linux-kernel - Re: [PATCH] x86/mm: Drop TS_COMPAT on 64-bit exec() syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 19 May 2018 03:33:41 +0100
From:   Dmitry Safonov <0x7f454c46@...il.com>
To:     Dmitry Safonov <dima@...sta.com>
Cc:     Andy Lutomirski <luto@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>, izbyshev@...ras.ru,
        Alexander Monakov <amonakov@...ras.ru>,
        Borislav Petkov <bp@...e.de>,
        Cyrill Gorcunov <gorcunov@...nvz.org>,
        "H. Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...hat.com>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Linux-MM <linux-mm@...ck.org>, X86 ML <x86@...nel.org>,
        stable <stable@...r.kernel.org>
Subject: Re: [PATCH] x86/mm: Drop TS_COMPAT on 64-bit exec() syscall

2018-05-19 3:25 GMT+01:00 Dmitry Safonov <0x7f454c46@...il.com>:
>> Here is the function:
>> 0000000000400842 <call32_from_64>:
>>   400842:       53                      push   %rbx
>>   400843:       55                      push   %rbp
>>   400844:       41 54                   push   %r12
>>   400846:       41 55                   push   %r13
>>   400848:       41 56                   push   %r14
>>   40084a:       41 57                   push   %r15
>>   40084c:       9c                      pushfq
>>   40084d:       48 89 27                mov    %rsp,(%rdi)
>>   400850:       48 89 fc                mov    %rdi,%rsp
>>   400853:       6a 23                   pushq  $0x23
>>   400855:       68 5c 08 40 00          pushq  $0x40085c
>>   40085a:       48 cb                   lretq
>>   40085c:       ff d6                   callq  *%rsi
>>   40085e:       ea                      (bad)
>>   40085f:       65 08 40 00             or     %al,%gs:0x0(%rax)
>>   400863:       33 00                   xor    (%rax),%eax
>>   400865:       48 8b 24 24             mov    (%rsp),%rsp
>>   400869:       9d                      popfq
>>   40086a:       41 5f                   pop    %r15
>>   40086c:       41 5e                   pop    %r14
>>   40086e:       41 5d                   pop    %r13
>>   400870:       41 5c                   pop    %r12
>>   400872:       5d                      pop    %rbp
>>   400873:       5b                      pop    %rbx
>>   400874:       c3                      retq
>>   400875:       66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)
>>   40087c:       00 00 00
>>   40087f:       90                      nop
>>
>> Looks like mov between registers caused it? The hell.
>
> Oh, it's not 400850, I missloked, but 40085a so lretq might case it.

But it's
002b:00000000417bafe8
USER_DS and sensible address, still no idea.

-- 
             Dmitry