Pointer authentication failure detection

Patent metadata

Field	Value
Publication number	US-11989280-B2
Application number	US-202117489390-A
Country	US
Kind code	B2
Filing date	Sep 17, 2021
Priority date	Sep 17, 2021
Publication date	May 21, 2024
Grant date	May 21, 2024

Abstract

Handling a memory fault based on detecting whether a memory pointer was invalidated by a pointer authentication (PA) failure. After an access to a memory pointer causes a memory fault, detecting that the memory pointer was invalidated by a PA failure includes creating a new memory pointer by replacing reserved bits of the memory pointer with a default value, and determining that the new memory pointer corresponds to a memory address that falls within executable memory. This determination includes determining that the memory address is within an executable memory page, determining that a call instruction is stored at a prior memory address that immediately precedes the memory address, and/or determining that the memory address corresponds to a code section of an executable file. The PA failure is handled based on logging the PA failure, terminating the application program, and/or resuming execution at an instruction stored at the memory address.

First claim

What is claimed:

1. A method, implemented at a computer system that includes a processor, for memory fault handling based on detecting whether a memory pointer was invalidated by a pointer authentication (PA) failure, the method comprising:
identifying a memory pointer, an access to which caused a memory fault at the processor during execution of an application program;
detecting that the memory pointer was invalidated by a PA failure, including:
creating a new memory pointer by replacing a plurality of reserved bits of the memory pointer with a default value of the plurality of reserved bits; and
determining that the new memory pointer corresponds to a memory address that falls within an executable memory location, based on at least one of:
determining that a call instruction is stored at a prior memory address that immediately precedes the memory address; or
determining that the memory address corresponds to a memory region mapped to a code section of an executable file; and

based at least on detecting that the memory pointer was invalidated by a PA failure, handling the PA failure, including performing at least one of:
logging the PA failure;
terminating the application program; or
resuming execution at a machine code instruction stored at the memory address.

2. The method of claim 1 , wherein the memory fault is a memory translation fault.

3. The method of claim 1 , the method being implemented by a memory fault handler of an operating system kernel.

4. The method of claim 1 , wherein the method detects whether the memory pointer was invalidated by a PA failure only when the processor is determined to be PA capable.

5. The method of claim 1 , wherein the method detects whether the memory pointer was invalidated by a PA failure only when the application program was compiled with support for PA.

6. The method of claim 1 , wherein, based on the application program executing in an audit mode, handling the PA failure comprises (i) logging the PA failure, and (ii) resuming execution at the machine code instruction stored at the memory address.

7. The method of claim 1 , wherein, based on the application program executing in a strict mode, handling the PA failure comprises (i) logging the PA failure, and (ii) terminating the application program.

8. The method of claim 1 , wherein,
the method includes determining that the memory address corresponds to a memory region mapped to a code section of an executable file; and
based on the application program executing in a compatibility mode, handling the PA failure comprises terminating the application program when the executable file corresponds to the application program.

9. The method of claim 1 , wherein,
the method includes determining that the memory address corresponds to a memory region mapped to a code section of an executable file; and
based on the application program executing in a compatibility mode, handling the PA failure comprises resuming execution at the machine code instruction stored at the memory address when the executable file is a binary loaded by the application program.

10. The method of claim 1 , wherein determining that the new memory pointer corresponds to a memory address that falls within an executable memory location comprises determining that the memory address is within an executable memory page.

11. The method of claim 1 , wherein determining that the new memory pointer corresponds to a memory address that falls within an executable memory location comprises determining that a call instruction is stored at a prior memory address that immediately precedes the memory address.

12. The method of claim 1 , wherein determining that the new memory pointer corresponds to a memory address that falls within an executable memory location comprises determining that the memory address corresponds to a memory region mapped to a code section of an executable file.

13. A computer system for memory fault handling based on detecting whether a memory pointer was invalidated by a pointer authentication (PA) failure, comprising:
a processor; and
a hardware storage device that stores computer-executable instructions that are executable by the processor to cause the computer system to at least:
identify a memory pointer, an access to which caused a memory fault at the processor during execution of an application program;
detect that the memory pointer was invalidated by a PA failure, including:
creating a new memory pointer by replacing a plurality of reserved bits of the memory pointer with a default value of the plurality of reserved bits; and
determining that the new memory pointer corresponds to a memory address that falls within an executable memory location, based on at least one of:
determining that a call instruction is stored at a prior memory address that immediately precedes the memory address; or
determining that the memory address corresponds to a memory region mapped to a code section of an executable file; and

based at least on detecting that the memory pointer was invalidated by a PA failure, handle the PA failure, including performing at least one of:
logging the PA failure;
terminating the application program; or
resuming execution at a machine code instruction stored at the memory address.

14. The computer system of claim 13 , wherein the computer-executable instructions are executable by the processor to cause the computer system to detect whether the memory pointer was invalidated by a PA failure only when the processor is determined to be PA capable.

15. The computer system of claim 13 , wherein the computer-executable instructions are executable by the processor to cause the computer system to detect whether the memory pointer was invalidated by a PA failure only when the application program was compiled with support for PA.

16. The computer system of claim 13 , wherein, based on the application program executing in an audit mode, handling the PA failure comprises (i) logging the PA failure, and (ii) resuming execution at the machine code instruction stored at the memory address.

17. The computer system of claim 13 , wherein, based on the application program executing in a strict mode, handling the PA failure comprises (i) logging the PA failure, and (ii) terminating the application program.

18. The computer system of claim 13 , wherein,
the computer system determines that the memory address corresponds to a memory region mapped to a code section of an executable file; and
based on the application program executing in a compatibility mode, handling the PA failure comprises terminating the application program when the executable file corresponds to the application program.

19. The computer system of claim 13 , wherein,
the computer system determines that the memory address corresponds to a memory region mapped to a code section of an executable file; and
based on the application program executing in a compatibility mode, handling the PA failure comprises resuming execution at the machine code instruction stored at the memory address when the executable file is a binary loaded by the application program.

20. A hardware storage device that stores computer-executable instructions that are executable by a processor to cause a computer system to handle a memory fault based on detecting whether a memory pointer was invalidated by a pointer authentication (PA) failure, the computer-executable instructions including instructions that are executable by the processor to cause the computer system to at least:
id

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Lin Jin
• Lin Jason
• Woolman Matthew John
• Iyigun Mehmet

Classifications

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F12/10

  Address translation · CPC title

• G06F2212/657

  Virtual address space management · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title