linux-kernel - Re: [PATCH] s390: fix normalization bug in exception table sorting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKv+Gu906bHv90mKjBu0dof+-JyRQeA_yPqx123C6CEGw9qLtg@mail.gmail.com>
Date:	Mon, 4 Jan 2016 10:44:01 +0100
From:	Ard Biesheuvel <ard.biesheuvel@...aro.org>
To:	Heiko Carstens <heiko.carstens@...ibm.com>
Cc:	schwidefsky@...ibm.com, linux-s390@...r.kernel.org,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] s390: fix normalization bug in exception table sorting

On 4 January 2016 at 10:42, Heiko Carstens <heiko.carstens@...ibm.com> wrote:
> On Fri, Jan 01, 2016 at 01:39:22PM +0100, Ard Biesheuvel wrote:
>> The normalization pass in the sorting routine of the relative exception
>> table serves two purposes:
>> - it ensures that the address fields of the exception table entries are
>>   fully ordered, so that no ambiguities arise between entries with
>>   identical instruction offsets (i.e., when two instructions that are
>>   exactly 8 bytes apart each have an exception table entry associated with
>>   them)
>> - it ensures that the offsets of both the instruction and the fixup fields
>>   of each entry are relative to their final location after sorting.
>>
>> Commit eb608fb366de ("s390/exceptions: switch to relative exception table
>> entries") ported the relative exception table format from x86, but modified
>> the sorting routine to only normalize the instruction offset field and not
>> the fixup offset field. The result is that the fixup offset of each entry
>> will be relative to the original location of the entry before sorting,
>> likely leading to crashes when those entries are dereferenced.
>
> Applied, thanks a lot!
>
> I was wondering why this never was observed on s390 during the last three
> years.
>
> The kernel text extable entries will be sorted during build time and I
> verified that for the majority of modules the extable entries are already
> sorted. And even if they are not sorted there isn't any major shuffling.
> So it looks like we were simply lucky...
>

Indeed. I guess most modules only have a single .text section so the
entries are emitted in order.

-- 
Ard.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/