RE: [PATCH] x86/uaccess: Use pointer masking to limit uaccess speculation

[David Laight]

From: Josh Poimboeuf
> Sent: 19 August 2020 18:02
> 
> On Wed, Aug 19, 2020 at 09:39:10AM -0700, Andy Lutomirski wrote:
> > On Wed, Aug 19, 2020 at 7:50 AM Josh Poimboeuf <jpoimboe@xxxxxxxxxx> wrote:
> > > +/*
> > > + * Sanitize a uaccess pointer such that it becomes NULL if it's not a valid
> > > + * user pointer.  This blocks speculative dereferences of user-controlled
> > > + * pointers.
> > > + */
> > > +#define uaccess_mask_ptr(ptr) \
> > > +       (__typeof__(ptr)) array_index_nospec((__force unsigned long)ptr, user_addr_max())
> > > +
> >
> > If I dug through all the macros correctly, this is generating a fairly
> > complex pile of math to account for the fact that user_addr_max() is
> > variable and that it's a nasty number.
> 
> The math is actually pretty simple.  It's identical to what getuser.S is
> doing:
> 
> 	cmp TASK_addr_limit(%_ASM_DX),%_ASM_AX
> 	sbb %_ASM_DX, %_ASM_DX
> 	and %_ASM_DX, %_ASM_AX
> 
> > But I don't think there's any particular need to use the real maximum
> > user address here.  Allowing a mis-speculated user access to a
> > non-canonical address or to the top guard page of the lower canonical
> > region is harmless.  With current kernels, a sequence like:
> >
> > if (likely((long)addr > 0) {
> >   masked_addr = addr & 0x7FFFFFFFFFFFFFFFUL;
> > } else {
> >   if (kernel fs) {
> >     masked_addr = addr;
> >   } else {
> >     EFAULT;
> >   }
> > }
> 
> The masking has to be done without conditional branches, otherwise it
> defeats the point.
> 
> > could plausibly be better.  But Christoph's series fixes this whole
> > mess, and I think that this should be:
> >
> > #define uaccess_mask_ptr(ptr) ((__typeof___(ptr)) (__force unsigned
> > long)ptr & USER_ADDR_MASK))
> >
> > where USER_ADDR_MASK is the appropriate value for 32-bit or 64-bit.
> 
> Yeah, we could do that.  Though in the meantime, the simple merge
> conflict resolution with Christoph's patches would be
> s/user_addr_max/TASK_SIZE_MAX/ in my uaccess_mask_ptr() macro.

For access_ok(ptr, size) I think you can do:
	(ptr | (ptr + size)) & (64bit ? 1 << 63 : 3 << 30)

Masking on 32bit is harder, something like.
Subtract 0xc0000000 (sets carry for user addresses)
sbb reg,reg to generate 0 (kernel) or ~0 (user).
And with the address - kernel addresses are now zero.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)