From nobody Sat Jul 25 00:13:36 2026 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34A1E35DA6D for ; Wed, 22 Jul 2026 00:44:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.12 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784681055; cv=none; b=nKtJISf9mX/EEPN8/6vrsjOC+Q38ylMkCea7+K+DTYfwGjoLJ4rOFOpa+8uNAkJMJ3R5rutz+8skIyCZo6UnWwnwfMHdhFfMjjBSErLLndM/EbAofSW/xgUFXPn7RZmdeafEP3Lojr+w+UPaMtR6d44FoG8bjzhDufPutc7kNjg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784681055; c=relaxed/simple; bh=lZHBBmreiFphSwSBZGOZ2a9MegNZEcSU8Fv9Chg5aGo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=K9v9Caepgxh6eTUNPt67bNxNKc4kJDGxan86LWG/DYBzbYRfpylmm8umqbieYogmBo0a/nt3Vp1DDMM3wqysJE4FeHwlpIo9B4BoV10h6WyzvSRFDrTRvm3h2vFCtgoFxY6b+6rRArnSsEKW4KhIHR2qEZF7n4qQwPAKrbJLbzw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=ZPYn8xmU; arc=none smtp.client-ip=198.175.65.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="ZPYn8xmU" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784681054; x=1816217054; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=lZHBBmreiFphSwSBZGOZ2a9MegNZEcSU8Fv9Chg5aGo=; b=ZPYn8xmUyXq2N/rde696JAkYPoEEHd3ZuFbrPJ1FHFg46zdggPMeLoi6 AZSQZZTrwki0CpzWQP8HKXVOEhHD67cC/BpvXteNWDqDt7mQEA2y8DX3T hYkPIFMvTjOesbQxFRAjgzI2f5xK+GeOHHS2Mq0g+z7LIZ4JSKjEH+zlJ denn9j43oG5YOgP3vS5Xnkhtw4wIyB1CxnQjuA7ki1zKWU5yo/cxIlaMu l4RNJ/CXW6MWRzH4BF9SyDFKIYteCPpPcgJMfOIra1CX+2saYekoFJ5Xl Og54LKi/SPpFhSMa9HWudo3leegrvVHCpIupmMpztXGQZbhXkIbb6tMBJ A==; X-CSE-ConnectionGUID: zBVhW0wbTfqvbNCaSFHWGA== X-CSE-MsgGUID: OfKhdRYqRvygWXBspSVwUA== X-IronPort-AV: E=McAfee;i="6800,10657,11853"; a="96819305" X-IronPort-AV: E=Sophos;i="6.25,177,1779174000"; d="scan'208";a="96819305" Received: from orviesa007.jf.intel.com ([10.64.159.147]) by orvoesa104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Jul 2026 17:44:13 -0700 X-CSE-ConnectionGUID: WpnQHsedSXuEadQMoxlvBw== X-CSE-MsgGUID: xc3tjf4VS4aJgFXk1hRbKw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,177,1779174000"; d="scan'208";a="258001497" Received: from sohilmeh.sc.intel.com ([172.25.103.65]) by orviesa007.jf.intel.com with ESMTP; 21 Jul 2026 17:44:12 -0700 From: Sohil Mehta To: Dave Hansen , x86@kernel.org, Andy Lutomirski , Borislav Petkov , "H . Peter Anvin" Cc: Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Sohil Mehta , Nam Cao , Cedric Xing , Kumar Kartikeya Dwivedi , Rick Edgecombe , Andrew Cooper , Michael Roth , Brijesh Singh , Jarkko Sakkinen , linux-kernel@vger.kernel.org Subject: [PATCH v2] x86/vsyscall: Avoid vsyscall emulation for unexpected page fault types Date: Tue, 21 Jul 2026 17:41:51 -0700 Message-ID: <20260722004152.503073-1-sohil.mehta@intel.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Currently, vsyscall emulation is rejected for write faults and kernel-privilege faults. It is assumed that other page fault error codes such as X86_PF_PK and X86_PF_SHSTK will not be set in the vsyscall context. From a defensive point of view, it is better to explicitly reject these faults than assume that they will never happen. So, avoid vsyscall emulation if any of those are present. Note, X86_PF_SGX and X86_PF_RMP are also unlikely to occur in the vsyscall context. They can probably be added to the reject-list in the future to solidify this further. Also, X86_PF_RSVD is already handled in do_user_addr_fault() before vsyscall emulation is attempted. Similarly, on systems that support X86_FEATURE_NX, X86_PF_INSTR is always expected to be set when an instruction fetch triggers a #PF. The kernel issues a warning whenever that is not the case. Instead of continuing when something is very wrong, return early and skip vsyscall emulation. Suggested-by: H. Peter Anvin (Intel) Signed-off-by: Sohil Mehta Reviewed-by: Jarkko Sakkinen --- v2: - Combined the two patches into one. - Make the commit message concise. I have excluded SGX and RMP because I wasn't 100% sure and I didn't get any feedback on them in the last post. Let me know if someone wants them to be added. RFC-v1: https://lore.kernel.org/lkml/20260313192327.2089471-1-sohil.mehta@i= ntel.com/ --- arch/x86/entry/vsyscall/vsyscall_64.c | 10 ++++++---- arch/x86/mm/fault.c | 3 --- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscal= l/vsyscall_64.c index ea36de9fa864..5176860cef55 100644 --- a/arch/x86/entry/vsyscall/vsyscall_64.c +++ b/arch/x86/entry/vsyscall/vsyscall_64.c @@ -257,8 +257,9 @@ static bool __emulate_vsyscall(struct pt_regs *regs, un= signed long address) bool emulate_vsyscall_pf(unsigned long error_code, struct pt_regs *regs, unsigned long address) { - /* Write faults or kernel-privilege faults never get fixed up. */ - if ((error_code & (X86_PF_WRITE | X86_PF_USER)) !=3D X86_PF_USER) + /* Only simple user read faults get fixed up (no write, pkey or shadow st= ack) */ + if ((error_code & (X86_PF_WRITE | X86_PF_PK | X86_PF_SHSTK | X86_PF_USER)= ) !=3D + X86_PF_USER) return false; =20 /* @@ -282,8 +283,9 @@ bool emulate_vsyscall_pf(unsigned long error_code, stru= ct pt_regs *regs, * available, use it to double-check that the emulation code * is only being used for instruction fetches: */ - if (cpu_feature_enabled(X86_FEATURE_NX)) - WARN_ON_ONCE(!(error_code & X86_PF_INSTR)); + if (cpu_feature_enabled(X86_FEATURE_NX) && + WARN_ON_ONCE(!(error_code & X86_PF_INSTR))) + return false; =20 return __emulate_vsyscall(regs, address); } diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index 45b99c3b1442..e0b645a55844 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -1318,9 +1318,6 @@ void do_user_addr_fault(struct pt_regs *regs, * * The vsyscall page does not have a "real" VMA, so do this * emulation before we go searching for VMAs. - * - * PKRU never rejects instruction fetches, so we don't need - * to consider the PF_PK bit. */ if (is_vsyscall_vaddr(address)) { if (emulate_vsyscall_pf(error_code, regs, address)) --=20 2.43.0