From patchwork Sun Sep 3 23:46:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cengiz Can X-Patchwork-Id: 1829249 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=NffDlWlV; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Rf7hT4kBDz1ynq for ; Mon, 4 Sep 2023 09:46:33 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1qcwnQ-0000U0-Tv; Sun, 03 Sep 2023 23:46:24 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1qcwnN-0000T4-JS for kernel-team@lists.ubuntu.com; Sun, 03 Sep 2023 23:46:21 +0000 Received: from mail-ej1-f72.google.com (mail-ej1-f72.google.com [209.85.218.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 4A7D03F13F for ; Sun, 3 Sep 2023 23:46:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1693784781; bh=ky0Jndn/lgw+AIKHqUZ3T9CgdObz4hK8TJNQc14oKxY=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=NffDlWlV2fitKpqMlGhmyYznCGDqwcDr01KyY3ASUjIRtM44w0cPivFVYzFYohuwc S4a1/OwuGwLbQY6saORjhAjdZqJAwKkj6xFATCM7kmm18QQt6jRdHT0JiP+hXYfQPC tfVLH5VMfqlchnrrketUnvvY0j9F8kP0kRAIShvTsv6V1RkCD7RAOCHnAm96/4bzt6 dzwFNAq6crAz7R2pX5tKV8Ytf3VDYNOIuidpruLeAAoG9/L7oIwzIss4O3OGapNOC/ C1FBzAn8AZkVcbL9B3mNN5vn7pB+07X0iZpO1CrI1zWWTO8cwQhffF2hGPV/CibnvG 3NN5+9GfARxuw== Received: by mail-ej1-f72.google.com with SMTP id a640c23a62f3a-9a647551b7dso83192766b.1 for ; Sun, 03 Sep 2023 16:46:21 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1693784780; x=1694389580; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ky0Jndn/lgw+AIKHqUZ3T9CgdObz4hK8TJNQc14oKxY=; b=gursiyNCV6wTIaM3oXkzUmt8lH+/4uOuL6FoJzidOt2ZBRRVsQ+Ha2hL6H7fZUiGeG N1zy1snFpZazUUecdIExIeAYXx8Gabuz8qymEQkHX0iPTr1WxP9+j4zxfroBToxDGKmO Gx/SVIU0kfWumJHZCScRZ3+jhheoz7/nULgXcP2ctDZZThQOj/ME3pTxXHWMDgET5jqf pGts6gZeHTDE6MGh2BCK0soq9NVfstdXm+10QkP8Du8zdxMGIPKtPHbn9Rp0JXBSq1f3 dhzx+JeS23b7iJDdNsC/t/SzRTvGW2IYEioU9VcvxEKp70qvH2QxH5F+bLepT2aPXgPE ktww== X-Gm-Message-State: AOJu0YwaIRkC4drlkkKIdF8a5vo/EaelThFu0AkO0AzQTGVKNjPX711E ptBrZKUgqJ8WnLTVcFilcnTlgSAsfnPStNHeCcO9kbSm9MswRZxJmmn5t2QiHzBAI6ELoaz6N27 b0wMvbq85iF2MO10gdTawqCCb4M4y8OW4syuIMF1Wu3NmnnvkeifA X-Received: by 2002:a17:907:3e1f:b0:9a5:9b93:d60d with SMTP id hp31-20020a1709073e1f00b009a59b93d60dmr11497599ejc.36.1693784780720; Sun, 03 Sep 2023 16:46:20 -0700 (PDT) X-Google-Smtp-Source: AGHT+IH72OUQqZokO0OjgbmQCdp5Q9aLc/NsSj1gDAKcYRO2neMcRFEnn2adZt5EVynJjh5oOdCtsA== X-Received: by 2002:a17:907:3e1f:b0:9a5:9b93:d60d with SMTP id hp31-20020a1709073e1f00b009a59b93d60dmr11497595ejc.36.1693784780449; Sun, 03 Sep 2023 16:46:20 -0700 (PDT) Received: from localhost ([24.133.89.143]) by smtp.gmail.com with ESMTPSA id n19-20020a170906379300b00991faf3810esm5449650ejc.146.2023.09.03.16.46.19 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 03 Sep 2023 16:46:20 -0700 (PDT) From: Cengiz Can To: kernel-team@lists.ubuntu.com Subject: [SRU Focal 3/6] x86/mm: Randomize per-cpu entry area Date: Mon, 4 Sep 2023 02:46:00 +0300 Message-Id: <20230903234603.859937-4-cengiz.can@canonical.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230903234603.859937-1-cengiz.can@canonical.com> References: <20230903234603.859937-1-cengiz.can@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Peter Zijlstra Seth found that the CPU-entry-area; the piece of per-cpu data that is mapped into the userspace page-tables for kPTI is not subject to any randomization -- irrespective of kASLR settings. On x86_64 a whole P4D (512 GB) of virtual address space is reserved for this structure, which is plenty large enough to randomize things a little. As such, use a straight forward randomization scheme that avoids duplicates to spread the existing CPUs over the available space. [ bp: Fix le build. ] Reported-by: Seth Jenkins Reviewed-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Dave Hansen Signed-off-by: Borislav