From patchwork Wed Feb 3 17:22:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Chang S. Bae" X-Patchwork-Id: 41920 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 1558639B8C96; Wed, 3 Feb 2021 17:27:27 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 1558639B8C96 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1612373247; bh=GmI24Ur2YbGgCXomtNPNuqDv1p9gmebDHY6vd2VHaxY=; h=To:Subject:Date:In-Reply-To:References:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=XYA6bxORcZ25F+Cx3um/6qZhzzDv/KnQYNeWiS0KyDZRaM7ZoqdXm0Ht/LY6NbwCJ SBk6pvD2Y4C+h5W57JOM7QB25TZEKVqIf38ICk+bl+iTg7w8VklLL4RZxKrI/WErhc WITZlFf6kLDlanS68EUcBWE0HjeQmLGc/7kdaxv8= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by sourceware.org (Postfix) with ESMTPS id 82EA0395041C for ; Wed, 3 Feb 2021 17:27:24 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 82EA0395041C IronPort-SDR: 81nv486a465EQyTSIWWlSytGHNglOYX7yGFUGtQPZS6WjOf/33NpHy2tCzEu8BZHDCSE2Bp5aJ WRMXNzD6vwEg== X-IronPort-AV: E=McAfee;i="6000,8403,9884"; a="180310491" X-IronPort-AV: E=Sophos;i="5.79,399,1602572400"; d="scan'208";a="180310491" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Feb 2021 09:27:24 -0800 IronPort-SDR: bw3pG0F0MkL22TB1uyGz7b/JSAbsJnbGkUobnGiW+Zlo0nH4M94oTIZ+IRmtG/Ek2Z3RC/Chp8 Xe8Yxzj4rBWg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.79,399,1602572400"; d="scan'208";a="406723684" Received: from chang-linux-3.sc.intel.com ([172.25.66.175]) by fmsmga004.fm.intel.com with ESMTP; 03 Feb 2021 09:27:24 -0800 To: bp@suse.de, tglx@linutronix.de, mingo@kernel.org, luto@kernel.org, x86@kernel.org Subject: [PATCH v5 4/5] x86/signal: Detect and prevent an alternate signal stack overflow Date: Wed, 3 Feb 2021 09:22:41 -0800 Message-Id: <20210203172242.29644-5-chang.seok.bae@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210203172242.29644-1-chang.seok.bae@intel.com> References: <20210203172242.29644-1-chang.seok.bae@intel.com> X-Spam-Status: No, score=-10.8 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_STATUS, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: "Chang S. Bae via Libc-alpha" From: "Chang S. Bae" Reply-To: "Chang S. Bae" Cc: linux-arch@vger.kernel.org, len.brown@intel.com, tony.luck@intel.com, libc-alpha@sourceware.org, ravi.v.shankar@intel.com, chang.seok.bae@intel.com, jannh@google.com, linux-kernel@vger.kernel.org, dave.hansen@intel.com, Borislav Petkov , linux-api@vger.kernel.org, Dave.Martin@arm.com Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" The kernel pushes context on to the userspace stack to prepare for the user's signal handler. When the user has supplied an alternate signal stack, via sigaltstack(2), it is easy for the kernel to verify that the stack size is sufficient for the current hardware context. Check if writing the hardware context to the alternate stack will exceed it's size. If yes, then instead of corrupting user-data and proceeding with the original signal handler, an immediate SIGSEGV signal is delivered. While previous patches in this series allow new source code to discover and use a sufficient alternate signal stack size, this check is still necessary to protect binaries with insufficient alternate signal stack size from data corruption. Suggested-by: Jann Horn Signed-off-by: Chang S. Bae Reviewed-by: Len Brown Reviewed-by: Jann Horn Cc: Borislav Petkov Cc: Jann Horn Cc: x86@kernel.org Cc: linux-kernel@vger.kernel.org Reported-by: kernel test robot --- Changes from v3: * Updated the changelog (Borislav Petkov) Changes from v2: * Simplified the implementation (Jann Horn) --- arch/x86/kernel/signal.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index 0d24f64d0145..8e2df070dbfd 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -242,7 +242,7 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, unsigned long math_size = 0; unsigned long sp = regs->sp; unsigned long buf_fx = 0; - int onsigstack = on_sig_stack(sp); + bool onsigstack = on_sig_stack(sp); int ret; /* redzone */ @@ -251,8 +251,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, /* This is the X/Open sanctioned signal stack switching. */ if (ka->sa.sa_flags & SA_ONSTACK) { - if (sas_ss_flags(sp) == 0) + if (sas_ss_flags(sp) == 0) { sp = current->sas_ss_sp + current->sas_ss_size; + /* On the alternate signal stack */ + onsigstack = true; + } } else if (IS_ENABLED(CONFIG_X86_32) && !onsigstack && regs->ss != __USER_DS &&