From patchwork Thu Mar 1 12:53:47 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Shi X-Patchwork-Id: 10251455 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0CD3160211 for ; Thu, 1 Mar 2018 13:42:56 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E5C122223E for ; Thu, 1 Mar 2018 13:42:55 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A363820CCF; Thu, 1 Mar 2018 13:42:55 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 13EF62846C for ; Thu, 1 Mar 2018 13:41:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=57ZW7ZVbnd22lmuBpW01kpzHIQobdl47M3mZpe6vID0=; b=cxh/vRY1hQGx62fuYlNpsrf81X 0zckuo7hxH1adMymhepjHVA+DobU+beLvMe7v6QiCPkk8LuP2Fg0z5apY/90yieUWXql7WjojVQeb dxmef54cg67YBsuN1qIVc0YH2Aar1J1Wn0CDRcpT/VxmPK5mQ/GpToJ0Pm5hFbkyGBR0pMM/BN9bs CwzQTtU9jtn/pVca9zX4ZLWODSU6UkU5UAwZMikdIXdEKaUXfDMRwPki1Az9LcoYDi+c7VqfGesgo Aa7a6+JNkkuk7tdZ74MQ8WUsaBWuBTBXKx622GeHAXL3NXy5deuo2Kzsr+tUAD+qk3LaFg5XdOlkI hPnVc9QA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1erOSc-0004Hb-JQ; Thu, 01 Mar 2018 13:41:26 +0000 Received: from merlin.infradead.org ([2001:8b0:10b:1231::1]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1erOHU-0001sV-63 for linux-arm-kernel@bombadil.infradead.org; Thu, 01 Mar 2018 13:29:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=merlin.20170209; h=References:In-Reply-To:Message-Id:Date: Subject:Cc:To:From:Sender:Reply-To:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=i4j5LLlcJTrNi6a03osuM7FMBFfhyS0MAdksfWz86sU=; b=IsLqSRRfHBFSB0KlOI+IbcSHz WNc/wdwgESbPlN1/txAdx7cl/KbOW4IFKNrEOnRbNionNgISDPtMeQyzUqCFo8s7IOHi5xkWObkKb WzkpLU4Mf/KJ3P0F7tTaPLrL3C+Gv7AdkvgnMtOkz5dRj83tAyAUYIPTvAAIp1LpmS+30QAAmYd8u VIezfB/7I6F1jMWnQypJDeRxBnh2fwnyS2MNRPMvpEQLEtW46+gOeaXQ7QF9pBCzc3UgoOni012Ct QM0jNHL7Ql41wz+A74F3MaTjpBe2i2g1eeLmQqutzTNYsK749KX9DL3jB0Tv7hggLSqdNwp//FC2U aneFjQ7Jw==; Received: from mail-pl0-x241.google.com ([2607:f8b0:400e:c01::241]) by merlin.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1erNlN-0002CK-SW for linux-arm-kernel@lists.infradead.org; Thu, 01 Mar 2018 12:56:47 +0000 Received: by mail-pl0-x241.google.com with SMTP id bb3-v6so3595131plb.2 for ; Thu, 01 Mar 2018 04:56:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=i4j5LLlcJTrNi6a03osuM7FMBFfhyS0MAdksfWz86sU=; b=R0saQ4fweThOggq/TobnvzHWJpLRton+5jJ0eFNYqO5Snpv2UioTyy6aGI6w4P0KOB ON5T9SkWwhlF0sSoZBtM07coOH5WOu7BJ3Wu1f+tjr6cxw9qZo+ztL/JTJLREOdqttzI 7BYcQCOeS00mxpxGtGWiH+X72LTRbi7E3+YJA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=i4j5LLlcJTrNi6a03osuM7FMBFfhyS0MAdksfWz86sU=; b=iRen8bAEKV2UlMD1jX00hWRpXFG6sG0eLwv3UflXN6D/+9c1u8xssfm730zASKI+3w 7zTEFSLAa0ndBu23Ft1w1mS5VBE8FrXfvu4zGw5V7W7c7MDt0t80SwInB8/bQnYzrW07 eQPuGLC9wbZUNq2xYIgrmLERd5BEvV/hohDUeANBt4f4fm4GL52tpg/pQ6eIeuFM7cAH L5KD06BWdfnWYORknj3o3otkHmz1vkOFOv7yzy+DTREPmfjhB0br/Ywg7nLxLL0iPmbr f2L11dqSUwEsaGgbvfi/+7KlH+xEWkkLzWru/53aICJNEwsxoCOtUH+ZhiXixXcn6Pcb mkzQ== X-Gm-Message-State: APf1xPDlMM7kdtPYjcCneXK/fG/wFMgxVErzRM4/BuIglUNGrW9Iw2i1 7cf6puDXsbjqp7gPoArYQcjUNg== X-Google-Smtp-Source: AG47ELsvVB0DSQF2OwnASvNYr6xc0pimqOciuNc9K+uEPMwaAu/w78ro4ekF5MjwucxAoQDv+70C4A== X-Received: by 2002:a17:902:b605:: with SMTP id b5-v6mr1873928pls.354.1519908991099; Thu, 01 Mar 2018 04:56:31 -0800 (PST) Received: from localhost.localdomain (176.122.172.82.16clouds.com. [176.122.172.82]) by smtp.gmail.com with ESMTPSA id x4sm2289655pfb.46.2018.03.01.04.56.