torvalds@linux-foundation.org>,
Andrew Morton <akpm@linux-foundation.org>,
Alan Cox <alan@linux.intel.com>
Subject: Re: [PATCH v4 07/10] x86: narrow out of bounds syscalls to sys_read under speculation
Date: Tue, 6 Feb 2018 22:51:32 +0000 [thread overview]
Message-ID: <20180206225132.yewppdrnut35gzrh@hermes.olymp> (raw)
In-Reply-To: <CAPcyv4ihN6fy5-vBtfA0PuwXvCAj8-rMhtQmevh5sdYxbH3Yfw@mail.gmail.com>
On Tue, Feb 06, 2018 at 11:48:45AM -0800, Dan Williams wrote:
> On Tue, Feb 6, 2018 at 11:29 AM, Luis Henriques <lhenriques@suse.com> wrote:
> > On Thu, Jan 18, 2018 at 04:02:21PM -0800, Dan Williams wrote:
> >> The syscall table base is a user controlled function pointer in kernel
> >> space. Like, 'get_user, use 'MASK_NOSPEC' to prevent any out of bounds
> >> speculation. While retpoline prevents speculating into the user
> >> controlled target it does not stop the pointer de-reference, the concern
> >> is leaking memory relative to the syscall table base.
> >
> > This patch seems to cause a regression. An easy way to reproduce what
> > I'm seeing is to run the samples/statx/test-statx. Here's what I see
> > when I have this patchset applied:
> >
> > # ./test-statx /tmp
> > statx(/tmp) = -1
> > /tmp: Bad file descriptor
> >
> > Reverting this single patch seems to fix it.
>
> Just to clarify, when you say "this patch" you mean:
>
> 2fbd7af5af86 x86/syscall: Sanitize syscall table de-references
> under speculation
>
> ...not this early MASK_NOSPEC version of the patch, right?
*sigh*
Looks like I spent some good amount of time hunting a non-issue just
because I have enough old branches hanging around to confusing me :-(
Sorry for the noise.
Cheers,
--
Luís
next prev parent reply other threads:[~2018-02-06 22:51 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-19 0:01 [PATCH v4 00/10] prevent bounds-check bypass via speculative execution Dan Williams
2018-01-19 0:01 ` [PATCH v4 01/10] Documentation: document array_ptr Dan Williams
2018-01-19 0:01 ` [PATCH v4 02/10] asm/nospec, array_ptr: sanitize speculative array de-references Dan Williams
2018-01-19 10:20 ` [kernel-hardening] " Jann Horn
2018-01-19 17:48 ` Adam Sampson
2018-01-19 18:12 ` Dan Williams
2018-01-19 18:18 ` Will Deacon
2018-01-19 18:26 ` Dan Williams
2018-01-19 18:18 ` Linus Torvalds
2018-01-19 20:55 ` Dan Williams
2018-01-25 7:09 ` Cyril Novikov
2018-01-25 22:37 ` Dan Williams
2018-01-19 0:01 ` [PATCH v4 03/10] x86: implement array_ptr_mask() Dan Williams
2018-01-19 0:01 ` [PATCH v4 04/10] x86: introduce __uaccess_begin_nospec and ifence Dan Williams
2018-01-19 0:02 ` [PATCH v4 05/10] x86, __get_user: use __uaccess_begin_nospec Dan Williams
2018-01-19 0:02 ` [PATCH v4 06/10] x86, get_user: use pointer masking to limit speculation Dan Williams
2018-01-19 0:02 ` [PATCH v4 07/10] x86: narrow out of bounds syscalls to sys_read under speculation Dan Williams
2018-01-24 14:40 ` Jiri Slaby
2018-02-06 19:29 ` Luis Henriques
2018-02-06 19:48 ` Dan Williams
2018-02-06 20:26 ` Linus Torvalds
2018-02-06 20:37 ` Dan Williams
2018-02-06 20:42 ` Linus Torvalds
2018-02-06 20:43 ` Linus Torvalds
2018-02-06 20:49 ` Andy Lutomirski
2018-02-06 20:58 ` Linus Torvalds
2018-02-06 21:37 ` Dan Williams
2018-02-06 22:52 ` Linus Torvalds
2018-02-07 0:33 ` Dan Williams
2018-02-07 1:23 ` Linus Torvalds
2018-02-06 22:51 ` Luis Henriques [this message]
2018-01-19 0:02 ` [PATCH v4 08/10] vfs, fdtable: prevent bounds-check bypass via speculative execution Dan Williams
2018-01-19 0:02 ` [PATCH v4 09/10] kvm, x86: fix spectre-v1 mitigation Dan Williams
2018-01-19 8:42 ` Paolo Bonzini
2018-01-19 0:02 ` [PATCH v4 10/10] nl80211: sanitize array index in parse_txq_params Dan Williams
2018-01-21 10:37 ` Johannes Berg
2018-01-20 6:58 ` [PATCH v4 00/10] prevent bounds-check bypass via speculative execution Dan Williams
2018-01-20 16:56 ` Alexei Starovoitov
2018-01-20 17:07 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180206225132.yewppdrnut35gzrh@hermes.olymp \
--to=lhenriques@suse.com \
--cc=akpm@linux-foundation.org \
--cc=alan@linux.intel.com \
--cc=dan.j.williams@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®