Messages in this thread Patch in this message | | | Date | Tue, 7 Apr 2020 21:41:12 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH 0/4] x86/module: Out-of-tree module decode and sanitize |
| |
On Tue, Apr 07, 2020 at 06:23:27PM +0100, Andrew Cooper wrote: > On 07/04/2020 12:02, Peter Zijlstra wrote: > > Hi all, > > > > Driven by the SLD vs VMX interaction, here are some patches that provide means > > to analyze the text of out-of-tree modules. > > > > The first user of that is refusing to load modules on VMX-SLD conflicts, but it > > also has a second patch that refulses to load any module that tries to modify > > CRn/DRn. > > > > I'm thinking people will quickly come up with more and more elaborate tests to > > which to subject out-of-tree modules. > > Anything playing with LGDT & friends? Shouldn't be substantially more > elaborate than CR/DR to check for.
More friends? (I wasn't sure on the Sxxx instructions, they appear harmless, but what do I know..)
I was also eyeing LSL LTR LSS, none of which I figured a module has any business of using. Are there more?
--- a/arch/x86/kernel/module.c +++ b/arch/x86/kernel/module.c @@ -282,6 +282,50 @@ static bool insn_is_mov_DRn(struct insn return false; } +static bool insn_is_LxDT(struct insn *insn) +{ + u8 modrm = insn->modrm.bytes[0]; + u8 modrm_mod = X86_MODRM_MOD(modrm); + u8 modrm_reg = X86_MODRM_REG(modrm); + + if (insn->opcode.bytes[0] != 0x0f) + return false; + + switch (insn->opcode.bytes[1]) { + case 0x00: + if (modrm_mod != 0x03) + break; + + switch (modrm_reg) { + case 0x0: /* SLDT */ + case 0x2: /* LLDT */ + return true; + + default: + break; + } + break; + + case 0x01: + switch (modrm_reg) { + case 0x0: /* SGDT */ + case 0x1: /* SIDT */ + case 0x2: /* LGDT */ + case 0x3: /* LIDT */ + return true; + + default: + break; + } + break; + + default: + break; + } + + return false; +} + static int decode_module(struct module *mod, void *text, void *text_end, bool sld_safe) { bool allow_vmx = sld_safe || !split_lock_enabled();
| |