linux-kernel - Re: [RFC PATCH v1 11/31] ARC: Low level IRQ/Trap/Exception(non-MMU) Handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 16 Nov 2012 04:58:28 +0000
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Vineet Gupta <Vineet.Gupta1@...opsys.com>
Cc:	linux-arch@...r.kernel.org, linux-kernel@...r.kernel.org,
	tglx@...utronix.de, arnd@...db.de
Subject: Re: [RFC PATCH v1 11/31] ARC: Low level IRQ/Trap/Exception(non-MMU)
 Handling

> +	; --------- check for signals/restore-sigmask ------------
> +	bbit0  r9, TIF_SIGPENDING, chk_next_work
> +
> +	; save CALLEE Regs.
> +	; (i)  If this signal causes coredump - full regfile needed
> +	; (ii) If signal is SIGTRAP/SIGSTOP, task is being traced thus
> +	;      tracer might call PEEKUSR for a CALLEE reg
> +	;
> +	; NOTE: SP will grow up by size of CALLEE Reg-File
> +	SAVE_CALLEE_SAVED_USER		; clobbers r12
> +
> +	; save location of saved Callee Regs @ thread_struct->callee
> +	GET_CURR_TASK_FIELD_PTR   TASK_THREAD, r10
> +	st  sp, [r10, THREAD_CALLEE_REG]
> +
> +	bl  @do_signal
> +
> +	; unwind SP for cheap discard of Callee saved Regs
> +	DISCARD_CALLEE_SAVED_USER

Uh-oh...  And what if tracer wanted to modify callee-saved regs?

> +	b      resume_user_mode_begin	; loop back to start of U mode ret
> +
> +	; --- notify_resume ---
> +chk_next_work:
> +	btst   r9, TIF_NOTIFY_RESUME
> +	blnz   @do_notify_resume
> +
> +	;--------- All things done, go back to Userland ------
> +
> +	b restore_regs

No.  After NOTIFY_RESUME stuff you need to recheck SIGPENDING.  This should
go to resume_user_mode_begin, not restore regs.  Another problem here is
IRQ handling - you hit do_signal()/do_notify_resume() with IRQs disabled,
which is broken - you need to re-enable it before going into either.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/