Commit acd547b2 authored by Dave Hansen's avatar Dave Hansen Committed by Thomas Gleixner
Browse files

x86/pkeys: Default to a restrictive init PKRU 



PKRU is the register that lets you disallow writes or all access to a given
protection key.

The XSAVE hardware defines an "init state" of 0 for PKRU: its most
permissive state, allowing access/writes to everything.  Since we start off
all new processes with the init state, we start all processes off with the
most permissive possible PKRU.

This is unfortunate.  If a thread is clone()'d [1] before a program has
time to set PKRU to a restrictive value, that thread will be able to write
to all data, no matter what pkey is set on it.  This weakens any integrity
guarantees that we want pkeys to provide.

To fix this, we define a very restrictive PKRU to override the
XSAVE-provided value when we create a new FPU context.  We choose a value
that only allows access to pkey 0, which is as restrictive as we can
practically make it.

This does not cause any practical problems with applications using
protection keys because we require them to specify initial permissions for
each key when it is allocated, which override the restrictive default.

In the end, this ensures that threads which do not know how to manage their
own pkey rights can not do damage to data which is pkey-protected.

I would have thought this was a pretty contrived scenario, except that I
heard a bug report from an MPX user who was creating threads in some very
early code before main().  It may be crazy, but folks evidently _do_ it.

Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Cc: linux-arch@vger.kernel.org
Cc: Dave Hansen <dave@sr71.net>
Cc: mgorman@techsingularity.net
Cc: arnd@arndb.de
Cc: linux-api@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: luto@kernel.org
Cc: akpm@linux-foundation.org
Cc: torvalds@linux-foundation.org
Link: http://lkml.kernel.org/r/20160729163021.F3C25D4A@viggo.jf.intel.com


Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent c74fe394

Documentation/kernel-parameters.txt

+5 −0
Original line number Diff line number Diff line
@@ -1643,6 +1643,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted. 


	initrd=		[BOOT] Specify the location of the initial ramdisk



	init_pkru=	[x86] Specify the default memory protection keys rights

			register contents for all processes.  0x55555554 by

			default (disallow access to all but pkey 0).  Can

			override in debugfs after boot.



	inport.irq=	[HW] Inport (ATI XL and Microsoft) busmouse driver

			Format: <irq>

arch/x86/include/asm/pkeys.h

+1 −0
Original line number Diff line number Diff line
@@ -100,5 +100,6 @@ extern int arch_set_user_pkey_access(struct task_struct *tsk, int pkey, 
		unsigned long init_val);

extern int __arch_set_user_pkey_access(struct task_struct *tsk, int pkey,

		unsigned long init_val);

extern void copy_init_pkru_to_fpregs(void);



#endif /*_ASM_X86_PKEYS_H */

arch/x86/kernel/fpu/core.c

+4 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#include <asm/traps.h>



#include <linux/hardirq.h>

#include <linux/pkeys.h>



#define CREATE_TRACE_POINTS

#include <asm/trace/fpu.h>
@@ -505,6 +506,9 @@ static inline void copy_init_fpstate_to_fpregs(void) 
		copy_kernel_to_fxregs(&init_fpstate.fxsave);

	else

		copy_kernel_to_fregs(&init_fpstate.fsave);



	if (boot_cpu_has(X86_FEATURE_OSPKE))

		copy_init_pkru_to_fpregs();

}



/*

arch/x86/mm/pkeys.c

+38 −0
Original line number Diff line number Diff line
@@ -121,3 +121,41 @@ int __arch_override_mprotect_pkey(struct vm_area_struct *vma, int prot, int pkey 
	 */

	return vma_pkey(vma);

}



#define PKRU_AD_KEY(pkey)	(PKRU_AD_BIT << ((pkey) * PKRU_BITS_PER_PKEY))



/*

 * Make the default PKRU value (at execve() time) as restrictive

 * as possible.  This ensures that any threads clone()'d early

 * in the process's lifetime will not accidentally get access

 * to data which is pkey-protected later on.

 */

u32 init_pkru_value = PKRU_AD_KEY( 1) | PKRU_AD_KEY( 2) | PKRU_AD_KEY( 3) |

		      PKRU_AD_KEY( 4) | PKRU_AD_KEY( 5) | PKRU_AD_KEY( 6) |

		      PKRU_AD_KEY( 7) | PKRU_AD_KEY( 8) | PKRU_AD_KEY( 9) |

		      PKRU_AD_KEY(10) | PKRU_AD_KEY(11) | PKRU_AD_KEY(12) |

		      PKRU_AD_KEY(13) | PKRU_AD_KEY(14) | PKRU_AD_KEY(15);



/*

 * Called from the FPU code when creating a fresh set of FPU

 * registers.  This is called from a very specific context where

 * we know the FPU regstiers are safe for use and we can use PKRU

 * directly.  The fact that PKRU is only available when we are

 * using eagerfpu mode makes this possible.

 */

void copy_init_pkru_to_fpregs(void)

{

	u32 init_pkru_value_snapshot = READ_ONCE(init_pkru_value);

	/*

	 * Any write to PKRU takes it out of the XSAVE 'init

	 * state' which increases context switch cost.  Avoid

	 * writing 0 when PKRU was already 0.

	 */

	if (!init_pkru_value_snapshot && !read_pkru())

		return;

	/*

	 * Override the PKRU state that came from 'init_fpstate'

	 * with the baseline from the process.

	 */

	write_pkru(init_pkru_value_snapshot);

}

include/linux/pkeys.h

+4 −0
Original line number Diff line number Diff line
@@ -35,6 +35,10 @@ static inline int arch_set_user_pkey_access(struct task_struct *tsk, int pkey, 
	return 0;

}



static inline void copy_init_pkru_to_fpregs(void)

{

}



#endif /* ! CONFIG_ARCH_HAS_PKEYS */



#endif /* _LINUX_PKEYS_H */

CRA Git | Maintained and supported by SUSTech CRA and CCSE