mirror of
https://gitee.com/bianbu-linux/linux-6.6
synced 2025-04-24 14:07:52 -04:00
1905912820
[ Upstream commit 24cf2bc982ffe02aeffb4a3885c71751a2c7023b ]
Assume there's a multithreaded application that runs untrusted user
code. Each thread has its stack/code protected by a non-zero PKEY, and the
PKRU register is set up such that only that particular non-zero PKEY is
enabled. Each thread also sets up an alternate signal stack to handle
signals, which is protected by PKEY zero. The PKEYs man page documents that
the PKRU will be reset to init_pkru when the signal handler is invoked,
which means that PKEY zero access will be enabled. But this reset happens
after the kernel attempts to push fpu state to the alternate stack, which
is not (yet) accessible by the kernel, which leads to a new SIGSEGV being
sent to the application, terminating it.
Enabling both the non-zero PKEY (for the thread) and PKEY zero in
userspace will not work for this use case. It cannot have the alt stack
writeable by all - the rationale here is that the code running in that
thread (using a non-zero PKEY) is untrusted and should not have access
to the alternate signal stack (that uses PKEY zero), to prevent the
return address of a function from being changed. The expectation is that
kernel should be able to set up the alternate signal stack and deliver
the signal to the application even if PKEY zero is explicitly disabled
by the application. The signal handler accessibility should not be
dictated by whatever PKRU value the thread sets up.
The PKRU register is managed by XSAVE, which means the sigframe contents
must match the register contents - which is not the case here. It's
required that the signal frame contains the user-defined PKRU value (so
that it is restored correctly from sigcontext) but the actual register must
be reset to init_pkru so that the alt stack is accessible and the signal
can be delivered to the application. It seems that the proper fix here
would be to remove PKRU from the XSAVE framework and manage it separately,
which is quite complicated. As a workaround, do this:
orig_pkru = rdpkru();
wrpkru(orig_pkru & init_pkru_value);
xsave_to_user_sigframe();
put_user(pkru_sigframe_addr, orig_pkru)
In preparation for writing PKRU to sigframe, pass PKRU as an additional
parameter down the call chain from get_sigframe().
No functional change.
Signed-off-by: Aruna Ramakrishna <aruna.ramakrishna@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/20240802061318.2140081-2-aruna.ramakrishna@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
37 lines
1.1 KiB
C
37 lines
1.1 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* x86 FPU signal frame handling methods:
|
|
*/
|
|
#ifndef _ASM_X86_FPU_SIGNAL_H
|
|
#define _ASM_X86_FPU_SIGNAL_H
|
|
|
|
#include <linux/compat.h>
|
|
#include <linux/user.h>
|
|
|
|
#include <asm/fpu/types.h>
|
|
|
|
#ifdef CONFIG_X86_64
|
|
# include <uapi/asm/sigcontext.h>
|
|
# include <asm/user32.h>
|
|
#else
|
|
# define user_i387_ia32_struct user_i387_struct
|
|
# define user32_fxsr_struct user_fxsr_struct
|
|
#endif
|
|
|
|
extern void convert_from_fxsr(struct user_i387_ia32_struct *env,
|
|
struct task_struct *tsk);
|
|
extern void convert_to_fxsr(struct fxregs_state *fxsave,
|
|
const struct user_i387_ia32_struct *env);
|
|
|
|
unsigned long
|
|
fpu__alloc_mathframe(unsigned long sp, int ia32_frame,
|
|
unsigned long *buf_fx, unsigned long *size);
|
|
|
|
unsigned long fpu__get_fpstate_size(void);
|
|
|
|
extern bool copy_fpstate_to_sigframe(void __user *buf, void __user *fp, int size, u32 pkru);
|
|
extern void fpu__clear_user_states(struct fpu *fpu);
|
|
extern bool fpu__restore_sig(void __user *buf, int ia32_frame);
|
|
|
|
extern void restore_fpregs_from_fpstate(struct fpstate *fpstate, u64 mask);
|
|
#endif /* _ASM_X86_FPU_SIGNAL_H */
|