linux-kernel - [tip:core/urgent] arm64/syscalls: Move address limit check in loop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 17 Sep 2017 10:54:45 -0700
From:   tip-bot for Thomas Garnier <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     catalin.marinas@....com, dhowells@...hat.com, wad@...omium.org,
        will.deacon@....com, tglx@...utronix.de, panand@...hat.com,
        hpa@...or.com, dave.hansen@...el.com, linux-kernel@...r.kernel.org,
        leonard.crestez@....com, arnd@...db.de, keescook@...omium.org,
        Dave.Martin@....com, mingo@...nel.org, luto@...capital.net,
        yhs@...com, thgarnie@...gle.com, viro@...iv.linux.org.uk,
        linux@...linux.org.uk
Subject: [tip:core/urgent] arm64/syscalls: Move address limit check in loop

Commit-ID:  a2048e34d4655c06d31400646ae495bbfeb16b27
Gitweb:     http://git.kernel.org/tip/a2048e34d4655c06d31400646ae495bbfeb16b27
Author:     Thomas Garnier <thgarnie@...gle.com>
AuthorDate: Thu, 7 Sep 2017 08:30:47 -0700
Committer:  Thomas Gleixner <tglx@...utronix.de>
CommitDate: Sun, 17 Sep 2017 19:45:33 +0200

arm64/syscalls: Move address limit check in loop

A bug was reported on ARM where set_fs might be called after it was
checked on the work pending function. ARM64 is not affected by this bug
but has a similar construct. In order to avoid any similar problems in
the future, the addr_limit_user_check function is moved at the beginning
of the loop.

Fixes: cf7de27ab351 ("arm64/syscalls: Check address limit on user-mode return")
Reported-by: Leonard Crestez <leonard.crestez@....com>
Signed-off-by: Thomas Garnier <thgarnie@...gle.com>
Signed-off-by: Kees Cook <keescook@...omium.org>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Pratyush Anand <panand@...hat.com>
Cc: Dave Martin <Dave.Martin@....com>
Cc: Will Drewry <wad@...omium.org>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Catalin Marinas <catalin.marinas@....com>
Cc: Will Deacon <will.deacon@....com>
Cc: Russell King <linux@...linux.org.uk>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: David Howells <dhowells@...hat.com>
Cc: Dave Hansen <dave.hansen@...el.com>
Cc: Al Viro <viro@...iv.linux.org.uk>
Cc: linux-api@...r.kernel.org
Cc: Yonghong Song <yhs@...com>
Cc: linux-arm-kernel@...ts.infradead.org
Link: http://lkml.kernel.org/r/1504798247-48833-5-git-send-email-keescook@chromium.org

---
 arch/arm64/kernel/signal.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
index c45214f..0bdc96c 100644
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -751,10 +751,10 @@ asmlinkage void do_notify_resume(struct pt_regs *regs,
 	 */
 	trace_hardirqs_off();
 
-	/* Check valid user FS if needed */
-	addr_limit_user_check();
-
 	do {
+		/* Check valid user FS if needed */
+		addr_limit_user_check();
+
 		if (thread_flags & _TIF_NEED_RESCHED) {
 			schedule();
 		} else {