Messages in this thread | | | From | Kees Cook <> | Date | Wed, 8 Feb 2017 13:20:26 -0800 | Subject | Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION |
| |
On Wed, Feb 8, 2017 at 1:12 AM, Peter Zijlstra <peterz@infradead.org> wrote: > On Tue, Feb 07, 2017 at 05:55:42PM +0000, Mark Rutland wrote: >> On Tue, Feb 07, 2017 at 06:30:36PM +0100, Peter Zijlstra wrote: >> > On Tue, Feb 07, 2017 at 04:03:01PM +0000, Mark Rutland wrote: >> > > For x86 it's a little painful due to '%' in the register names, but it looks >> > > possible. The below appears to do the mangling correctly (then screams due to >> > > the mangled result being nonexistent). >> > >> > > asm( >> > > " .macro reg_to_offset r\n" >> > > " .irp rs,eax,ebx,ecx,edx\n" >> > > " .ifc \\r, %\\rs\n" >> > > " __offset_of_\\rs\n" >> > > " .endif\n" >> > > " .endr\n" >> > > " .endm\n" >> > > ); >> > > >> > > #define asm_sym(var) asm volatile("reg_to_offset %0\n" : : "r" (var)) >> > >> > Oh gawd that's a most gnarly hack. >> >> :) >> >> > Do we want to go do that for all archs or somehow cook a generic >> > fallback that ends up doing a full function call or something? >> >> Given the arch-specific reg->blah mapping is so "fun", I guess a generic >> fallback would be a good start. >> >> I haven't figured out all the plumbing details. It'd be nice to reuse >> the bug infrastructure so that arches don't have to implement another >> trap and callback pair, but I guess the reg details need to live in >> another data structure. > > On x86 have have __ex_table and __bug_table. The former is used for all > sorts of things, including fixing up faults. > > Now, our struct exception_table_entry has a third field used to specify > a handler, see commit: > > 548acf19234d ("x86/mm: Expand the exception table logic to allow new handling options") > > Also, given we trigger things with a known instruction at these sites, > the ->to field is reusable and can be used to encode the register > offset. > > Still, if we want to allow a generic implementation that does a function > call, the handler prototype should probably look like: > > void exception_value(unsigned long value); > > Which means the arch bits need a trampoline and we also need to encode > that. The best I've come up with is having nr_regs trampolines and > stuffing the trampoline function in the ->handler field and then using > the ->to field to encode the actual handler. > > Something like: > > #define EX_REG_HANDLER(_reg) \ > bool ex_handler_value_##_reg(const struct exception_table_entry *fixup, \ > struct pt_regs *regs, int trapnr) \ > { \ > void (*handler)(unsigned long) = \ > (void *)((unsigned long)&fixup->to + fixup->to); \ > \ > if (trapnr != X86_TRAP_UD) \ > return false; \ > \ > regs->ip += 2; /* size of UD2 instruction */ \ > handler(regs->_reg); \ > return true; \ > } > > EX_REG_HANDLER(bx); > EX_REG_HANDLER(cx); > ... > EX_REG_HANDLER(ss); > > > asm ( > " .macro reg_to_handler r\n" > " .irp rs,bx,cx,...,ss\n" > " .ifc \\r, %\\rs\n" > " ex_handler_value_\\rs\n" > " .endif\n" > " .endr\n" > " .endm\n" > ); > > #define EXCEPTION_VALUE(val, handler) \ > asm volatile ("1: ud2" \ > _ASM_EXTABLE_HANDLE(1b, handler, \ > reg_to_handler %0) \ > : : "r" (val)) > > > Where the generic version can simply be: > > #define EXCEPTION_VALUE(val, handler) handler((unsigned long)val) > > > Makes sense?
Ooooh, that is intense. And the trampolines (EX_REG_HANDLERs) are all just there to catch whatever register gcc decides to stuff the value into? *cover face* Sure, okay. :)
I wonder how many existing WARN callsites could be repurposed to use this?
-Kees
-- Kees Cook Pixel Security
| |