From 0a2d7d9b1e63dd28baf6c8e1416b64a33f89c900 Mon Sep 17 00:00:00 2001

From: Linus Torvalds <torvalds@linux-foundation.org>

Date: Tue, 23 Feb 2016 14:58:52 -0800

Subject: x86: fix SMAP in 32-bit environments

commit de9e478b9d49f3a0214310d921450cf5bb4a21e6 upstream.

In commit 11f1a4b9755f ("x86: reorganize SMAP handling in user space

accesses") I changed how the stac/clac instructions were generated

around the user space accesses, which then made it possible to do

batched accesses efficiently for user string copies etc.

However, in doing so, I completely spaced out, and didn't even think

about the 32-bit case.  And nobody really even seemed to notice, because

SMAP doesn't even exist until modern Skylake processors, and you'd have

to be crazy to run 32-bit kernels on a modern CPU.

Which brings us to Andy Lutomirski.

He actually tested the 32-bit kernel on new hardware, and noticed that

it doesn't work.  My bad.  The trivial fix is to add the required

uaccess begin/end markers around the raw accesses in <asm/uaccess_32.h>.

I feel a bit bad about this patch, just because that header file really

should be cleaned up to avoid all the duplicated code in it, and this

commit just expands on the problem.  But this just fixes the bug without

any bigger cleanup surgery.

Reported-and-tested-by: Andy Lutomirski <luto@kernel.org>

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

[bwh: Backported to 3.16: There's no 'case 8' in __copy_to_user_inatomic()]

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

---

 arch/x86/include/asm/uaccess_32.h | 24 ++++++++++++++++++++++++

 1 file changed, 24 insertions(+)

diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h

index 3c03a5de64d3..b25d109fb95a 100644

--- a/arch/x86/include/asm/uaccess_32.h

+++ b/arch/x86/include/asm/uaccess_32.h

@@ -48,16 +48,22 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)

 		switch (n) {

 		case 1:

+			__uaccess_begin();

 			__put_user_size(*(u8 *)from, (u8 __user *)to,

 					1, ret, 1);

+			__uaccess_end();

 			return ret;

 		case 2:

+			__uaccess_begin();

 			__put_user_size(*(u16 *)from, (u16 __user *)to,

 					2, ret, 2);

+			__uaccess_end();

 			return ret;

 		case 4:

+			__uaccess_begin();

 			__put_user_size(*(u32 *)from, (u32 __user *)to,

 					4, ret, 4);

+			__uaccess_end();

 			return ret;

 		}

 	}

@@ -98,13 +104,19 @@ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)

 		switch (n) {

 		case 1:

+			__uaccess_begin();

 			__get_user_size(*(u8 *)to, from, 1, ret, 1);

+			__uaccess_end();

 			return ret;

 		case 2:

+			__uaccess_begin();

 			__get_user_size(*(u16 *)to, from, 2, ret, 2);

+			__uaccess_end();

 			return ret;

 		case 4:

+			__uaccess_begin();

 			__get_user_size(*(u32 *)to, from, 4, ret, 4);

+			__uaccess_end();

 			return ret;

 		}

 	}

@@ -142,13 +154,19 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)

 		switch (n) {

 		case 1:

+			__uaccess_begin();

 			__get_user_size(*(u8 *)to, from, 1, ret, 1);

+			__uaccess_end();

 			return ret;

 		case 2:

+			__uaccess_begin();

 			__get_user_size(*(u16 *)to, from, 2, ret, 2);

+			__uaccess_end();

 			return ret;

 		case 4:

+			__uaccess_begin();

 			__get_user_size(*(u32 *)to, from, 4, ret, 4);

+			__uaccess_end();

 			return ret;

 		}

 	}

@@ -164,13 +182,19 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,

 		switch (n) {

 		case 1:

+			__uaccess_begin();

 			__get_user_size(*(u8 *)to, from, 1, ret, 1);

+			__uaccess_end();

 			return ret;

 		case 2:

+			__uaccess_begin();

 			__get_user_size(*(u16 *)to, from, 2, ret, 2);

+			__uaccess_end();

 			return ret;

 		case 4:

+			__uaccess_begin();

 			__get_user_size(*(u32 *)to, from, 4, ret, 4);

+			__uaccess_end();

 			return ret;

 		}

 	}

-- 

cgit 1.2-0.3.lf.el7

From 98ce99aa23b43c3dc736cd0354537fca029d69cb Mon Sep 17 00:00:00 2001

From: Dan Williams <dan.j.williams@intel.com>

Date: Mon, 29 Jan 2018 17:02:49 -0800

Subject: x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec

commit 304ec1b050310548db33063e567123fae8fd0301 upstream.

