lkml.org 
[lkml]   [2020]   [Feb]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC PATCH v9 13/27] x86/mm: Shadow Stack page fault error checking
    On Wed, Feb 05, 2020 at 10:19:21AM -0800, Yu-cheng Yu wrote:
    > If a page fault is triggered by a Shadow Stack (SHSTK) access
    > (e.g. CALL/RET) or SHSTK management instructions (e.g. WRUSSQ), then bit[6]
    > of the page fault error code is set.
    >
    > In access_error(), verify a SHSTK page fault is within a SHSTK memory area.
    > It is always an error otherwise.
    >
    > For a valid SHSTK access, set FAULT_FLAG_WRITE to effect copy-on-write.
    >
    > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>

    Reviewed-by: Kees Cook <keescook@chromium.org>

    -Kees

    > ---
    > arch/x86/include/asm/traps.h | 2 ++
    > arch/x86/mm/fault.c | 18 ++++++++++++++++++
    > 2 files changed, 20 insertions(+)
    >
    > diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
    > index 7ac26bbd0bef..8023d177fcd8 100644
    > --- a/arch/x86/include/asm/traps.h
    > +++ b/arch/x86/include/asm/traps.h
    > @@ -169,6 +169,7 @@ enum {
    > * bit 3 == 1: use of reserved bit detected
    > * bit 4 == 1: fault was an instruction fetch
    > * bit 5 == 1: protection keys block access
    > + * bit 6 == 1: shadow stack access fault
    > */
    > enum x86_pf_error_code {
    > X86_PF_PROT = 1 << 0,
    > @@ -177,5 +178,6 @@ enum x86_pf_error_code {
    > X86_PF_RSVD = 1 << 3,
    > X86_PF_INSTR = 1 << 4,
    > X86_PF_PK = 1 << 5,
    > + X86_PF_SHSTK = 1 << 6,
    > };
    > #endif /* _ASM_X86_TRAPS_H */
    > diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
    > index 304d31d8cbbc..9c1243302663 100644
    > --- a/arch/x86/mm/fault.c
    > +++ b/arch/x86/mm/fault.c
    > @@ -1187,6 +1187,17 @@ access_error(unsigned long error_code, struct vm_area_struct *vma)
    > (error_code & X86_PF_INSTR), foreign))
    > return 1;
    >
    > + /*
    > + * Verify X86_PF_SHSTK is within a Shadow Stack VMA.
    > + * It is always an error if there is a Shadow Stack
    > + * fault outside a Shadow Stack VMA.
    > + */
    > + if (error_code & X86_PF_SHSTK) {
    > + if (!(vma->vm_flags & VM_SHSTK))
    > + return 1;
    > + return 0;
    > + }
    > +
    > if (error_code & X86_PF_WRITE) {
    > /* write, present and write, not present: */
    > if (unlikely(!(vma->vm_flags & VM_WRITE)))
    > @@ -1344,6 +1355,13 @@ void do_user_addr_fault(struct pt_regs *regs,
    >
    > perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
    >
    > + /*
    > + * If the fault is caused by a Shadow Stack access,
    > + * i.e. CALL/RET/SAVEPREVSSP/RSTORSSP, then set
    > + * FAULT_FLAG_WRITE to effect copy-on-write.
    > + */
    > + if (hw_error_code & X86_PF_SHSTK)
    > + flags |= FAULT_FLAG_WRITE;
    > if (hw_error_code & X86_PF_WRITE)
    > flags |= FAULT_FLAG_WRITE;
    > if (hw_error_code & X86_PF_INSTR)
    > --
    > 2.21.0
    >

    --
    Kees Cook

    \
     
     \ /
      Last update: 2020-02-25 21:17    [W:2.219 / U:1.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site