lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 10 Mar 2014 11:10:57 -0700
From:	Andy Lutomirski <>
To:	"H. Peter Anvin" <>
Cc:	Linus Torvalds <>,
	Linux Kernel Mailing List <>,
	Stefani Seibold <>,
	Andreas Brief <>,
	Martin Runge <>
Subject: Re: [x86, vdso] BUG: unable to handle kernel paging request at d34bd000

On Mon, Mar 10, 2014 at 10:58 AM, H. Peter Anvin <> wrote:
> On 03/10/2014 10:52 AM, Andy Lutomirski wrote:
>>> Hint: where is your RIP?  Where is the RIP of other processes?
>> Whoa there, I'm not suggesting anything nearly that crazy :)
>> I'm suggesting changing out the vvar page *for that process*, which is
>> not executable.  The actual vdso code already supports this -- from
>> userspace's point of view it's the same thing as 'echo acpi_pm >
>> /sys/devices/system/clocksource/clocksource0/current_clocksource',
>> except that if the actual clocksource is HPET, the hpet page will be
>> switched out (presumably with a zero page) while being read.
>> Other processes are totally irrelevant, unless they share the same
>> struct mm.  (This is why the vvar page can't be in the fixmap for this
>> to work.)
> I meant "threads" not "processes"...

Still okay.  The vclock_gettime code does, more or less:

        do {
                seq = raw_read_seqcount_begin(&gtod->seq);
                mode = gtod->clock.vclock_mode;
                read the time;
        } while (unlikely(read_seqcount_retry(&gtod->seq, seq)));

Switching the clocksource in current code will make seq odd, then
change vclock_mode, then make seq even again.  The prctl would zap the
mapping, flush the TLB, and then map something else (with a different
seq and vclock_mode) there.  User code will be hard pressed to tell
the difference.

To avoid having to carve out a special seq value, I'd actually propose
just leaving seq odd for the TSC off case -- I think that the
vclock_gettime code could move the branch for mode == NONE inside the
loop with no loss in performance.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists