linux-kernel - Re: Sysenter crash with Nested Task Bit set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200609181729.23934.ak@suse.de>
Date:	Mon, 18 Sep 2006 17:29:23 +0200
From:	Andi Kleen <ak@...e.de>
To:	Linus Torvalds <torvalds@...l.org>
Cc:	Andrew Morton <akpm@...l.org>,
	Chuck Ebbert <76306.1226@...puserve.com>,
	In Cognito <defend.the.world@...il.com>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...e.hu>, bcrl@...ck.org
Subject: Re: Sysenter crash with Nested Task Bit set


> If we fix it in the task-switch code, we shouldn't need any other changes 
> (ie Chuck's change is unnecessary too), because then the process that sets 
> NT will happily die (with NT set), but switch away to something else and 
> nobody else will be affected.

Won't it die in the kernel with an oops on the next interrupt?
 
> So if I'm right, then this patch _should_ fix it. UNTESTED (and the 
> "ref_from_fork" special case doesn't clear NT, so it's strictly incompete, 
> but maybe somebody can test this?)

Are you sure this handles interrupts or nested syscalls 
before the context switch correctly?

I think it really needs to be handled in the sysenter path.

> 
> Hmm? Ingo? Comments?
> 
> Andi? I don't know if x86-64 honors NT in 64-bit mode, but if it does, it 
> needs something similar (assuming this works).

It doesn't task switch, but you would get a #GP in IRET at least.
Leaking that to another process is definitely not good.


>  #define switch_to(prev,next,last) do {					\
>  	unsigned long esi,edi;						\
> -	asm volatile("pushl %%ebp\n\t"					\
> +	asm volatile("pushfl\n\t"		/* Save flags */	\
> +		     "pushl %%ebp\n\t"					\

We used to do that pushfl/popfl some time ago, but Ben removed it because
it was slow on P4.  Ok, nobody thought of that case back then.

-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/