Re: [PATCH v10 08/15] x86/vsyscall: Reorganize the page fault emulation code

[Edgecombe, Rick P]

On Tue, 2025-10-07 at 11:48 -0700, Dave Hansen wrote:
> On 10/7/25 11:37, Edgecombe, Rick P wrote:
> > >   	/*
> > >   	 * No point in checking CS -- the only way to get here is a user mode
> > >   	 * trap to a high address, which means that we're in 64-bit user code.
> > I don't know. Is this as true any more? We are now sometimes guessing based on
> > regs->ip of a #GP. What if the kernel accidentally tries to jump to the vsyscall
> > address? Then we are reading the kernel stack and strange things. Maybe it's
> > worth replacing the comment with a check? Feel free to call this paranoid.
> 
> The first check in emulate_vsyscall() is:
> 
>        /* Write faults or kernel-privilege faults never get fixed up. */
>        if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
>                return false;
> 
> If the kernel jumped to the vsyscall page, it would end up there, return
> false, and never reach the code near the "No point in checking CS" comment.
> 
> Right? Or am I misunderstanding the scenario you're calling out?
> 
> If I'm understanding it right, I'd be a bit reluctant to add a CS check
> as well.

Sorry, I could have been clearer. Yes, I assumed that the comment was talking
about that check you quote.

But I'm looking at this applied. The following patches (which don't include that
hunk), add another call site:

bool emulate_vsyscall_gp(struct pt_regs *regs)
{
	if (!cpu_feature_enabled(X86_FEATURE_LASS))
		return false;

	/* Emulate only if the RIP points to the vsyscall address */
	if (!is_vsyscall_vaddr(regs->ip))
		return false;

	return __emulate_vsyscall(regs, regs->ip);
}

If indeed we should add a check, it should probably go in one of the later
patches and not this one.