Messages in this thread | | | Date | Tue, 3 Jan 2017 18:11:55 +0300 | From | "Kirill A. Shutemov" <> | Subject | Re: [PATCH v2] selftests/x86: Add a selftest for SYSRET to noncanonical addresses |
| |
On Mon, Dec 26, 2016 at 07:20:50PM -0800, Andy Lutomirski wrote: > SYSRET to a noncanonical address will blow up on Intel CPUs. Linux > needs to prevent this from happening in two major cases, and the > criteria will become more complicated when support for larger virtual > address spaces is added. > > A fast-path SYSCALL will fallthrough to the following instruction > using SYSRET without any particular checking. To prevent fallthrough > to a noncanonical address, Linux prevents the highest canonical page > from being mapped. This test case checks a variety of possible maximum > addresses to make sure that either we can't map code there or that > SYSCALL fallthrough works. > > A slow-path system call can return anywhere. Linux needs to make sure > that, if the return address is non-canonical, it won't use SYSRET. > This test cases causes sigreturn() to return to a variety of addresses > (with RCX == RIP) and makes sure that nothing explodes. > > Some of this code comes from Kirill Shutemov. > > Changes from v1: > - Get rid of some extra parentheses. > - Test more corner cases. > - Get rid of some duplicate '0x' printout. > > Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> > Signed-off-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Output with 5-level paging enabled:
[RUN] sigreturn to 0x800000000000 [OK] Got SIGSEGV at RIP=0x800000000000 [RUN] sigreturn to 0x1000000000000 [OK] Got SIGSEGV at RIP=0x1000000000000 [RUN] sigreturn to 0x2000000000000 [OK] Got SIGSEGV at RIP=0x2000000000000 [RUN] sigreturn to 0x4000000000000 [OK] Got SIGSEGV at RIP=0x4000000000000 [RUN] sigreturn to 0x8000000000000 [OK] Got SIGSEGV at RIP=0x8000000000000 [RUN] sigreturn to 0x10000000000000 [OK] Got SIGSEGV at RIP=0x10000000000000 [RUN] sigreturn to 0x20000000000000 [OK] Got SIGSEGV at RIP=0x20000000000000 [RUN] sigreturn to 0x40000000000000 [OK] Got SIGSEGV at RIP=0x40000000000000 [RUN] sigreturn to 0x80000000000000 [OK] Got SIGSEGV at RIP=0x80000000000000 [RUN] sigreturn to 0x100000000000000 [OK] Got SIGSEGV at RIP=0x100000000000000 [RUN] sigreturn to 0x200000000000000 [OK] Got SIGSEGV at RIP=0x200000000000000 [RUN] sigreturn to 0x400000000000000 [OK] Got SIGSEGV at RIP=0x400000000000000 [RUN] sigreturn to 0x800000000000000 [OK] Got SIGSEGV at RIP=0x800000000000000 [RUN] sigreturn to 0x1000000000000000 [OK] Got SIGSEGV at RIP=0x1000000000000000 [RUN] sigreturn to 0x2000000000000000 [OK] Got SIGSEGV at RIP=0x2000000000000000 [RUN] sigreturn to 0x4000000000000000 [OK] Got SIGSEGV at RIP=0x4000000000000000 [RUN] sigreturn to 0x8000000000000000 [OK] Got SIGSEGV at RIP=0x8000000000000000 [RUN] Trying a SYSCALL that falls through to 0x7fffffffe000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x7ffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x800000000000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0xfffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x1000000000000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x1fffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x2000000000000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x3fffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x4000000000000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x7fffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x8000000000000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0xffffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x10000000000000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x1ffffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x20000000000000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x3ffffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x40000000000000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x7ffffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x80000000000000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0xfffffffffff000 [OK] We survived [RUN] Trying a SYSCALL that falls through to 0x100000000000000 [OK] mremap to 0xfffffffffff000 failed [RUN] Trying a SYSCALL that falls through to 0x1fffffffffff000 [OK] mremap to 0x1ffffffffffe000 failed [RUN] Trying a SYSCALL that falls through to 0x200000000000000 [OK] mremap to 0x1fffffffffff000 failed [RUN] Trying a SYSCALL that falls through to 0x3fffffffffff000 [OK] mremap to 0x3ffffffffffe000 failed [RUN] Trying a SYSCALL that falls through to 0x400000000000000 [OK] mremap to 0x3fffffffffff000 failed [RUN] Trying a SYSCALL that falls through to 0x7fffffffffff000 [OK] mremap to 0x7ffffffffffe000 failed [RUN] Trying a SYSCALL that falls through to 0x800000000000000 [OK] mremap to 0x7fffffffffff000 failed [RUN] Trying a SYSCALL that falls through to 0xffffffffffff000 [OK] mremap to 0xfffffffffffe000 failed [RUN] Trying a SYSCALL that falls through to 0x1000000000000000 [OK] mremap to 0xffffffffffff000 failed [RUN] Trying a SYSCALL that falls through to 0x1ffffffffffff000 [OK] mremap to 0x1fffffffffffe000 failed [RUN] Trying a SYSCALL that falls through to 0x2000000000000000 [OK] mremap to 0x1ffffffffffff000 failed [RUN] Trying a SYSCALL that falls through to 0x3ffffffffffff000 [OK] mremap to 0x3fffffffffffe000 failed [RUN] Trying a SYSCALL that falls through to 0x4000000000000000 [OK] mremap to 0x3ffffffffffff000 failed [RUN] Trying a SYSCALL that falls through to 0x7ffffffffffff000 [OK] mremap to 0x7fffffffffffe000 failed [RUN] Trying a SYSCALL that falls through to 0x8000000000000000 [OK] mremap to 0x7ffffffffffff000 failed
-- Kirill A. Shutemov
| |