Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION

From: Mark Rutland
Date: Wed Feb 08 2017 - 09:50:02 EST


On Wed, Feb 08, 2017 at 10:12:50AM +0100, Peter Zijlstra wrote:
> On x86 have have __ex_table and __bug_table. The former is used for all
> sorts of things, including fixing up faults.
>
> Now, our struct exception_table_entry has a third field used to specify
> a handler, see commit:
>
> 548acf19234d ("x86/mm: Expand the exception table logic to allow new handling options")

Ah; neat!

> Still, if we want to allow a generic implementation that does a function
> call, the handler prototype should probably look like:
>
> void exception_value(unsigned long value);
>
> Which means the arch bits need a trampoline and we also need to encode
> that. The best I've come up with is having nr_regs trampolines and
> stuffing the trampoline function in the ->handler field and then using
> the ->to field to encode the actual handler.
>
> Something like:
>
> #define EX_REG_HANDLER(_reg) \
> bool ex_handler_value_##_reg(const struct exception_table_entry *fixup, \
> struct pt_regs *regs, int trapnr) \
> { \
> void (*handler)(unsigned long) = \
> (void *)((unsigned long)&fixup->to + fixup->to); \
> \
> if (trapnr != X86_TRAP_UD) \
> return false; \
> \
> regs->ip += 2; /* size of UD2 instruction */ \
> handler(regs->_reg); \
> return true; \
> }
>
> EX_REG_HANDLER(bx);
> EX_REG_HANDLER(cx);
> ...
> EX_REG_HANDLER(ss);
>
>
> asm (
> " .macro reg_to_handler r\n"
> " .irp rs,bx,cx,...,ss\n"
> " .ifc \\r, %\\rs\n"
> " ex_handler_value_\\rs\n"
> " .endif\n"
> " .endr\n"
> " .endm\n"
> );
>
> #define EXCEPTION_VALUE(val, handler) \
> asm volatile ("1: ud2" \
> _ASM_EXTABLE_HANDLE(1b, handler, \
> reg_to_handler %0) \
> : : "r" (val))
>
>
> Where the generic version can simply be:
>
> #define EXCEPTION_VALUE(val, handler) handler((unsigned long)val)
>
> Makes sense?

That all makes sense to me.

I'll take a look at putting together an arm64 equivalent to the x86
extable patch, along with cleanup to our SW breakpoint code (which we
use in lieu for x86's UD2).

Thanks,
Mark.