Re: [PATCH v28 09/32] x86/mm: Introduce _PAGE_COW

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 8/16/2021 3:43 AM, Borislav Petkov wrote:
On Thu, Jul 22, 2021 at 01:51:56PM -0700, Yu-cheng Yu wrote:
@@ -153,13 +178,23 @@ static inline int pud_young(pud_t pud)
static inline int pte_write(pte_t pte)
  {
-	return pte_flags(pte) & _PAGE_RW;
+	/*
+	 * Shadow stack pages are always writable - but not by normal
+	 * instructions, and only by shadow stack operations.  Therefore,
+	 * the W=0,D=1 test with pte_shstk().
+	 */
+	return (pte_flags(pte) & _PAGE_RW) || pte_shstk(pte);

Well, this is weird: if some kernel code queries a shstk page and this
here function says it is writable but then goes and tries to write into
it and that write fails, then it'll confuse the user.

IOW, from where I'm standing, that should be:

	return (pte_flags(pte) & _PAGE_RW) && !pte_shstk(pte);

as in, a writable page is one which has _PAGE_RW and it is *not* a
shadow stack page because latter is special and not really writable.
> Hmmm?


Indeed, this can be looked at in a few ways. We can visualize pte_write() as 'CPU can write to it with MOV' or 'CPU can write to it with any opcodes'. Depending on whatever pte_write() is, copy-on-write code can be adjusted accordingly.

Yu-cheng



[Index of Archives]     [Linux Kernel]     [Kernel Newbies]     [x86 Platform Driver]     [Netdev]     [Linux Wireless]     [Netfilter]     [Bugtraq]     [Linux Filesystems]     [Yosemite Discussion]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Device Mapper]

  Powered by Linux