Quoting Linus:

    I do think that it would be a good idea to very expressly document

    the fact that it's not that the user access itself is unsafe. I do

    agree that things like "get_user()" want to be protected, but not

    because of any direct bugs or problems with get_user() and friends,

    but simply because get_user() is an excellent source of a pointer

    that is obviously controlled from a potentially attacking user

    space. So it's a prime candidate for then finding _subsequent_

    accesses that can then be used to perturb the cache.

__uaccess_begin_nospec() covers __get_user() and copy_from_iter() where the

limit check is far away from the user pointer de-reference. In those cases

a barrier_nospec() prevents speculation with a potential pointer to

privileged memory. uaccess_try_nospec covers get_user_try.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>

Suggested-by: Andi Kleen <ak@linux.intel.com>

Signed-off-by: Dan Williams <dan.j.williams@intel.com>

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

Cc: linux-arch@vger.kernel.org

Cc: Kees Cook <keescook@chromium.org>

Cc: kernel-hardening@lists.openwall.com

Cc: gregkh@linuxfoundation.org

Cc: Al Viro <viro@zeniv.linux.org.uk>

Cc: alan@linux.intel.com

Link: https://lkml.kernel.org/r/151727416953.33451.10508284228526170604.stgit@dwillia2-desk3.amr.corp.intel.com

[bwh: Backported to 3.16:

 - Convert several more functions to use __uaccess_begin_nospec(), that

   are just wrappers in mainline

 - There's no 'case 8' in __copy_to_user_inatomic()

 - Adjust context]

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

---

 arch/x86/include/asm/uaccess.h    |  6 +++---

 arch/x86/include/asm/uaccess_32.h | 24 ++++++++++++------------

 arch/x86/include/asm/uaccess_64.h | 20 ++++++++++----------

 arch/x86/lib/usercopy_32.c        | 10 +++++-----

 4 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h

index b25d109fb95a..c803818cedfb 100644

--- a/arch/x86/include/asm/uaccess_32.h

+++ b/arch/x86/include/asm/uaccess_32.h

@@ -48,19 +48,19 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)

 		switch (n) {

 		case 1:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__put_user_size(*(u8 *)from, (u8 __user *)to,

 					1, ret, 1);

 			__uaccess_end();

 			return ret;

 		case 2:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__put_user_size(*(u16 *)from, (u16 __user *)to,

 					2, ret, 2);

 			__uaccess_end();

 			return ret;

 		case 4:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__put_user_size(*(u32 *)from, (u32 __user *)to,

 					4, ret, 4);

 			__uaccess_end();

@@ -104,17 +104,17 @@ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)

 		switch (n) {

 		case 1:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__get_user_size(*(u8 *)to, from, 1, ret, 1);

 			__uaccess_end();

 			return ret;

 		case 2:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__get_user_size(*(u16 *)to, from, 2, ret, 2);

 			__uaccess_end();

 			return ret;

 		case 4:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__get_user_size(*(u32 *)to, from, 4, ret, 4);

 			__uaccess_end();

 			return ret;

@@ -154,17 +154,17 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)

 		switch (n) {

 		case 1:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__get_user_size(*(u8 *)to, from, 1, ret, 1);

 			__uaccess_end();

 			return ret;

 		case 2:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__get_user_size(*(u16 *)to, from, 2, ret, 2);

 			__uaccess_end();

 			return ret;

 		case 4:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__get_user_size(*(u32 *)to, from, 4, ret, 4);

 			__uaccess_end();

 			return ret;

@@ -182,17 +182,17 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,

 		switch (n) {

 		case 1:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__get_user_size(*(u8 *)to, from, 1, ret, 1);

 			__uaccess_end();

 			return ret;

 		case 2:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__get_user_size(*(u16 *)to, from, 2, ret, 2);

 			__uaccess_end();

 			return ret;

 		case 4:

-			__uaccess_begin();

+			__uaccess_begin_nospec();

 			__get_user_size(*(u32 *)to, from, 4, ret, 4);

 			__uaccess_end();

 			return ret;

diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c

index 7f6e7dd46215..de848bc95a9f 100644

--- a/arch/x86/lib/usercopy_32.c

+++ b/arch/x86/lib/usercopy_32.c

@@ -570,7 +570,7 @@ do {									\

 unsigned long __copy_to_user_ll(void __user *to, const void *from,

 				unsigned long n)

 {

-	__uaccess_begin();

+	__uaccess_begin_nospec();

 	if (movsl_is_ok(to, from, n))

 		__copy_user(to, from, n);

 	else

-- 

cgit 1.2-0.3.lf.el7