linux-kernel - Re: [PATCH, RFC] x86-64: properly handle FPU code/data selectors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+55aFwCe=t4dDbDhHTWhzA3zMEyyS2WSYBP2Sfe0eogGEBS1w@mail.gmail.com>
Date:	Wed, 16 Oct 2013 08:19:04 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Jan Beulich <JBeulich@...e.com>
Cc:	Ingo Molnar <mingo@...e.hu>, Thomas Gleixner <tglx@...utronix.de>,
	Peter Anvin <hpa@...or.com>, KVM list <kvm@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH, RFC] x86-64: properly handle FPU code/data selectors

On Wed, Oct 16, 2013 at 5:00 AM, Jan Beulich <JBeulich@...e.com> wrote:
>
> The basic idea here is to either use a priori information on the
> intended state layout (in the case of 32-bit processes) or "sense" the
> proper layout (in the case of KVM guests) by inspecting the already
> saved FPU rip/rdp, and reading their actual values in a second save
> operation.

The rip/rdp thing looks very hacky. And *without* the rip/rdp thing, I
think the word-size always matches the TIF32 bit, right?

Why wouldn't the high bits be zero even in 64-bit mode? It would seem
to be a *major* bug if you are in 64-bit mode but (for example) try to
use the low 32-bit of virtual memory (ie something x32-like), and now
your patch decides to use the 32-bit layout.

As far as I can tell, you actually corrupt rid/rdp in that case
(because when you write the fcs thing, it overwrites the high bits of
rip, and fos overwrites the high bits of rdp). So now bits that
*should* be zero are not.

So you're basically trying to save some old state by corrupting new
state instead.

Am I overlooking something?

                Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/