linux-kernel - Re: [PATCH 0/2] ptrace/x86: simplify ptrace_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130415233652.GE17561@somewhere.redhat.com>
Date:	Tue, 16 Apr 2013 01:36:54 +0200
From:	Frederic Weisbecker <fweisbec@...il.com>
To:	Oleg Nesterov <oleg@...hat.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Alan Stern <stern@...land.harvard.edu>,
	Ingo Molnar <mingo@...e.hu>,
	Jan Kratochvil <jan.kratochvil@...hat.com>,
	Maneesh Soni <maneesh@...ux.vnet.ibm.com>,
	Prasad <prasad@...ux.vnet.ibm.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/2] ptrace/x86: simplify ptrace_write_dr7()

On Sun, Apr 14, 2013 at 09:12:05PM +0200, Oleg Nesterov wrote:
> Hello.
> 
> On top of "[PATCH 0/5] kill ptrace_{get,put}_breakpoints()".
> Cleanup and preparation for the potential fix, see below.
> 
> ------------------------------------------------------------------------------
> Now the question. Initially I was going to make more patches
> and fix the regression introduced by 24f1e32c (although I am
> not 100% sure which exactly patch should be blamed).
> 
> See https://bugzilla.redhat.com/show_bug.cgi?id=660204 for
> details.

Oh I missed that.

> 
> ptrace_write_dr7() does not create bp if it is zero, the comment
> says:
> 
> 	/*
> 	 * We should have at least an inactive breakpoint at
> 	 * this slot. It means the user is writing dr7 without
> 	 * having written the address register first.
> 	 */
>                                                                                                     
> and this looks logical. However, at least until 72f674d2
> ptrace_set_debugreg(n => 7) worked even if addr wasn't set
> by ptrace_set_debugreg(n => 0|1|2|3) before.
> 
> And note that ptrace_get_debugreg() does not fail if !ptrace_bps[n],
> it just returns zero as if the address register was written. And
> there is no way to know if address was actually set, not good and
> not consistent.

Indeed.

Looking at the bug report, it seems they only reproduced with a homemade
test. No real app has reported that issue?

Now I guess this is irrelevant. It indeed seems to me saner to be
consistent with regs read like you are pointing out. And that ABI
breakage makes me uncomfortable, even though we haven't heard about
real breakage yet.

> 
> Jan, Frederic, et all. What do you think we should do?
> 
> 	1. Change ptrace_write_dr7() to do register_user_hw_breakpoint()
> 	   if necessary.
> 
> 	   This is what I was going to do, but I am no longer sure
> 	   we want this. For what? Unlikely it is very useful to use
> 	   the "default" addr == 0 for debugging.

So you mean assume that the addr is 0 in dr[0-3] if we write dr7 before writing
the addr register?

Yes, I'm convinced that's the right direction!

> 
> 	2. Change ptrace_get_debugreg(0-4) to return -ESOMETHING if
> 	   ptrace_bps[n] == NULL.
> 
> 	   This will match ptrace_set_debugreg(), but this can break
> 	   something else...

Yeah that would be worse, and I'm sure that breaks existing apps :)

Thanks!
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/