linux-kernel - Re: [PATCH v3 1/2] x86_64,signal: Fix SS handling for signals delivered to 64-bit programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150318183133.GB1832@redhat.com>
Date:	Wed, 18 Mar 2015 19:31:33 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Cyrill Gorcunov <gorcunov@...il.com>
Cc:	Andrey Wagin <avagin@...il.com>, Andy Lutomirski <luto@...nel.org>,
	Ingo Molnar <mingo@...nel.org>,
	Andi Kleen <andi@...stfloor.org>,
	"H. Peter Anvin" <hpa@...or.com>,
	Al Viro <viro@...iv.linux.org.uk>, X86 ML <x86@...nel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Borislav Petkov <bp@...en8.de>,
	Andy Lutomirski <luto@...capital.net>,
	Pavel Emelyanov <xemul@...nvz.org>
Subject: Re: [PATCH v3 1/2] x86_64,signal: Fix SS handling for signals
	delivered to 64-bit programs

On 03/18, Cyrill Gorcunov wrote:
>
> On Wed, Mar 18, 2015 at 06:48:43PM +0100, Oleg Nesterov wrote:
> >
> > Shot in a dark afer a quick grep: restore_gpregs() should initialize ->ss?
>
> It hasn't been needed earlier, if this would help it means abi is broken, no? :)
> Otherwise I don't understand what's happening.

until this commit the kernel simply forgot to restore ->ss in sigreturn().

after this commit, if your rt_sigframe has garbage in ->ss then SIGSEGV
is clear.

> > perhaps something like below... obviously uncompiled/untested.
> >
> > And my grep can't find the definition of UserX86RegsEntry in crtools...
> > Perhaps the change below needs CPREG1(ss, anothername).
> >
> > Seriously, where is UserX86RegsEntry?
>
> It's in protobif/core-x86.proto, welcome to protobuf hell.

Still can't find UserX86RegsEntry... OK, perhaps it comes from
user_x86_regs_entry in protobuf/core-x86.proto. Then I guess the patch I sent
can be compiled at least ;)

>
> >
> > Oleg.
> >
> >
> > --- a/arch/x86/crtools.c
> > +++ b/arch/x86/crtools.c
> > @@ -475,6 +475,7 @@ int restore_gpregs(struct rt_sigframe *f, UserX86RegsEntry *r)
> >  	CPREG2(rip, ip);
> >  	CPREG2(eflags, flags);
> >  	CPREG1(cs);
> > +	CPREG1(ss);
> >  	CPREG1(gs);
> >  	CPREG1(fs);
> >
> > diff --git a/arch/x86/include/asm/restorer.h b/arch/x86/include/asm/restorer.h
> > index 70199fb..c04fb94 100644
> > --- a/arch/x86/include/asm/restorer.h
> > +++ b/arch/x86/include/asm/restorer.h
> > @@ -53,7 +53,7 @@ struct rt_sigcontext {
> >  	unsigned short			cs;
> >  	unsigned short			gs;
> >  	unsigned short			fs;
> > -	unsigned short			__pad0;
> > +	unsigned short			ss;
> >  	unsigned long			err;
> >  	unsigned long			trapno;
> >  	unsigned long			oldmask;
> >
>
> 	Cyrill

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/