* [PATCH] x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area
@ 2019-07-25 16:37 Andy Lutomirski
2019-07-25 17:28 ` Peter Zijlstra
0 siblings, 1 reply; 3+ messages in thread
From: Andy Lutomirski @ 2019-07-25 16:37 UTC (permalink / raw
To: LKML; +Cc: x86, Borislav Petkov, Peter Zijlstra, Andy Lutomirski
A data breakpoint near the top of an IST stack will cause unresoverable
recursion. A data breakpoint on the GDT, IDT, or TSS is terrifying.
Prevent either of these from happening.
Co-developed-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---
The rest of my series is still in progress -- as we all know, idtentry
is a morass. But this is self-contained and is an obvious fix.
arch/x86/include/asm/cpu_entry_area.h | 10 ++++++++++
arch/x86/kernel/hw_breakpoint.c | 17 +++++++++++++++++
2 files changed, 27 insertions(+)
diff --git a/arch/x86/include/asm/cpu_entry_area.h b/arch/x86/include/asm/cpu_entry_area.h
index e23e2d9a92d7..3f50d4738487 100644
--- a/arch/x86/include/asm/cpu_entry_area.h
+++ b/arch/x86/include/asm/cpu_entry_area.h
@@ -126,6 +126,16 @@ static inline struct entry_stack *cpu_entry_stack(int cpu)
return &get_cpu_entry_area(cpu)->entry_stack_page.stack;
}
+/*
+ * Checks whether the range from addr to end, inclusive, overlaps the CPU
+ * entry area range.
+ */
+static inline bool within_cpu_entry_area(unsigned long addr, unsigned long end)
+{
+ return end >= CPU_ENTRY_AREA_PER_CPU &&
+ addr < (CPU_ENTRY_AREA_PER_CPU + CPU_ENTRY_AREA_TOT_SIZE);
+}
+
#define __this_cpu_ist_top_va(name) \
CEA_ESTACK_TOP(__this_cpu_read(cea_exception_stacks), name)
diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
index 218c8917118e..dc4581fe4b4e 100644
--- a/arch/x86/kernel/hw_breakpoint.c
+++ b/arch/x86/kernel/hw_breakpoint.c
@@ -231,6 +231,23 @@ static int arch_build_bp_info(struct perf_event *bp,
const struct perf_event_attr *attr,
struct arch_hw_breakpoint *hw)
{
+ unsigned long bp_end;
+
+ /* Ensure that bp_end does not oveflow. */
+ if (attr->bp_len >= ULONG_MAX - attr->bp_addr)
+ return -EINVAL;
+
+ bp_end = attr->bp_addr + attr->bp_len - 1;
+
+ /*
+ * Prevent any breakpoint of any type that overlaps the
+ * cpu_entry_area. This protects the IST stacks and also
+ * reduces the chance that we ever find out what happens if
+ * there's a data breakpoint on the GDT, IDT, or TSS.
+ */
+ if (within_cpu_entry_area(attr->bp_addr, bp_end))
+ return -EINVAL;
+
hw->address = attr->bp_addr;
hw->mask = 0;
--
2.21.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area
2019-07-25 16:37 [PATCH] x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area Andy Lutomirski
@ 2019-07-25 17:28 ` Peter Zijlstra
2019-07-25 22:11 ` Thomas Gleixner
0 siblings, 1 reply; 3+ messages in thread
From: Peter Zijlstra @ 2019-07-25 17:28 UTC (permalink / raw
To: Andy Lutomirski; +Cc: LKML, x86, Borislav Petkov
On Thu, Jul 25, 2019 at 09:37:15AM -0700, Andy Lutomirski wrote:
> A data breakpoint near the top of an IST stack will cause unresoverable
> recursion. A data breakpoint on the GDT, IDT, or TSS is terrifying.
> Prevent either of these from happening.
>
> Co-developed-by: Peter Zijlstra <peterz@infradead.org>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
One small nit beflow.
> ---
>
> arch/x86/include/asm/cpu_entry_area.h | 10 ++++++++++
> arch/x86/kernel/hw_breakpoint.c | 17 +++++++++++++++++
> 2 files changed, 27 insertions(+)
>
> diff --git a/arch/x86/include/asm/cpu_entry_area.h b/arch/x86/include/asm/cpu_entry_area.h
> index e23e2d9a92d7..3f50d4738487 100644
> --- a/arch/x86/include/asm/cpu_entry_area.h
> +++ b/arch/x86/include/asm/cpu_entry_area.h
> @@ -126,6 +126,16 @@ static inline struct entry_stack *cpu_entry_stack(int cpu)
> return &get_cpu_entry_area(cpu)->entry_stack_page.stack;
> }
>
> +/*
> + * Checks whether the range from addr to end, inclusive, overlaps the CPU
> + * entry area range.
