linux-kernel - [PATCH 1/1] get_nr_restart_syscall() should return __NR_ia32_restart_syscall if __USER32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Mar 2017 16:54:32 +0200
From:   Oleg Nesterov <oleg@...hat.com>
To:     Andrew Morton <akpm@...ux-foundation.org>,
        Andy Lutomirski <luto@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Denys Vlasenko <dvlasenk@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...hat.com>,
        Jan Kratochvil <jan.kratochvil@...hat.com>,
        Pedro Alves <palves@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>, x86@...nel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH 1/1] get_nr_restart_syscall() should return
 __NR_ia32_restart_syscall if __USER32_CS

get_nr_restart_syscall() checks TS_I386_REGS_POKED but this bit is only
set if debugger is 32-bit. If a 64-bit debugger restores the registers
of a 32-bit debugee outside of syscall exit path get_nr_restart_syscall()
wrongly returns __NR_restart_syscall.

Test-case:

  $ cvs -d :pserver:anoncvs:anoncvs@...rceware.org:/cvs/systemtap co ptrace-tests
  $ gcc -o erestartsys-trap-debuggee ptrace-tests/tests/erestartsys-trap-debuggee.c --m32
  $ gcc -o erestartsys-trap-debugger ptrace-tests/tests/erestartsys-trap-debugger.c -lutil
  $ ./erestartsys-trap-debugger
  Unexpected: retval 1, errno 22
  erestartsys-trap-debugger: ptrace-tests/tests/erestartsys-trap-debugger.c:421

As Jan explains this is what "(gdb) call func()" actually does:

	* Tracee calls sleep(2).
	* Debugger interrupts the tracee by CTRL-C after 1 sec.
	* Save regs by PTRACE_GETREGS.
	* Use PTRACE_SETREGS changing %rip to some 'func' and setting %orig_rax=-1
	* PTRACE_CONT
	* func() uses int3.
	* Debugger catches SIGTRAP.
	* Restore original regs by PTRACE_SETREGS.
	* PTRACE_CONT

Change get_nr_restart_syscall() to take __USER32_CS into account, to me
this looks a bit better than TIF_IA32 check but either way this logic
can't be always right as the comment explains.

Alternatively we could change putreg() to set TS_I386_REGS_POKED just like
putreg32() does if "child" is 32-bit, but this won't fix all the problems
too and I think it would be beter to kill TS_I386_REGS_POKED after this
change.

Reported-by: Jan Kratochvil <jan.kratochvil@...hat.com>
Signed-off-by: Oleg Nesterov <oleg@...hat.com>
Cc: stable@...r.kernel.org
---
 arch/x86/kernel/signal.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 763af1d..1b05448 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -785,7 +785,8 @@ static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs)
 	 * than the tracee.
 	 */
 #ifdef CONFIG_IA32_EMULATION
-	if (current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED))
+	if ((current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED)) ||
+	    regs->cs == __USER32_CS)
 		return __NR_ia32_restart_syscall;
 #endif
 #ifdef CONFIG_X86_X32_ABI
-- 
2.5.0