linux-kernel - Re: Compat 32-bit syscall entry from 64-bit task!?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 25 Jan 2012 20:36:35 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Indan Zupancic <indan@....nu>, Andi Kleen <andi@...stfloor.org>,
	Jamie Lokier <jamie@...reable.org>,
	Andrew Lutomirski <luto@....edu>,
	Will Drewry <wad@...omium.org>, linux-kernel@...r.kernel.org,
	keescook@...omium.org, john.johansen@...onical.com,
	serge.hallyn@...onical.com, coreyb@...ux.vnet.ibm.com,
	pmoore@...hat.com, eparis@...hat.com, djm@...drot.org,
	segoon@...nwall.com, rostedt@...dmis.org, jmorris@...ei.org,
	scarybeasts@...il.com, avi@...hat.com, penberg@...helsinki.fi,
	viro@...iv.linux.org.uk, mingo@...e.hu, akpm@...ux-foundation.org,
	khilman@...com, borislav.petkov@....com, amwang@...hat.com,
	ak@...ux.intel.com, eric.dumazet@...il.com, gregkh@...e.de,
	dhowells@...hat.com, daniel.lezcano@...e.fr,
	linux-fsdevel@...r.kernel.org,
	linux-security-module@...r.kernel.org, olofj@...omium.org,
	mhalcrow@...gle.com, dlaor@...hat.com,
	Roland McGrath <mcgrathr@...omium.org>,
	Denys Vlasenko <vda.linux@...glemail.com>
Subject: Re: Compat 32-bit syscall entry from 64-bit task!?

On 01/18, Linus Torvalds wrote:
>
> Using the high bits of 'eflags' might work.

I thought about changing eflags too, this looks very natural to me.

But I do not understand the result of this discussion, are you going
to apply this change?

If not...

Not sure this is really better, but there is another idea. Currently we
have PTRACE_O_TRACESYSGOOD to avoid the confusion with the real SIGTRAP.
Perhaps we can add PTRACE_O_TRACESYS_VERY_GOOD (or we can look at
PT_SEIZED instead) and report TS_COMPAT via ptrace_report_syscall ?

IOW. Currently ptrace_report_syscall() does

	ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));

We can add the new events,

	PTRACE_EVENT_SYSCALL_ENTRY
	PTRACE_EVENT_SYSCALL_COMPAT_ENTRY
	PTRACE_EVENT_SYSCALL_EXIT
	PTRACE_EVENT_SYSCALL_COMPAT_EXIT

and change ptrace_report_syscall() to do

	if (PT_SEIZED) /* or PT_TRACESYS_VERY_GOOD? */ {
		int event = entry ? PTRACE_EVENT_SYSCALL_ENTRY : EXIT;
		if (is_compat_task(current))
			event++;
		ptrace_notify((event << 8) | SIGTRAP);
	} else {
		ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
	}

This also allows to distinguish entry/exit.


However. The change in get_flags() also allows to know the state of
TIF_IA32 bit bit outside of syscall entry/exit reports, perhaps there
is a reason why do we want this?

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/