Re: [PATCH 1/3] arm64: vdso: Don't prefix sigreturn trampoline with a BTI C instruction

From: Dave Martin <Dave.Martin@arm.com>
To: Mark Brown <broonie@kernel.org>
Cc: Tamas Zsoldos <tamas.zsoldos@arm.com>,
	kernel-team@android.com, Will Deacon <will@kernel.org>,
	linux-arm-kernel@lists.infradead.org,
	Daniel Kiss <daniel.kiss@arm.com>
Subject: Re: [PATCH 1/3] arm64: vdso: Don't prefix sigreturn trampoline with a BTI C instruction
Date: Wed, 20 May 2020 10:48:45 +0100	[thread overview]
Message-ID: <20200520094844.GL5031@arm.com> (raw)
In-Reply-To: <20200519154247.GN4611@sirena.org.uk>

On Tue, May 19, 2020 at 04:42:47PM +0100, Mark Brown wrote:
> On Tue, May 19, 2020 at 03:55:15PM +0100, Dave Martin wrote:
> > On Tue, May 19, 2020 at 03:35:00PM +0100, Mark Brown wrote:
> > > On Tue, May 19, 2020 at 02:25:38PM +0100, Dave Martin wrote:
> 
> > > > Rather, the "ret lr" that jumps here is supposed to be authenticated via
> > > > pointer auth in the caller.
> 
> > > In which case there was an issue anyway...
> 
> > What issue?
> 
> None, I was confused.
> 
> > > > If BTI {nothing} allows this while disallowing all BR/BLR then we could
> > > > use that (I can't remember what BTI {nothing} is useful for, if anything).
> 
> > > > Otherwise, it's less clear what we should have here.
> 
> > > I can't remember anything that distinguishes it from an explicit NOP.
> 
> > I think it rejects everything other then fallthrough execution
> > (BTYPE==0, which includes RET).  I might have misunderstood something
> 
> Right, but since BTI only generates an exception when BTYPE != 0 I'm
> having trouble differentiating this from a NOP in practical terms.

The idea would be that if an attacker could fudge some function pointer
to point at __kernel_rt_sigreturn, attempting to do a call via that
pointer would still trigger a BTI trap.

This vulnerability isn't applicable to return addresses, because the
victim is supposed to sign those before storing them to (attackable)
memory, and authenticate between loading back from memory and doing the
RET.  So the victim can defend itself from that scenario.

> 
> > somewhere, but sort of feels like the right thing here.  I never put a
> > lot of effort into trying to understand BTI {nothing} though.  It
> > seemed a weird, possibly useless special case.
> 
> That was my read too.

And if the gdb doesn't tolerate modification of the exact insn sequence,
we can't do it anyway.  I'd really say that's a bug-like rogue heuristic
in gdb and "not our problem".  But people will moan about regressions
nonetheless.

I was that interested because of the potential use for BTI {nothing}.
I'd have to actually try it out to be 100% sure it works anyway.

Cheers
---Dave

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel