linux-kernel - Re: 'khelper' (child) is stuck in endless loop: do_signal() and !user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120308162913.GA12554@redhat.com>
Date:	Thu, 8 Mar 2012 17:29:13 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	"Dmitry ADAMUSHKA (EXT)" <dmitry.adamushka_ext@...tathome.com>,
	"H. Peter Anvin" <hpa@...or.com>
Cc:	Ingo Molnar <mingo@...e.hu>, Ralf Baechle <ralf@...ux-mips.org>,
	wouter cloetens <wouter.cloetens@...tathome.com>,
	linux-kernel@...r.kernel.org,
	Dmitry Adamushko <dmitry.adamushko@...il.com>
Subject: Re: 'khelper' (child) is stuck in endless loop: do_signal() and
	!user_mode(regs)

On 03/08, Dmitry ADAMUSHKA (EXT) wrote:
>
> The following quick hack "fixes" it for x86.

First of all let me repeat, I do not understand this asm ;)
Fortunately Ingo and Peter do.

But,

> --- arch/x86/kernel/entry_32.S.orig     2012-03-08 15:42:25.041296595 +0100
> +++ arch/x86/kernel/entry_32.S  2012-03-08 15:58:29.926081131 +0100
> @@ -98,12 +98,6 @@
>  #endif
>  .endm
>
> -#ifdef CONFIG_VM86
> -#define resume_userspace_sig   check_userspace
> -#else
> -#define resume_userspace_sig   resume_userspace
> -#endif
> -
>  /*
>   * User gs save/restore
>   *
> @@ -327,10 +321,19 @@ ret_from_exception:
>         preempt_stop(CLBR_ANY)
>  ret_from_intr:
>         GET_THREAD_INFO(%ebp)
> -check_userspace:
> +resume_userspace_sig:
> +#ifdef CONFIG_VM86
>         movl PT_EFLAGS(%esp), %eax      # mix EFLAGS and CS
>         movb PT_CS(%esp), %al
>         andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
> +#else
> +/*
> + * We can be coming here from a syscall done in the kernel space,
> + * e.g. a failed kernel_execve().
> + */
> +       movl PT_CS(%esp), %eax
> +       andl $SEGMENT_RPL_MASK, %eax
> +#endif
>         cmpl $USER_RPL, %eax
>         jb resume_kernel                # not returning to v8086 or userspace

IIUC (I can be easily wrong) this breaks the endless loop, but
only after do_notify_resume() was already called.

_perhaps_ it would be better to avoid do_notify_resume() in this
case altogether. Say, fire_user_return_notifiers() doesn't look
right in this case, we are not going to return to the usermode.

Not that I think this is really wrong though.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/