linux-kernel - Re: Q: user_enable_single_step() && update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5019427B.1070002@linutronix.de>
Date:	Wed, 01 Aug 2012 16:51:39 +0200
From:	Sebastian Andrzej Siewior <bigeasy@...utronix.de>
To:	Oleg Nesterov <oleg@...hat.com>
CC:	Roland McGrath <roland@...k.frob.com>,
	"H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org,
	ananth@...ibm.com, a.p.zijlstra@...llo.nl, mingo@...hat.com,
	srikar@...ux.vnet.ibm.com
Subject: Re: Q: user_enable_single_step() && update_debugctlmsr()

On 08/01/2012 04:31 PM, Oleg Nesterov wrote:
> And I think you missed my point. I'll try again.
Okay.

> We have the GDB process and the (stopped) tracee T. And we have
> another task X which have TIF_SINGLESTEP but not TIF_BLOCKSTEP.
> To simplify, suppose that X is already TASK_RUNNING but not on rq.
>
> GDB does ptrace(PTRACE_SINGLEBLOCK, T). This sets X->TIF_BLOCKSTEP.
> Now suppose that GDB is preempted right after it does
> update_debugctlmsr(), and the scheduler choses X as the next task.
>
> Both GDB and X do not have TIF_BLOCKSTEP, so __switch_to_extra()
> does not update DEBUGCTLMSR_BTF.
>
> X returns to the user-mode with TIF_SINGLESTEP and TIF_BLOCKSTEP,
> the latter is wrong.
>
> No?

Yup, correct, you are right sir. Thank you for trying so hard to make
me see this :)

So a patch like
--- a/arch/x86/kernel/step.c
+++ b/arch/x86/kernel/step.c
@@ -173,8 +173,8 @@ static void enable_step(struct task_struct *child, 
bool block)
                 unsigned long debugctl = get_debugctlmsr();

                 debugctl |= DEBUGCTLMSR_BTF;
-               update_debugctlmsr(debugctl);
                 set_tsk_thread_flag(child, TIF_BLOCKSTEP);
+               update_debugctlmsr(debugctl);
         } else if (test_tsk_thread_flag(child, TIF_BLOCKSTEP)) {
                 unsigned long debugctl = get_debugctlmsr();

should fix the race and _yes_ I also would follow your suggestion to
remove this update_debugctlmsr() here since switch_to() should do this.

>
> Oleg.
>

Sebastian
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/