linux-kernel - TIF_SINGLESTEP bug?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrXbF6SeEMm5wmRFAExXSSi40h0SXgS73cWydWmhWzqRNA@mail.gmail.com>
Date:	Fri, 10 Apr 2015 14:30:28 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Oleg Nesterov <oleg@...hat.com>, X86 ML <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Borislav Petkov <bp@...en8.de>,
	Denys Vlasenko <dvlasenk@...hat.com>
Subject: TIF_SINGLESTEP bug?

Hi all-

AFAICS there are several things wrong with our magical do_debug
handling of single-stepping through the kernel.  They boil down to two
issues:

1. do_debug seems to be overly permissive in terms of what faults in
kernel space it thinks are okay.  This isn't obviously a problem
except that it obfuscates what's going on.  AFAICT the *only*
acceptable case is TF set on sysenter.  All the mentions of syscalls
are garbage -- both int80 and syscall clear TF.

2.  I think this is wrong:

                set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
                regs->flags &= ~X86_EFLAGS_TF;

TIF_SINGLESTEP doesn't mean "set TF in this sysenter's saved flags and
then clear TIF_SINGLESTEP".  It means something complicated.

The upshot AFAICT is that the attached program blows up if you build
it with -m32 and run it on an Intel machine.

Help?  The best option I see is to add a new ti flag that tells the
syscall entry hook to clear that flag and set TF in regs->flags.  But
I don't understand ptrace or kgdb very well.

--Andy

-- 
Andy Lutomirski
AMA Capital Management, LLC

View attachment "single_step_syscall.c" of type "text/x-csrc" (2960 bytes)