linux-kernel - [PATCH] Fatal kernel faults should update thread struct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Mon, 12 Feb 2007 15:22:20 -0500
From:	Jeff Dike <jdike@...toit.com>
To:	akpm@...l.org, "Andi Kleen" <ak@...e.de>
cc:	linux-kernel@...r.kernel.org, "Jan Beulich" <jbeulich@...ell.com>,
	patches@...-64.org
Subject: [PATCH] Fatal kernel faults should update thread struct

Fix a bug introduced in my earlier fault information pollution
prevention patch.  That patch assumed that no kernel fault information
should ever be put in thread.error_code and .trap_no.  It turns out
that die() reads those fields, so fatal kernel faults, as well as
userspace faults, need those fields set.  The case where they aren't
set is kernelspace faults which are fixed up.

Thanks to Jan Beulich for his review and spotting this bug.

Signed-off-by: Jeff Dike <jdike@...toit.com>
--
 arch/i386/kernel/traps.c   |   11 +++++++++++
 arch/x86_64/kernel/traps.c |   14 +++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

Index: linux-2.6/arch/i386/kernel/traps.c
===================================================================
--- linux-2.6.orig/arch/i386/kernel/traps.c
+++ linux-2.6/arch/i386/kernel/traps.c
@@ -607,6 +607,15 @@ fastcall void __kprobes do_general_prote
 	if (!user_mode(regs))
 		goto gp_in_kernel;
 
+	/*
+	 * We want error_code and trap_no set for userspace faults and
+	 * kernelspace faults which result in die(), but not
+	 * kernelspace faults which are fixed up.  die() gives the
+	 * process no chance to handle the signal and notice the
+	 * kernel fault information, so that won't result in polluting
+	 * the information about previously queued, but not yet
+	 * delivered, fault.
+	 */
 	current->thread.error_code = error_code;
 	current->thread.trap_no = 13;
 	force_sig(SIGSEGV, current);
@@ -619,6 +628,8 @@ gp_in_vm86:
 
 gp_in_kernel:
 	if (!fixup_exception(regs)) {
+		current->thread.error_code = error_code;
+		current->thread.trap_no = 13;
 		if (notify_die(DIE_GPF, "general protection fault", regs,
 				error_code, 13, SIGSEGV) == NOTIFY_STOP)
 			return;
Index: linux-2.6/arch/x86_64/kernel/traps.c
===================================================================
--- linux-2.6.orig/arch/x86_64/kernel/traps.c
+++ linux-2.6/arch/x86_64/kernel/traps.c
@@ -582,6 +582,15 @@ static void __kprobes do_trap(int trapnr
 	struct task_struct *tsk = current;
 
 	if (user_mode(regs)) {
+		/*
+		 * We want error_code and trap_no set for userspace faults
+		 * and kernelspace faults which result in die(), but
+		 * not kernelspace faults which are fixed up.  die()
+		 * gives the process no chance to handle the signal
+		 * and notice the kernel fault information, so that
+		 * won't result in polluting the information about
+		 * previously queued, but not yet delivered, fault.
+		 */
 		tsk->thread.error_code = error_code;
 		tsk->thread.trap_no = trapnr;
 
@@ -605,8 +614,11 @@ static void __kprobes do_trap(int trapnr
 		fixup = search_exception_tables(regs->rip);
 		if (fixup)
 			regs->rip = fixup->fixup;
-		else	
+		else {
+			tsk->thread.error_code = error_code;
+			tsk->thread.trap_no = trapnr;
 			die(str, regs, error_code);
+		}
 		return;
 	}
 }

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/