linux-kernel - Re: [x86, vdso] BUG: unable to handle kernel paging request at d34bd000

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 10 Mar 2014 11:10:57 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	"H. Peter Anvin" <hpa@...ux.intel.com>
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Stefani Seibold <stefani@...bold.net>,
	Andreas Brief <Andreas.Brief@...de-schwarz.com>,
	Martin Runge <Martin.Runge@...de-schwarz.com>
Subject: Re: [x86, vdso] BUG: unable to handle kernel paging request at d34bd000

On Mon, Mar 10, 2014 at 10:58 AM, H. Peter Anvin <hpa@...ux.intel.com> wrote:
> On 03/10/2014 10:52 AM, Andy Lutomirski wrote:
>>>
>>> Hint: where is your RIP?  Where is the RIP of other processes?
>>>
>>
>> Whoa there, I'm not suggesting anything nearly that crazy :)
>>
>> I'm suggesting changing out the vvar page *for that process*, which is
>> not executable.  The actual vdso code already supports this -- from
>> userspace's point of view it's the same thing as 'echo acpi_pm >
>> /sys/devices/system/clocksource/clocksource0/current_clocksource',
>> except that if the actual clocksource is HPET, the hpet page will be
>> switched out (presumably with a zero page) while being read.
>>
>> Other processes are totally irrelevant, unless they share the same
>> struct mm.  (This is why the vvar page can't be in the fixmap for this
>> to work.)
>>
>
> I meant "threads" not "processes"...

Still okay.  The vclock_gettime code does, more or less:

        do {
                seq = raw_read_seqcount_begin(&gtod->seq);
                mode = gtod->clock.vclock_mode;
                read the time;
        } while (unlikely(read_seqcount_retry(&gtod->seq, seq)));

Switching the clocksource in current code will make seq odd, then
change vclock_mode, then make seq even again.  The prctl would zap the
mapping, flush the TLB, and then map something else (with a different
seq and vclock_mode) there.  User code will be hard pressed to tell
the difference.

To avoid having to carve out a special seq value, I'd actually propose
just leaving seq odd for the TSC off case -- I think that the
vclock_gettime code could move the branch for mode == NONE inside the
loop with no loss in performance.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/