Messages in this thread | | | From | Andy Lutomirski <> | Date | Tue, 10 Nov 2020 15:39:43 -0800 | Subject | Re: [RFC][PATCH 13/24] x86/pti: Extend PTI user mappings |
| |
On Mon, Nov 9, 2020 at 11:54 AM Alexandre Chartre <alexandre.chartre@oracle.com> wrote: > > > [Copying the reply to Andy in the thread with the right email addresses] > > On 11/9/20 6:28 PM, Andy Lutomirski wrote: > > On Mon, Nov 9, 2020 at 3:22 AM Alexandre Chartre > > <alexandre.chartre@oracle.com> wrote: > >> > >> Extend PTI user mappings so that more kernel entry code can be executed > >> with the user page-table. To do so, we need to map syscall and interrupt > >> entry code, > > > > Probably fine. > > > >> per cpu offsets (__per_cpu_offset, which is used some in > >> entry code), > > > > This likely already leaks due to vulnerable CPUs leaking address space > > layout info. > > I forgot to update the comment, I am not mapping __per_cpu_offset anymore. > > However, if we do map __per_cpu_offset then we don't need to enforce the > ordering in paranoid_entry to switch CR3 before GS.
I'm okay with mapping __per_cpu_offset.
> > > > >> the stack canary, > > > > That's going to be a very tough sell. > > > > I can get rid of this, but this will require to disable stack-protector for > any function that we can call while using the user page-table, like already > done in patch 21 (x86/entry: Disable stack-protector for IST entry C handlers). >
You could probably get away with using a different stack protector canary before and after the CR3 switch as long as you are careful to have the canary restored when you return from whatever function is involved.
| |