linux-kernel - Re: [PATCH v1 1/4] um: Fix ptrace GETREGS/SETREGS bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 21 Dec 2015 20:10:54 +0100
From:	Mickaël Salaün <mic@...ikod.net>
To:	Richard Weinberger <richard@....at>, linux-kernel@...r.kernel.org
Cc:	Jonathan Corbet <corbet@....net>, Jeff Dike <jdike@...toit.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H . Peter Anvin" <hpa@...or.com>, x86@...nel.org,
	Kees Cook <keescook@...omium.org>,
	Andy Lutomirski <luto@...capital.net>,
	Will Drewry <wad@...omium.org>,
	Shuah Khan <shuahkh@....samsung.com>,
	Chris Metcalf <cmetcalf@...hip.com>,
	Michael Ellerman <mpe@...erman.id.au>,
	Andrew Morton <akpm@...ux-foundation.org>,
	James Hogan <james.hogan@...tec.com>,
	Thomas Meyer <thomas@...3r.de>,
	Nicolas Iooss <nicolas.iooss_linux@....org>,
	Anton Ivanov <aivanov@...cade.com>, linux-doc@...r.kernel.org,
	user-mode-linux-devel@...ts.sourceforge.net,
	user-mode-linux-user@...ts.sourceforge.net,
	linux-api@...r.kernel.org,
	Meredydd Luff <meredydd@...atehouse.org>,
	David Drysdale <drysdale@...gle.com>
Subject: Re: [PATCH v1 1/4] um: Fix ptrace GETREGS/SETREGS bugs


On 21/12/2015 11:13, Richard Weinberger wrote:
> Am 21.12.2015 um 10:23 schrieb Mickaël Salaün:
>>>>> Doesn't this break the support for changing syscall numbers using PTRACE_SETREGS?
>>>>
>>>> The logic is unchanged except updating the UPT_SYSCALL_NR before syscall_trace_enter(). I did my last tests with the x86_32 subarchitecture and all tests (from selftest/seccomp), including PTRACE_SETREGS for syscall numbers tests, passed. However, 2 of this tests still fail for x86_64 (only).
>>>
>>> No, the logic is different.
>>> syscall_trace_enter(regs) enters the ptrace() path and here registers can be changed.
>>> Hence "syscall = UPT_SYSCALL_NR(r);" will see the old syscall number.
>>> UPT_SYSCALL_NR() returns the syscall number before the ptrace() path...
>>
>> The thing is, PTRACE_SETREGS give access to *orig_ax* in the user_regs_struct from arch/x86/include/asm/user_*.h and selftest/seccomp only update this (virtual) register, not the EAX/RAX. Am I missing something?
> 
> Sorry, meant orig...
> 
> Please see the attached program. It proves that your patch is breaking stuff.
> The test is extracted from UML's selftests.

OK, I found the origin of this misunderstanding. On x86_32, PTRACE_SETREGS set regs->syscall when updating orig_eax, which is not the case on x86_64, hence the difference of behavior. I fixed this bug in the v2 series. The ptsc test and all the seccomp tests pass for 32 and 64 bits!

Where can we find the UML selftests?

Thanks,
 Mickaël


Download attachment "signature.asc" of type "application/pgp-signature" (456 bytes)