From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 05B823C73F6 for ; Wed, 22 Jul 2026 15:36:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784734612; cv=none; b=bW+xrAHIp+bs+gafaYwfM38KhhsfrUVdQVObabtomhsqRFkHZWhyEdv/2wHdaWLE2rLGrGiZ7/V2uKKKdM2DQhYDcuu0EZpBGsC73iGD1WyHy5r7Oj+5EvBx4jGLX+Z572KKe6imw4X61gofYCkIA5EPB1YOOTWof17FicmJA4k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784734612; c=relaxed/simple; bh=v0SLJDKBp2FzXGrHIfds8RXVOP+EBhyCfIJsOBfO2CM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=fJIRgEUSgTwu9sXI3DVc+ojl5F1q9nv7LZoCtJiQyG5DIrsZCkvIpXHuSDqrPN9ix/1Cx7foFlLHNc/Xjg4CYKrQiiNV33jSFHfRQoUBIQz7jxbtv+krIkzdNiTPrX9kBIe7NVNpQghlVcqA7y2qKa6vXgfXwXlCHF/SvJPEqoo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=B5OHRZ6r; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="B5OHRZ6r" Received: by smtp.kernel.org (Postfix) with UTF8SMTPSA id 04A071F000E9; Wed, 22 Jul 2026 15:36:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784734610; bh=LypLFGVRiF6WSQJaOUyLd7AEr2D3IlP3cuz/12D6fgE=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=B5OHRZ6rFjCFMTwe+clpfyYY1rfyuBHfa3dRcp1ci9lkxHb9sA7QnQVVDtJE22And lZJITYQaGXRVRIqIyDa5f6qf0De9taXglvMR/IpK5y2UGW8vDQ5SCBmaRdxwzBwpu/ sVgkLZtyok4vle92upxH58N8N27zRdJD3l2D9Cq3HBj3xY9n2hYtyzDkm5ZTKi8r0l tZP8TMNfcYB+HzzR/MxkIso0Tdvrj2eKH6JbKMCLNKQDSgLUL+fUp6Smscz2RkP4dE y+1nYZCD4xXgsNX/csIQehpJv1aZeYVswMagKbVkOzEPYw3Rrp5DvMCEkKTpYt9e+J nSf17qVMRTM5Q== Date: Wed, 22 Jul 2026 18:36:46 +0300 From: Jarkko Sakkinen To: Sohil Mehta Cc: Dave Hansen , x86@kernel.org, Andy Lutomirski , Borislav Petkov , "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Nam Cao , Cedric Xing , Kumar Kartikeya Dwivedi , Rick Edgecombe , Andrew Cooper , Michael Roth , Brijesh Singh , linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] x86/vsyscall: Avoid vsyscall emulation for unexpected page fault types Message-ID: References: <20260722004152.503073-1-sohil.mehta@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260722004152.503073-1-sohil.mehta@intel.com> On Tue, Jul 21, 2026 at 05:41:51PM -0700, Sohil Mehta wrote: > Currently, vsyscall emulation is rejected for write faults and > kernel-privilege faults. It is assumed that other page fault error codes > such as X86_PF_PK and X86_PF_SHSTK will not be set in the vsyscall > context. From a defensive point of view, it is better to explicitly > reject these faults than assume that they will never happen. So, avoid > vsyscall emulation if any of those are present. > > Note, X86_PF_SGX and X86_PF_RMP are also unlikely to occur in the > vsyscall context. They can probably be added to the reject-list in the > future to solidify this further. Also, X86_PF_RSVD is already handled in > do_user_addr_fault() before vsyscall emulation is attempted. > > Similarly, on systems that support X86_FEATURE_NX, X86_PF_INSTR is > always expected to be set when an instruction fetch triggers a #PF. The > kernel issues a warning whenever that is not the case. Instead of > continuing when something is very wrong, return early and skip vsyscall > emulation. > > Suggested-by: H. Peter Anvin (Intel) > Signed-off-by: Sohil Mehta > --- > v2: > - Combined the two patches into one. > - Make the commit message concise. > > I have excluded SGX and RMP because I wasn't 100% sure and I didn't get > any feedback on them in the last post. Let me know if someone wants them > to be added. > RFC-v1: https://lore.kernel.org/lkml/20260313192327.2089471-1-sohil.mehta@intel.com/ > --- > arch/x86/entry/vsyscall/vsyscall_64.c | 10 ++++++---- > arch/x86/mm/fault.c | 3 --- > 2 files changed, 6 insertions(+), 7 deletions(-) > > diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c > index ea36de9fa864..5176860cef55 100644 > --- a/arch/x86/entry/vsyscall/vsyscall_64.c > +++ b/arch/x86/entry/vsyscall/vsyscall_64.c > @@ -257,8 +257,9 @@ static bool __emulate_vsyscall(struct pt_regs *regs, unsigned long address) > bool emulate_vsyscall_pf(unsigned long error_code, struct pt_regs *regs, > unsigned long address) > { > - /* Write faults or kernel-privilege faults never get fixed up. */ > - if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER) > + /* Only simple user read faults get fixed up (no write, pkey or shadow stack) */ > + if ((error_code & (X86_PF_WRITE | X86_PF_PK | X86_PF_SHSTK | X86_PF_USER)) != > + X86_PF_USER) > return false; > > /* > @@ -282,8 +283,9 @@ bool emulate_vsyscall_pf(unsigned long error_code, struct pt_regs *regs, > * available, use it to double-check that the emulation code > * is only being used for instruction fetches: > */ > - if (cpu_feature_enabled(X86_FEATURE_NX)) > - WARN_ON_ONCE(!(error_code & X86_PF_INSTR)); > + if (cpu_feature_enabled(X86_FEATURE_NX) && > + WARN_ON_ONCE(!(error_code & X86_PF_INSTR))) > + return false; > > return __emulate_vsyscall(regs, address); > } > diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c > index 45b99c3b1442..e0b645a55844 100644 > --- a/arch/x86/mm/fault.c > +++ b/arch/x86/mm/fault.c > @@ -1318,9 +1318,6 @@ void do_user_addr_fault(struct pt_regs *regs, > * > * The vsyscall page does not have a "real" VMA, so do this > * emulation before we go searching for VMAs. > - * > - * PKRU never rejects instruction fetches, so we don't need > - * to consider the PF_PK bit. > */ > if (is_vsyscall_vaddr(address)) { > if (emulate_vsyscall_pf(error_code, regs, address)) > -- > 2.43.0 > Reviewed-by: Jarkko Sakkinen BR, Jarkko