linux-kernel - Re: [PATCH] x86: fix typo(?) in step.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080306121648.A53FA2700FD@magilla.localdomain>
Date:	Thu,  6 Mar 2008 04:16:48 -0800 (PST)
From:	Roland McGrath <roland@...hat.com>
To:	Ingo Molnar <mingo@...e.hu>
Cc:	Jan Beulich <jbeulich@...ell.com>, tglx@...utronix.de,
	hpa@...or.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] x86: fix typo(?) in step.c

> my interpretation of the bug would be that we fail to mask out the 
> block-step MSR bit [because we mask out bit 25 instead of bit 1], and 
> hence the bug would cause that MSR bit to stay enabled in other tasks 
> too.

The wrong bit is in calls to write_debugctlmsr, only used when setting up a
thread to step.  It does not affect context switch, so it would never have
an effect on other tasks as you suggest here.

> So in theory the bug should manifest itself as block-step mode never 
> clearing itself, once activated. 

That doesn't happen in the trivial sense of "never", because in the normal
case an actual block-step exception happens and that makes the hardware
clear BTF from the MSR (as well as TF from eflags).  So it would only come
up in a more obscure case.  That is, you set up for block-step but didn't
actually finish the user-mode instruction block.  e.g. interrupted by a
signal or faulting instruction.  The child stops again but not by SIGTRAP,
and next time you don't block-step it.  Then, the BTF bit stays set in
thread.debugctlmsr and gets switched back in when the child runs again.
If you then resume with single-step instead, it will block-step because
BTF is set, but you wanted instruction-step.  Like I said, I didn't
produce a case that behaved that way.  I may be overlooking something.
But that's the scenario I imagine.

> (but this would never leak into other tasks because we've got the
> thread.debugctlmsr abstraction that protects them)

Correct.

Thanks,
Roland
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/