lkml.org 
[lkml]   [2020]   [Nov]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [RFC][PATCH 13/24] x86/pti: Extend PTI user mappings
On Mon, Nov 9, 2020 at 11:54 AM Alexandre Chartre
<alexandre.chartre@oracle.com> wrote:
>
>
> [Copying the reply to Andy in the thread with the right email addresses]
>
> On 11/9/20 6:28 PM, Andy Lutomirski wrote:
> > On Mon, Nov 9, 2020 at 3:22 AM Alexandre Chartre
> > <alexandre.chartre@oracle.com> wrote:
> >>
> >> Extend PTI user mappings so that more kernel entry code can be executed
> >> with the user page-table. To do so, we need to map syscall and interrupt
> >> entry code,
> >
> > Probably fine.
> >
> >> per cpu offsets (__per_cpu_offset, which is used some in
> >> entry code),
> >
> > This likely already leaks due to vulnerable CPUs leaking address space
> > layout info.
>
> I forgot to update the comment, I am not mapping __per_cpu_offset anymore.
>
> However, if we do map __per_cpu_offset then we don't need to enforce the
> ordering in paranoid_entry to switch CR3 before GS.

I'm okay with mapping __per_cpu_offset.

>
> >
> >> the stack canary,
> >
> > That's going to be a very tough sell.
> >
>
> I can get rid of this, but this will require to disable stack-protector for
> any function that we can call while using the user page-table, like already
> done in patch 21 (x86/entry: Disable stack-protector for IST entry C handlers).
>

You could probably get away with using a different stack protector
canary before and after the CR3 switch as long as you are careful to
have the canary restored when you return from whatever function is
involved.

\
 
 \ /
  Last update: 2020-11-11 00:40    [W:0.064 / U:0.724 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site