Messages in this thread | | | From | "Bae, Chang Seok" <> | Subject | Re: [PATCH 13/15] x86/fsgsbase/64: With FSGSBASE, compare GS bases on paranoid_entry | Date | Tue, 20 Mar 2018 16:33:42 +0000 |
| |
On 3/20/18, 07:58, "Andy Lutomirski" <luto@kernel.org> wrote:
>> On Mar 19, 2018, at 10:49 AM, Chang S. Bae <chang.seok.bae@intel.com> wrote: >> >> When FSGSBASE is enabled, SWAPGS needs if and only if (current) >> GS base is not the kernel's. >> >> FSGSBASE instructions allow user to write any value on GS base; >> even negative. Sign check on the current GS base is not >> sufficient. Fortunately, reading GS base is fast. Kernel GS >> base is also known from the offset table with the CPU number.
> The original version of these patches (mine and Andi’s) didn’t have > this comparison, didn’t need RDMSR, and didn’t allow malicious user > programs to cause the kernel to run decently large chunks of code with > the reverse of the expected GS convention. Why did you change it?
> I really really don't like having a corner case like this that can and > will be triggered by malicious user code but that is hard to write a > self-test for because it involves guessing a 64-bit magic number. > Untestable corner cases in the x86 entry code are bad.
Originally, I took it. But since it keeps kernel GS base on the (IST) stack, it is thought as fragile [1] AFAIK. If you really don't like this "comparison" then GS base can be written (unconditionally) while the original GS base stitched (like the original approach did) IMO. [1] https://marc.info/?l=linux-kernel&m=151725088506036&w=3
| |