linux-kernel - Re: [PATCH 3/9] x86/asm/entry/64: do not SAVE_EXTRA_REGS in stub

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <551D5E23.2050002@redhat.com>
Date:	Thu, 02 Apr 2015 17:20:03 +0200
From:	Denys Vlasenko <dvlasenk@...hat.com>
To:	Brian Gerst <brgerst@...il.com>
CC:	Ingo Molnar <mingo@...nel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Borislav Petkov <bp@...en8.de>,
	"H. Peter Anvin" <hpa@...or.com>,
	Andy Lutomirski <luto@...capital.net>,
	Oleg Nesterov <oleg@...hat.com>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Alexei Starovoitov <ast@...mgrid.com>,
	Will Drewry <wad@...omium.org>,
	Kees Cook <keescook@...omium.org>,
	the arch/x86 maintainers <x86@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 3/9] x86/asm/entry/64: do not SAVE_EXTRA_REGS in stub_sigreturn

On 04/02/2015 05:01 PM, Brian Gerst wrote:
> On Thu, Apr 2, 2015 at 10:36 AM, Denys Vlasenko <dvlasenk@...hat.com> wrote:
>> stub_sigreturn ignores old values of pt_regs->REG for all general-purpose
>> registers, it sets them to values saved on userspace
>> signal stack.
>>
>> Which is hardly surprising - it would be a bug if it would use pt_regs->REG.
>> sigreturn must restore all registers.
>>
>> Therefore, SAVE_EXTRA_REGS in it ought to be redundant.
>>
>> It is a leftover from the time SAVE_EXTRA_REGS wasn't only saving registers,
>> but it also was extending stack to "full" pt_regs.
>>
>> Delete this SAVE_EXTRA_REGS.
>>
>> Run-tested.
>>
>> Signed-off-by: Denys Vlasenko <dvlasenk@...hat.com>
>> CC: Linus Torvalds <torvalds@...ux-foundation.org>
>> CC: Steven Rostedt <rostedt@...dmis.org>
>> CC: Ingo Molnar <mingo@...nel.org>
>> CC: Borislav Petkov <bp@...en8.de>
>> CC: "H. Peter Anvin" <hpa@...or.com>
>> CC: Andy Lutomirski <luto@...capital.net>
>> CC: Oleg Nesterov <oleg@...hat.com>
>> CC: Frederic Weisbecker <fweisbec@...il.com>
>> CC: Alexei Starovoitov <ast@...mgrid.com>
>> CC: Will Drewry <wad@...omium.org>
>> CC: Kees Cook <keescook@...omium.org>
>> CC: x86@...nel.org
>> CC: linux-kernel@...r.kernel.org
>> ---
>>  arch/x86/kernel/entry_64.S | 9 +++++++--
>>  1 file changed, 7 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
>> index ec51598..1cf245d 100644
>> --- a/arch/x86/kernel/entry_64.S
>> +++ b/arch/x86/kernel/entry_64.S
>> @@ -447,7 +447,12 @@ ENTRY(stub_rt_sigreturn)
>>         CFI_STARTPROC
>>         addq $8, %rsp
>>         DEFAULT_FRAME 0
>> -       SAVE_EXTRA_REGS
>> +       /*
>> +        * Despite RESTORE_EXTRA_REGS in return_from_stub,
>> +        * no need to SAVE_EXTRA_REGS here:
>> +        * sys_rt_sigreturn overwrites all general purpose pt_regs->REGs
>> +        * on stack, for RESTORE_{EXTRA,C}_REGS to pick them up.
>> +        */
>>         call sys_rt_sigreturn
>>         jmp  return_from_stub
>>         CFI_ENDPROC
>> @@ -458,7 +463,7 @@ ENTRY(stub_x32_rt_sigreturn)
>>         CFI_STARTPROC
>>         addq $8, %rsp
>>         DEFAULT_FRAME 0
>> -       SAVE_EXTRA_REGS
>> +       /* No need to SAVE_EXTRA_REGS */
>>         call sys32_x32_rt_sigreturn
>>         jmp  return_from_stub
>>         CFI_ENDPROC
> 
> I had the same idea, but determined sigreturn can fault and return an
> error code without modifying all the registers.  This would leak junk
> from the stack.

This still can be made to work by not RESTORE'ing EXTRA_REGS either,
if there is a way to detect the failure:

	call sys_rt_sigreturn
-	jmp  return_from_stub
+	testl ???????????
+	jz   return_from_stub
+	ret
	CFI_ENDPROC

But this is not a normal syscall, off-hand I don't see an easy way
to do the test. sys_rt_sigreturn() on failure runs this code:

...
 segfault:
        force_sig(SIGSEGV, current);
        return 0;
}

Help?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/