Petkov (backported from commit 97e3d26b5e5f371b3ee223d94dd123e6c442ba80) [cascardo: macros in a different file] [cascardo: no checks in breakpoint] [cascardo: get_cpu_entry_area is not noinstr] [cascardo: include ] CVE-2023-0597 Signed-off-by: Thadeu Lima de Souza Cascardo --- arch/x86/include/asm/cpu_entry_area.h | 13 ++++---- arch/x86/mm/cpu_entry_area.c | 47 +++++++++++++++++++++++++-- 2 files changed, 52 insertions(+), 8 deletions(-) diff --git a/arch/x86/include/asm/cpu_entry_area.h b/arch/x86/include/asm/cpu_entry_area.h index 0d1d37d8b279..1a569407312f 100644 --- a/arch/x86/include/asm/cpu_entry_area.h +++ b/arch/x86/include/asm/cpu_entry_area.h @@ -111,10 +111,6 @@ struct cpu_entry_area { }; #define CPU_ENTRY_AREA_SIZE (sizeof(struct cpu_entry_area)) -#define CPU_ENTRY_AREA_ARRAY_SIZE (CPU_ENTRY_AREA_SIZE * NR_CPUS) - -/* Total size includes the readonly IDT mapping page as well: */ -#define CPU_ENTRY_AREA_TOTAL_SIZE (CPU_ENTRY_AREA_ARRAY_SIZE + PAGE_SIZE) DECLARE_PER_CPU(struct cpu_entry_area *, cpu_entry_area); DECLARE_PER_CPU(struct cea_exception_stacks *, cea_exception_stacks); @@ -128,8 +124,13 @@ extern void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags); #define CPU_ENTRY_AREA_RO_IDT_VADDR ((void *)CPU_ENTRY_AREA_RO_IDT) -#define CPU_ENTRY_AREA_MAP_SIZE \ - (CPU_ENTRY_AREA_PER_CPU + CPU_ENTRY_AREA_ARRAY_SIZE - CPU_ENTRY_AREA_BASE) +#ifdef CONFIG_X86_32 +#define CPU_ENTRY_AREA_MAP_SIZE (CPU_ENTRY_AREA_PER_CPU + \ + (CPU_ENTRY_AREA_SIZE * NR_CPUS) - \ + CPU_ENTRY_AREA_BASE) +#else +#define CPU_ENTRY_AREA_MAP_SIZE P4D_SIZE +#endif extern struct cpu_entry_area *get_cpu_entry_area(int cpu); diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c index 102e1d63f99a..e7a201f3fa65 100644 --- a/arch/x86/mm/cpu_entry_area.c +++ b/arch/x86/mm/cpu_entry_area.c @@ -4,6 +4,7 @@ #include #include #include +#include #include #include @@ -16,11 +17,52 @@ static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage) #ifdef CONFIG_X86_64 static DEFINE_PER_CPU_PAGE_ALIGNED(struct exception_stacks, exception_stacks); DEFINE_PER_CPU(struct cea_exception_stacks*, cea_exception_stacks); + +static DEFINE_PER_CPU_READ_MOSTLY(unsigned long, _cea_offset); + +static __always_inline unsigned int cea_offset(unsigned int cpu) +{ + return per_cpu(_cea_offset, cpu); +} + +static __init void init_cea_offsets(void) +{ + unsigned int max_cea; + unsigned int i, j; + + max_cea = (CPU_ENTRY_AREA_MAP_SIZE - PAGE_SIZE) / CPU_ENTRY_AREA_SIZE; + + /* O(sodding terrible) */ + for_each_possible_cpu(i) { + unsigned int cea; + +again: + cea = prandom_u32_max(max_cea); + + for_each_possible_cpu(j) { + if (cea_offset(j) == cea) + goto again; + + if (i == j) + break; + } + + per_cpu(_cea_offset, i) = cea; + } +} +#else /* !X86_64 */ +DECLARE_PER_CPU_PAGE_ALIGNED(struct doublefault_stack, doublefault_stack); + +static __always_inline unsigned int cea_offset(unsigned int cpu) +{ + return cpu; +} +static inline void init_cea_offsets(void) { } #endif struct cpu_entry_area *get_cpu_entry_area(int cpu) { - unsigned long va = CPU_ENTRY_AREA_PER_CPU + cpu * CPU_ENTRY_AREA_SIZE; + unsigned long va = CPU_ENTRY_AREA_PER_CPU + cea_offset(cpu) * CPU_ENTRY_AREA_SIZE; BUILD_BUG_ON(sizeof(struct cpu_entry_area) % PAGE_SIZE != 0); return (struct cpu_entry_area *) va; @@ -186,7 +228,6 @@ static __init void setup_cpu_entry_area_ptes(void) /* The +1 is for the readonly IDT: */ BUILD_BUG_ON((CPU_ENTRY_AREA_PAGES+1)*PAGE_SIZE != CPU_ENTRY_AREA_MAP_SIZE); - BUILD_BUG_ON(CPU_ENTRY_AREA_TOTAL_SIZE != CPU_ENTRY_AREA_MAP_SIZE); BUG_ON(CPU_ENTRY_AREA_BASE & ~PMD_MASK); start = CPU_ENTRY_AREA_BASE; @@ -202,6 +243,8 @@ void __init setup_cpu_entry_areas(void) { unsigned int cpu; + init_cea_offsets(); + setup_cpu_entry_area_ptes(); for_each_possible_cpu(cpu)