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 01 Mar 2018 04:56:30 -0800 (PST) From: Alex Shi To: Marc Zyngier , Will Deacon , Ard Biesheuvel , Catalin Marinas , stable@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 10/45] arm64: Use pointer masking to limit uaccess speculation Date: Thu, 1 Mar 2018 20:53:47 +0800 Message-Id: <1519908862-11425-11-git-send-email-alex.shi@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519908862-11425-1-git-send-email-alex.shi@linaro.org> References: <1519908862-11425-1-git-send-email-alex.shi@linaro.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180301_075645_932349_D30DD11D X-CRM114-Status: GOOD ( 15.93 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Robin Murphy MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP From: Robin Murphy commit 4d8efc2d5ee4 upstream. Similarly to x86, mitigate speculation past an access_ok() check by masking the pointer against the address limit before use. Even if we don't expect speculative writes per se, it is plausible that a CPU may still speculate at least as far as fetching a cache line for writing, hence we also harden put_user() and clear_user() for peace of mind. Signed-off-by: Robin Murphy Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas --- arch/arm64/include/asm/uaccess.h | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index 7b1eb49..3531fec 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -170,6 +170,26 @@ static inline void uaccess_enable_not_uao(void) } /* + * Sanitise a uaccess pointer such that it becomes NULL if above the + * current addr_limit. + */ +#define uaccess_mask_ptr(ptr) (__typeof__(ptr))__uaccess_mask_ptr(ptr) +static inline void __user *__uaccess_mask_ptr(const void __user *ptr) +{ + void __user *safe_ptr; + + asm volatile( + " bics xzr, %1, %2\n" + " csel %0, %1, xzr, eq\n" + : "=&r" (safe_ptr) + : "r" (ptr), "r" (current_thread_info()->addr_limit) + : "cc"); + + csdb(); + return safe_ptr; +} + +/* * The "__xxx" versions of the user access functions do not verify the address * space - it must have been done previously with a separate "access_ok()" * call. @@ -241,7 +261,7 @@ do { \ __typeof__(*(ptr)) __user *__p = (ptr); \ might_fault(); \ access_ok(VERIFY_READ, __p, sizeof(*__p)) ? \ - __get_user((x), __p) : \ + __p = uaccess_mask_ptr(__p), __get_user((x), __p) : \ ((x) = 0, -EFAULT); \ }) @@ -307,7 +327,7 @@ do { \ __typeof__(*(ptr)) __user *__p = (ptr); \ might_fault(); \ access_ok(VERIFY_WRITE, __p, sizeof(*__p)) ? \ - __put_user((x), __p) : \ + __p = uaccess_mask_ptr(__p), __put_user((x), __p) : \ -EFAULT; \ }) @@ -368,7 +388,7 @@ static inline unsigned long __must_check copy_in_user(void __user *to, const voi static inline unsigned long __must_check clear_user(void __user *to, unsigned long n) { if (access_ok(VERIFY_WRITE, to, n)) - n = __clear_user(to, n); + n = __clear_user(__uaccess_mask_ptr(to), n); return n; }