> + */
> +static inline bool within_cpu_entry_area(unsigned long addr, unsigned long end)
> +{
> + return end >= CPU_ENTRY_AREA_PER_CPU &&
> + addr < (CPU_ENTRY_AREA_PER_CPU + CPU_ENTRY_AREA_TOT_SIZE);
> +}
> +
> #define __this_cpu_ist_top_va(name) \
> CEA_ESTACK_TOP(__this_cpu_read(cea_exception_stacks), name)
>
> diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
> index 218c8917118e..dc4581fe4b4e 100644
> --- a/arch/x86/kernel/hw_breakpoint.c
> +++ b/arch/x86/kernel/hw_breakpoint.c
> @@ -231,6 +231,23 @@ static int arch_build_bp_info(struct perf_event *bp,
> const struct perf_event_attr *attr,
> struct arch_hw_breakpoint *hw)
> {
> + unsigned long bp_end;
> +
> + /* Ensure that bp_end does not oveflow. */
> + if (attr->bp_len >= ULONG_MAX - attr->bp_addr)
> + return -EINVAL;
> +
> + bp_end = attr->bp_addr + attr->bp_len - 1;
The alternative (and possibly more conventional) overflow test would be:
if (bp_end < attr->bp_addr)
return -EINVAL;
> +
> + /*
> + * Prevent any breakpoint of any type that overlaps the
> + * cpu_entry_area. This protects the IST stacks and also
> + * reduces the chance that we ever find out what happens if
> + * there's a data breakpoint on the GDT, IDT, or TSS.
> + */
> + if (within_cpu_entry_area(attr->bp_addr, bp_end))
> + return -EINVAL;
> +
> hw->address = attr->bp_addr;
> hw->mask = 0;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area
2019-07-25 17:28 ` Peter Zijlstra
@ 2019-07-25 22:11 ` Thomas Gleixner
0 siblings, 0 replies; 3+ messages in thread
From: Thomas Gleixner @ 2019-07-25 22:11 UTC (permalink / raw
To: Peter Zijlstra; +Cc: Andy Lutomirski, LKML, x86, Borislav Petkov
On Thu, 25 Jul 2019, Peter Zijlstra wrote:
> On Thu, Jul 25, 2019 at 09:37:15AM -0700, Andy Lutomirski wrote:
> > A data breakpoint near the top of an IST stack will cause unresoverable
unresoverable?
> > recursion. A data breakpoint on the GDT, IDT, or TSS is terrifying.
> > Prevent either of these from happening.
> >
> > Co-developed-by: Peter Zijlstra <peterz@infradead.org>
Co-developed-by want's a Signed-off-by of the co-developer
> > Signed-off-by: Andy Lutomirski <luto@kernel.org>
> > diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
> > index 218c8917118e..dc4581fe4b4e 100644
> > --- a/arch/x86/kernel/hw_breakpoint.c
> > +++ b/arch/x86/kernel/hw_breakpoint.c
> > @@ -231,6 +231,23 @@ static int arch_build_bp_info(struct perf_event *bp,
> > const struct perf_event_attr *attr,
> > struct arch_hw_breakpoint *hw)
> > {
> > + unsigned long bp_end;
> > +
> > + /* Ensure that bp_end does not oveflow. */
oveflow?
> > + if (attr->bp_len >= ULONG_MAX - attr->bp_addr)
> > + return -EINVAL;
> > +
> > + bp_end = attr->bp_addr + attr->bp_len - 1;
>
> The alternative (and possibly more conventional) overflow test would be:
>
> if (bp_end < attr->bp_addr)
> return -EINVAL;
Yes please.
> > +
> > + /*
> > + * Prevent any breakpoint of any type that overlaps the
> > + * cpu_entry_area. This protects the IST stacks and also
> > + * reduces the chance that we ever find out what happens if
I surely hope that the chance is reduced to 0 ...
I know this is all an annoyance brought to us by hardware and I surely
enjoy the hidden sarcasm but please make this information as technically
accurate as possible. Put the rant into an extra line of the comment :)
> > + * there's a data breakpoint on the GDT, IDT, or TSS.
> > + */
> > + if (within_cpu_entry_area(attr->bp_addr, bp_end))
> > + return -EINVAL;
Thanks,
tglx
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-07-25 22:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-07-25 16:37 [PATCH] x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area Andy Lutomirski
2019-07-25 17:28 ` Peter Zijlstra
2019-07-25 22:11 ` Thomas Gleixner
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.