From: Alexander Shishkin <alexander.shishkin@linux.intel.com>

Provide a more helpful message on #GP when a kernel side LASS violation
is detected.

A NULL pointer dereference is reported if a LASS violation occurs due to
accessing the first page frame.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
---
 arch/x86/kernel/traps.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 40e34bb66d7c..5206eb0ab01a 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -636,7 +636,16 @@ DEFINE_IDTENTRY(exc_bounds)
 enum kernel_gp_hint {
 	GP_NO_HINT,
 	GP_NON_CANONICAL,
-	GP_CANONICAL
+	GP_CANONICAL,
+	GP_LASS_VIOLATION,
+	GP_NULL_POINTER,
+};
+
+static const char * const kernel_gp_hint_help[] = {
+	[GP_NON_CANONICAL]	= "probably for non-canonical address",
+	[GP_CANONICAL]		= "maybe for address",
+	[GP_LASS_VIOLATION]	= "LASS prevented access to address",
+	[GP_NULL_POINTER]	= "kernel NULL pointer dereference",
 };
 
 /*
@@ -672,6 +681,12 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs,
 	if (*addr < ~__VIRTUAL_MASK &&
 	    *addr + insn.opnd_bytes - 1 > __VIRTUAL_MASK)
 		return GP_NON_CANONICAL;
+	else if (*addr < ~__VIRTUAL_MASK &&
+		 cpu_feature_enabled(X86_FEATURE_LASS)) {
+		if (*addr < PAGE_SIZE)
+			return GP_NULL_POINTER;
+		return GP_LASS_VIOLATION;
+	}
 #endif
 
 	return GP_CANONICAL;
@@ -833,11 +848,10 @@ DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
 	else
 		hint = get_kernel_gp_address(regs, &gp_addr);
 
-	if (hint != GP_NO_HINT)
+	if (hint != GP_NO_HINT) {
 		snprintf(desc, sizeof(desc), GPFSTR ", %s 0x%lx",
-			 (hint == GP_NON_CANONICAL) ? "probably for non-canonical address"
-						    : "maybe for address",
-			 gp_addr);
+			 kernel_gp_hint_help[hint], gp_addr);
+	}
 
 	/*
 	 * KASAN is interested only in the non-canonical case, clear it
-- 
2.47.2

On 7/1/2025 2:58 AM, Kirill A. Shutemov wrote:
>  /*
> @@ -672,6 +681,12 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs,
>  	if (*addr < ~__VIRTUAL_MASK &&
>  	    *addr + insn.opnd_bytes - 1 > __VIRTUAL_MASK)
>  		return GP_NON_CANONICAL;
> +	else if (*addr < ~__VIRTUAL_MASK &&
> +		 cpu_feature_enabled(X86_FEATURE_LASS)) {
> +		if (*addr < PAGE_SIZE)
> +			return GP_NULL_POINTER;
> +		return GP_LASS_VIOLATION;
> +	}

The comments above this section of code say:

/*
 * Check that:
 *  - the operand is not in the kernel half
 *  - the last byte of the operand is not in the user canonical half
 */

They should be updated since we are updating the logic.

Also, below is easier to read than above:

	if (*addr < ~__VIRTUAL_MASK) {

		if (*addr + insn.opnd_bytes - 1 > __VIRTUAL_MASK)
			return EXC_NON_CANONICAL;

		if (cpu_feature_enabled(X86_FEATURE_LASS)) {
			if (*addr < PAGE_SIZE)
				return EXC_NULL_POINTER;
			return EXC_LASS_VIOLATION;
		}
	}

I am wondering if the NULL pointer exception should be made
unconditional, even if it is unlikely to reach here without LASS. So
maybe something like this:

	if (*addr < ~__VIRTUAL_MASK) {

		if (*addr + insn.opnd_bytes - 1 > __VIRTUAL_MASK)
			return EXC_NON_CANONICAL;

		if (*addr < PAGE_SIZE)
			return EXC_NULL_POINTER;

		if (cpu_feature_enabled(X86_FEATURE_LASS))
			return EXC_LASS_VIOLATION;
	}

On Tue, Jul 01, 2025 at 05:36:06PM -0700, Sohil Mehta wrote:
> On 7/1/2025 2:58 AM, Kirill A. Shutemov wrote:
> >  /*
> > @@ -672,6 +681,12 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs,
> >  	if (*addr < ~__VIRTUAL_MASK &&
> >  	    *addr + insn.opnd_bytes - 1 > __VIRTUAL_MASK)
> >  		return GP_NON_CANONICAL;
> > +	else if (*addr < ~__VIRTUAL_MASK &&
> > +		 cpu_feature_enabled(X86_FEATURE_LASS)) {
> > +		if (*addr < PAGE_SIZE)
> > +			return GP_NULL_POINTER;
> > +		return GP_LASS_VIOLATION;
> > +	}
> 
> The comments above this section of code say:
> 
> /*
>  * Check that:
>  *  - the operand is not in the kernel half
>  *  - the last byte of the operand is not in the user canonical half
>  */
> 
> They should be updated since we are updating the logic.

Okay.

> Also, below is easier to read than above:
> 
> 	if (*addr < ~__VIRTUAL_MASK) {
> 
> 		if (*addr + insn.opnd_bytes - 1 > __VIRTUAL_MASK)
> 			return EXC_NON_CANONICAL;
> 
> 		if (cpu_feature_enabled(X86_FEATURE_LASS)) {
> 			if (*addr < PAGE_SIZE)
> 				return EXC_NULL_POINTER;
> 			return EXC_LASS_VIOLATION;
> 		}
> 	}
> 
> I am wondering if the NULL pointer exception should be made
> unconditional, even if it is unlikely to reach here without LASS. So
> maybe something like this:
> 
> 	if (*addr < ~__VIRTUAL_MASK) {
> 
> 		if (*addr + insn.opnd_bytes - 1 > __VIRTUAL_MASK)
> 			return EXC_NON_CANONICAL;
> 
> 		if (*addr < PAGE_SIZE)
> 			return EXC_NULL_POINTER;
> 
> 		if (cpu_feature_enabled(X86_FEATURE_LASS))
> 			return EXC_LASS_VIOLATION;
> 	}

That's cleaner.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov