Skip to contentSkip to conversation

v5.10 backport of x86/iopl: Fake iopl(3) CLI/STI usage

PATCH In review Ondrej Zary 2 participants 2 messages Nov 16, 2021 – Nov 19, 2021

Subsystems (2)
Stable branch x86
lore
Share & tools
lore

Ondrej Zary

author
#0 lore raw

PATCH 1/1 v5.10 backport of x86/iopl: Fake iopl(3) CLI/STI usage

Backport of the following patch for 5.10-stable:

Quoted 1 line
Quoted 1 line

From b968e84b509da593c50dc3db679e1d33de701f78 Mon Sep 17 00:00:00 2001

From: Peter Zijlstra <[email protected]>
Date: Fri, 17 Sep 2021 11:20:04 +0200

Since commit c8137ace5638 ("x86/iopl: Restrict iopl() permission scope") it's possible to emulate iopl(3) using ioperm(), except for the CLI/STI usage.

Userspace CLI/STI usage is very dubious (read broken), since any exception taken during that window can lead to rescheduling anyway (or worse). The IOPL(2) manpage even states that usage of CLI/STI is highly discouraged and might even crash the system.

Of course, that won't stop people and HP has the dubious honour of being the first vendor to be found using this in their hp-health package.

In order to enable this 'software' to still 'work', have the #GP treat the CLI/STI instructions as NOPs when iopl(3). Warn the user that their program is doing dubious things.

Fixes a24ca9976843 ("x86/iopl: Remove legacy IOPL option")
Reported-by Ondrej Zary <[email protected]>
Signed-off-by Peter Zijlstra (Intel) <[email protected]>
Reviewed-by Thomas Gleixner <[email protected]>
Link https://lkml.kernel.org/r/[email protected] open here
Signed-off-by Ondrej Zary <[email protected]>
---
 arch/x86/include/asm/insn-eval.h |  1 +
 arch/x86/include/asm/processor.h |  1 +
 arch/x86/kernel/process.c        |  1 +
 arch/x86/kernel/traps.c          | 34 ++++++++++++++++++++++++++++++++
 arch/x86/lib/insn-eval.c         |  2 +-
 5 files changed, 38 insertions(+), 1 deletion(-)
arch/x86/include/asm/insn-eval.h +1 -0
index 98b4dae5e8bc..c1438f9239e4 100644
@@ -21,6 +21,7 @@ int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs);
 int insn_get_modrm_reg_off(struct insn *insn, struct pt_regs *regs);
 unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx);
 int insn_get_code_seg_params(struct pt_regs *regs);
+unsigned long insn_get_effective_ip(struct pt_regs *regs);
 int insn_fetch_from_user(struct pt_regs *regs,
 			 unsigned char buf[MAX_INSN_SIZE]);
 int insn_fetch_from_user_inatomic(struct pt_regs *regs,
arch/x86/include/asm/processor.h +1 -0
index 50d02db72317..d428d611a43a 100644
@@ -534,6 +534,7 @@ struct thread_struct {
 	 */
 	unsigned long		iopl_emul;
 
+	unsigned int		iopl_warn:1;
 	unsigned int		sig_on_uaccess_err:1;
 
 	/* Floating point and extended processor state */
arch/x86/kernel/process.c +1 -0
index 145a7ac0c19a..0aa1baf9a3af 100644
@@ -138,6 +138,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, unsigned long arg,
 	frame->ret_addr = (unsigned long) ret_from_fork;
 	p->thread.sp = (unsigned long) fork_frame;
 	p->thread.io_bitmap = NULL;
+	p->thread.iopl_warn = 0;
 	memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
 
 #ifdef CONFIG_X86_64
arch/x86/kernel/traps.c +34 -0
index 143fcb8af38f..2d4ecd50e69b 100644
@@ -523,6 +523,37 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs,
 
 #define GPFSTR "general protection fault"
 
+static bool fixup_iopl_exception(struct pt_regs *regs)
+{
+	struct thread_struct *t = &current->thread;
+	unsigned char byte;
+	unsigned long ip;
+
+	if (!IS_ENABLED(CONFIG_X86_IOPL_IOPERM) || t->iopl_emul != 3)
+		return false;
+
+	ip = insn_get_effective_ip(regs);
+	if (!ip)
+		return false;
+
+	if (get_user(byte, (const char __user *)ip))
+		return false;
+
+	if (byte != 0xfa && byte != 0xfb)
+		return false;
+
+	if (!t->iopl_warn && printk_ratelimit()) {
+		pr_err("%s[%d] attempts to use CLI/STI, pretending it's a NOP, ip:%lx",
+		       current->comm, task_pid_nr(current), ip);
+		print_vma_addr(KERN_CONT " in ", ip);
+		pr_cont("\n");
+		t->iopl_warn = 1;
+	}
+
+	regs->ip += 1;
+	return true;
+}
+
 DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
 {
 	char desc[sizeof(GPFSTR) + 50 + 2*sizeof(unsigned long) + 1] = GPFSTR;

@@ -548,6 +579,9 @@ DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
 	tsk = current;
 
 	if (user_mode(regs)) {
+		if (fixup_iopl_exception(regs))
+			goto exit;
+
 		tsk->thread.error_code = error_code;
 		tsk->thread.trap_nr = X86_TRAP_GP;
arch/x86/lib/insn-eval.c +1 -1
index bb0b3fe1e0a0..c6a19c88af54 100644
@@ -1415,7 +1415,7 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
 	}
 }
 
-static unsigned long insn_get_effective_ip(struct pt_regs *regs)
+unsigned long insn_get_effective_ip(struct pt_regs *regs)
 {
 	unsigned long seg_base = 0;
Signature · 1 line
2.20.1
maintainer
#1 lore raw
Quoted 23 lines · Ondrej Zary

Backport of the following patch for 5.10-stable:

Quoted 1 line
Quoted 1 line
Quoted 1 line

From b968e84b509da593c50dc3db679e1d33de701f78 Mon Sep 17 00:00:00 2001

From: Peter Zijlstra <[email protected]>
Date: Fri, 17 Sep 2021 11:20:04 +0200

Since commit c8137ace5638 ("x86/iopl: Restrict iopl() permission scope") it's possible to emulate iopl(3) using ioperm(), except for the CLI/STI usage.

Userspace CLI/STI usage is very dubious (read broken), since any exception taken during that window can lead to rescheduling anyway (or worse). The IOPL(2) manpage even states that usage of CLI/STI is highly discouraged and might even crash the system.

Of course, that won't stop people and HP has the dubious honour of being the first vendor to be found using this in their hp-health package.

In order to enable this 'software' to still 'work', have the #GP treat the CLI/STI instructions as NOPs when iopl(3). Warn the user that their program is doing dubious things.

Quoted 6 lines
Fixes a24ca9976843 ("x86/iopl: Remove legacy IOPL option")
Reported-by Ondrej Zary <[email protected]>
Signed-off-by Peter Zijlstra (Intel) <[email protected]>
Reviewed-by Thomas Gleixner <[email protected]>
Link https://lkml.kernel.org/r/[email protected] open here
Signed-off-by Ondrej Zary <[email protected]>

Now queued up, thanks.

greg k-h