[4.9,V2,24/24] ARM: spectre-v1: mitigate user accesses

Message ID	20181107164402.9380-25-dave.long@linaro.org
State	New
Headers	show Delivered-To: patch@linaro.org Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; From: David Long <dave.long@linaro.org> To: stable@vger.kernel.org, Russell King - ARM Linux <linux@armlinux.org.uk>, Florian Fainelli <f.fainelli@gmail.com>, Tony Lindgren <tony@atomide.com>, Marc Zyngier <marc.zyngier@arm.com>, Mark Rutland <mark.rutland@arm.com> Cc: Greg KH <gregkh@linuxfoundation.org>, Mark Brown <broonie@kernel.org> Subject: [PATCH 4.9 V2 24/24] ARM: spectre-v1: mitigate user accesses Date: Wed, 7 Nov 2018 11:44:02 -0500 Message-Id: <20181107164402.9380-25-dave.long@linaro.org> In-Reply-To: <20181107164402.9380-1-dave.long@linaro.org> References: <20181107164402.9380-1-dave.long@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	V4.9 backport of 32-bit arm spectre patches \| expand [4.9,V2,00/24] V4.9 backport of 32-bit arm spectre patches [4.9,V2,01/24] ARM: add more CPU part numbers for Cortex and Brahma B15 CPUs [4.9,V2,02/24] ARM: bugs: prepare processor bug infrastructure [4.9,V2,03/24] ARM: bugs: hook processor bug checking into SMP and suspend paths [4.9,V2,04/24] ARM: bugs: add support for per-processor bug checking [4.9,V2,05/24] ARM: spectre: add Kconfig symbol for CPUs vulnerable to Spectre [4.9,V2,06/24] ARM: spectre-v2: harden branch predictor on context switches [4.9,V2,07/24] ARM: spectre-v2: add Cortex A8 and A15 validation of the IBE bit [4.9,V2,08/24] ARM: spectre-v2: harden user aborts in kernel space [4.9,V2,09/24] ARM: spectre-v2: add firmware based hardening [4.9,V2,10/24] ARM: spectre-v2: warn about incorrect context switching functions [4.9,V2,11/24] ARM: KVM: invalidate BTB on guest exit for Cortex-A12/A17 [4.9,V2,12/24] ARM: KVM: invalidate icache on guest exit for Cortex-A15 [4.9,V2,13/24] ARM: spectre-v2: KVM: invalidate icache on guest exit for Brahma B15 [4.9,V2,14/24] ARM: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling [4.9,V2,15/24] ARM: KVM: report support for SMCCC_ARCH_WORKAROUND_1 [4.9,V2,16/24] ARM: spectre-v1: add speculation barrier (csdb) macros [4.9,V2,17/24] ARM: spectre-v1: add array_index_mask_nospec() implementation [4.9,V2,18/24] ARM: spectre-v1: fix syscall entry [4.9,V2,19/24] ARM: signal: copy registers using __copy_from_user() [4.9,V2,20/24] ARM: vfp: use __copy_from_user() when restoring VFP state [4.9,V2,21/24] ARM: oabi-compat: copy semops using __copy_from_user() [4.9,V2,22/24] ARM: use __inttype() in get_user() [4.9,V2,23/24] ARM: spectre-v1: use get_user() for __get_user() [4.9,V2,24/24] ARM: spectre-v1: mitigate user accesses

Message ID

20181107164402.9380-25-dave.long@linaro.org

State

New

Headers

Received-SPF: pass (google.com: best guess record for domain of
	stable-owner@vger.kernel.org designates 209.132.180.67 as
	permitted sender) client-ip=209.132.180.67; 
From: David Long <dave.long@linaro.org>
To: stable@vger.kernel.org, Russell King - ARM Linux <linux@armlinux.org.uk>,
	Florian Fainelli <f.fainelli@gmail.com>,
	Tony Lindgren <tony@atomide.com>, Marc Zyngier <marc.zyngier@arm.com>,
	Mark Rutland <mark.rutland@arm.com>
Cc: Greg KH <gregkh@linuxfoundation.org>, Mark Brown <broonie@kernel.org>
Subject: [PATCH 4.9 V2 24/24] ARM: spectre-v1: mitigate user accesses
Date: Wed,  7 Nov 2018 11:44:02 -0500
Message-Id: <20181107164402.9380-25-dave.long@linaro.org>
In-Reply-To: <20181107164402.9380-1-dave.long@linaro.org>
References: <20181107164402.9380-1-dave.long@linaro.org>
Sender: stable-owner@vger.kernel.org
Precedence: bulk

Series

V4.9 backport of 32-bit arm spectre patches | expand

Commit Message

David Long Nov. 7, 2018, 4:44 p.m. UTC

From: Russell King <rmk+kernel@armlinux.org.uk>


Commit a3c0f84765bb429ba0fd23de1c57b5e1591c9389 upstream.

Spectre variant 1 attacks are about this sequence of pseudo-code:

	index = load(user-manipulated pointer);
	access(base + index * stride);

In order for the cache side-channel to work, the access() must me made
to memory which userspace can detect whether cache lines have been
loaded.  On 32-bit ARM, this must be either user accessible memory, or
a kernel mapping of that same user accessible memory.

The problem occurs when the load() speculatively loads privileged data,
and the subsequent access() is made to user accessible memory.

Any load() which makes use of a user-maniplated pointer is a potential
problem if the data it has loaded is used in a subsequent access.  This
also applies for the access() if the data loaded by that access is used
by a subsequent access.

Harden the get_user() accessors against Spectre attacks by forcing out
of bounds addresses to a NULL pointer.  This prevents get_user() being
used as the load() step above.  As a side effect, put_user() will also
be affected even though it isn't implicated.

Also harden copy_from_user() by redoing the bounds check within the
arm_copy_from_user() code, and NULLing the pointer if out of bounds.

Acked-by: Mark Rutland <mark.rutland@arm.com>

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>

Signed-off-by: David A. Long <dave.long@linaro.org>

---
 arch/arm/include/asm/assembler.h | 4 ++++
 arch/arm/lib/copy_from_user.S    | 9 +++++++++
 2 files changed, 13 insertions(+)

-- 
2.17.1

diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 189f3b42baea..e616f61f859d 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -458,6 +458,10 @@  THUMB(	orr	\reg , \reg , #PSR_T_BIT	)
 	adds	\tmp, \addr, #\size - 1
 	sbcccs	\tmp, \tmp, \limit
 	bcs	\bad
+#ifdef CONFIG_CPU_SPECTRE
+	movcs	\addr, #0
+	csdb
+#endif
 #endif
 	.endm
 
diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
index 7a4b06049001..a826df3d3814 100644
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -90,6 +90,15 @@ 
 	.text
 
 ENTRY(arm_copy_from_user)
+#ifdef CONFIG_CPU_SPECTRE
+	get_thread_info r3
+	ldr	r3, [r3, #TI_ADDR_LIMIT]
+	adds	ip, r1, r2	@ ip=addr+size
+	sub	r3, r3, #1	@ addr_limit - 1
+	cmpcc	ip, r3		@ if (addr+size > addr_limit - 1)
+	movcs	r1, #0		@ addr = NULL
+	csdb
+#endif
 
 #include "copy_template.S"

[4.9,V2,24/24] ARM: spectre-v1: mitigate user accesses

Commit Message

Patch