linux-kernel - Re: [PATCH v2] arm: cmpxchg syscall should data abort if page not write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTimOakgzK9LB6g8ibEZ_rr9=ZJw+4aS5Xz3F=J7Z@mail.gmail.com>
Date:	Thu, 17 Mar 2011 17:18:00 +0800
From:	Po-Yu Chuang <ratbert.chuang@...il.com>
To:	linux-arm-kernel@...ts.infradead.org, linux@....linux.org.uk
Cc:	linux-kernel@...r.kernel.org, tony@...mide.com,
	nicolas.pitre@...aro.org, joe@...ches.com,
	Po-Yu Chuang <ratbert@...aday-tech.com>
Subject: Re: [PATCH v2] arm: cmpxchg syscall should data abort if page not write

Dear Russell King,

On Tue, Mar 15, 2011 at 2:13 PM, Po-Yu Chuang <ratbert.chuang@...il.com> wrote:
>
> From: Po-Yu Chuang <ratbert@...aday-tech.com>
>
> If the page to cmpxchg is user mode read only (not write),
> we should simulate a data abort first.
>
> Signed-off-by: Po-Yu Chuang <ratbert@...aday-tech.com>
> ---
> v2:
> remove !pte_young() check
>
>  arch/arm/kernel/traps.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
> index 446aee9..eac7c05 100644
> --- a/arch/arm/kernel/traps.c
> +++ b/arch/arm/kernel/traps.c
> @@ -563,7 +563,7 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
>                if (!pmd_present(*pmd))
>                        goto bad_access;
>                pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
> -               if (!pte_present(*pte) || !pte_dirty(*pte)) {
> +               if (!pte_present(*pte) || !pte_write(*pte) || !pte_dirty(*pte)) {
>                        pte_unmap_unlock(pte, ptl);
>                        goto bad_access;
>                }
> --
> 1.6.3.3
>

I think maybe I should describe more details of the problem.
Here is the story.

There is a lock with value 0. After fork(), the page containing the lock
becomes user mode read only for COW later. Process 0 writes 1 to
the lock with cmpxchg syscall. This write should cause COW.
The value of lock of Process 0 should become 1 and the value of lock
of Porcess 1 should still be 0 in the COWed page.

(CORRECT)

P0:lock=0
P0:fork
P0:cmpxchg -> COW
P0:lock=1	P1:lock=0

However, because cmpxchg syscall did not check user mode read only,
it wrote 1 to the lock value directly. After returning to user mode,
Process 0 wrote another variable, say foo, on the same page and
caused COW. The value of lock of Process 1 became 1 which is
incorrect.

(INCORRECT)

P0:lock=0
P0:fork
P0:cmpxchg
P0:lock=1
P0:foo=123 -> COW
P0:lock=1	P1:lock=1

best regards,
Po-Yu Chuang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/