linux-kernel - Re: [regression] x86/signal/64: Fix SS handling for signals delivered to 64-bit programs breaks dosemu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 13 Aug 2015 09:44:56 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Stas Sergeev <stsp@...t.ru>,
	Linux kernel <linux-kernel@...r.kernel.org>
Subject: Re: [regression] x86/signal/64: Fix SS handling for signals delivered
 to 64-bit programs breaks dosemu

On Thu, Aug 13, 2015 at 9:43 AM, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
> On Thu, Aug 13, 2015 at 9:34 AM, Linus Torvalds
> <torvalds@...ux-foundation.org> wrote:
>>
>> Are you sure? From the description by Stas, the problem is literally
>> the *restoring* action of the sigcontext, and trying to restore a SS
>> value that is no longer valid.
>>
>>  "The crash happens when DOS program terminates.
>>   At that point dosemu subverts the execution flow by
>>   replacing segregs and cs/ip ss/sp in sigcontext with its own.
>>   But __pad0 still has DOS SS, which crash because (presumably)
>>   the DOS LDT have been just removed"
>
> Side note: if this is the main issue, and the problem is the "iret"
> faulting when trying to restore SS (and causing an unexpected SIGSEGV
> that dosemu crashes on), then an alternate model might be to keep the
> save/restore SS code, but do a "VERW" on the SS descriptor in
> restore_sigcontext(), and silently just replacing it with __USER_DS if
> that fails.
>

I have a patch to do approximately that (using LAR instead of VERW to
rule out DPL < 3.

I'm 90% sure that the regs->ss = __USER_DS thing is a problem.  Read
farther up in the thread.

I'm leaning toward saying we should revert, cc: stable, and fix it
better for 4.3.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/