[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [PATCH] x86/cet: Fix shskt manipulation error with BUGFRAME_{warn,run_fn}
On Thu, Aug 12, 2021 at 06:03:50PM +0100, Andrew Cooper wrote: > This was a clear oversight in the original CET work. The BUGFRAME_run_fn and > BUGFRAME_warn paths update regs->rip without an equivlenet adjustment to the > shadow stack, causes IRET to suffer #CP due to the mismatch. > > One subtle, and therefore fragile, aspect of extable_shstk_fixup() was that it > required regs->rip to have its old value as a cross-check that the correct > word in the shadow stack was being adjusted. > > Rework extable_shstk_fixup() into fixup_exception_return() which takes > ownership of the update to both the regular and shadow stacks, ensuring that > the regs->rip update is ordered suitably. > > Use the new fixup_exception_return() for BUGFRAME_run_fn and BUGFRAME_warn to > ensure that the shadow stack is updated too. > > Fixes: 209fb9919b50 ("x86/extable: Adjust extable handling to be shadow stack > compatible") > Reported-by: Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx> > Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> With this path, I don't observe the crash anymore. Thanks! Tested-by: Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx> -- Best Regards, Marek Marczykowski-Górecki Invisible Things Lab Attachment:
signature.asc
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |