From patchwork Fri Nov 4 22:35:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 13032660 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54FF2C4332F for ; Fri, 4 Nov 2022 22:39:57 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id CA0BB8E0010; Fri, 4 Nov 2022 18:39:43 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id BDC748E0007; Fri, 4 Nov 2022 18:39:43 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9E22C8E0010; Fri, 4 Nov 2022 18:39:43 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 6FAF78E0007 for ; Fri, 4 Nov 2022 18:39:43 -0400 (EDT) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 59E13A0497 for ; Fri, 4 Nov 2022 22:39:43 +0000 (UTC) X-FDA: 80097228246.04.808A341 Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by imf14.hostedemail.com (Postfix) with ESMTP id DDD99100002 for ; Fri, 4 Nov 2022 22:39:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1667601582; x=1699137582; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=kPqO2kwM78EGnIAhrKsxSWDtILBo5g6MXomNZ5elCHU=; b=A7wk8CqKSWPo0z8bOPm8GcsfTH+kgsSlHdXKGfXcr5RIXTbjI5zgJdMC glMbs3Kd0B3Ck8vWOHSgOQMB7mUFgcn8gDIe/enaQ7bi/IO+B0ozDOO7A ZV+yJROsNEC6T5Vo6YGZFKonqaAxbSXa4MIFcupMeAN7zhICHOVI7hm9C 3bt9JpevxxHMX4L683SBvAEJpTYWvkp21CYFXaIu3yim1QOYtGltSBS8Y 5MrVKsvc09aIl2MWR74BSVEGmidpEmujEOs1g8MIUVN/AKZXILsJ22EpL beiwiIcBtD1BVZeX/izpK93PFkes7LGwcEHLLBmrZ7PrXIkqJQQKSzyr/ A==; X-IronPort-AV: E=McAfee;i="6500,9779,10521"; a="297559677" X-IronPort-AV: E=Sophos;i="5.96,138,1665471600"; d="scan'208";a="297559677" Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Nov 2022 15:39:42 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10521"; a="668514096" X-IronPort-AV: E=Sophos;i="5.96,138,1665471600"; d="scan'208";a="668514096" Received: from adhjerms-mobl1.amr.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.212.227.68]) by orsmga001-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Nov 2022 15:39:41 -0700 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V . Shankar" , Weijiang Yang , "Kirill A . Shutemov" , John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com, akpm@linux-foundation.org Cc: rick.p.edgecombe@intel.com Subject: [PATCH v3 22/37] mm: Don't allow write GUPs to shadow stack memory Date: Fri, 4 Nov 2022 15:35:49 -0700 Message-Id: <20221104223604.29615-23-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20221104223604.29615-1-rick.p.edgecombe@intel.com> References: <20221104223604.29615-1-rick.p.edgecombe@intel.com> ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=A7wk8CqK; spf=pass (imf14.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 134.134.136.20 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1667601583; a=rsa-sha256; cv=none; b=De1Dfqot2ngCgRvAHcVnnoHoq9GG12pSha3NNfL7WVRyfv1QGDPSr84MaaQ3t95ojniUAc 0ct5kFkdw8NaqHA708Ep3P1E/2Y636EnGII0cbUj7hBMGA7N+krcedCllGOn8tcFKJty/D BZFF/bJSrjU4AjVbmnnmX5k7v/M84LA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1667601583; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references:dkim-signature; bh=RivJ7Jf0eqPqaFzyb06995WGh+0/by2/HPOSpRY/UWg=; b=2lbf3sYdj0eKp1XW6t/0BxSNUPyPstqujjEuCLz5m6zknL+aOb6C1OJHzIFT4s4se19TzU inoe3Is1MocZMM+EhETLq9w+n9Rz7+2WuB1jrqwhDU8QJxWvTOyeMmunD3YB0TTtvhngSo YPyIfDMm7J5VS6KTktsUSUq7tqqxGpY= X-Stat-Signature: 9qaq1eqtww9kifffgih78bemf61bcy1g X-Rspamd-Queue-Id: DDD99100002 Authentication-Results: imf14.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=A7wk8CqK; spf=pass (imf14.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 134.134.136.20 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com X-Rspam-User: X-Rspamd-Server: rspam12 X-HE-Tag: 1667601582-561536 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The x86 Control-flow Enforcement Technology (CET) feature includes a new type of memory called shadow stack. This shadow stack memory has some unusual properties, which requires some core mm changes to function properly. Shadow stack memory is writable only in very specific, controlled ways. However, since it is writable, the kernel treats it as such. As a result there remain many ways for userspace to trigger the kernel to write to shadow stack's via get_user_pages(, FOLL_WRITE) operations. To make this a little less exposed, block writable GUPs for shadow stack VMAs. Still allow FOLL_FORCE to write through shadow stack protections, as it does for read-only protections. Tested-by: Pengfei Xu Tested-by: John Allen Signed-off-by: Rick Edgecombe --- v3: - Add comment in __pte_access_permitted() (Dave) - Remove unneeded shadow stack specific check in __pte_access_permitted() (Jann) arch/x86/include/asm/pgtable.h | 5 +++++ mm/gup.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h index d57dc1b2d3e8..0d18f3a4373d 100644 --- a/arch/x86/include/asm/pgtable.h +++ b/arch/x86/include/asm/pgtable.h @@ -1637,6 +1637,11 @@ static inline bool __pte_access_permitted(unsigned long pteval, bool write) { unsigned long need_pte_bits = _PAGE_PRESENT|_PAGE_USER; + /* + * Write=0,Dirty=1 PTEs are shadow stack, which the kernel + * shouldn't generally allow access to, but since they + * are already Write=0, the below logic covers both cases. + */ if (write) need_pte_bits |= _PAGE_RW; diff --git a/mm/gup.c b/mm/gup.c index fe195d47de74..411befd4d431 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -1062,7 +1062,7 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) return -EFAULT; if (write) { - if (!(vm_flags & VM_WRITE)) { + if (!(vm_flags & VM_WRITE) || (vm_flags & VM_SHADOW_STACK)) { if (!(gup_flags & FOLL_FORCE)) return -EFAULT; /*