linux-kernel - Re: [PATCH v3 2/3] x86: SROP mitigation: implement signal cookies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160308210333.7ad77a29@lxorguk.ukuu.org.uk>
Date:	Tue, 8 Mar 2016 21:03:33 +0000
From:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:	Scott Bauer <sbauer@....utah.edu>
Cc:	linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com,
	x86@...nel.org, wmealing@...hat.com, ak@...ux.intel.com,
	luto@...capital.net, Abhiram Balasubramanian <abhiram@...utah.edu>
Subject: Re: [PATCH v3 2/3] x86: SROP mitigation: implement signal cookies

>  static int ia32_restore_sigcontext(struct pt_regs *regs,
> -				   struct sigcontext_32 __user *sc)
> +				   struct sigcontext_32 __user *sc,
> +				   void __user **user_cookie)
>  {
>  	unsigned int tmpflags, err = 0;
>  	void __user *buf;
> @@ -105,6 +106,16 @@ static int ia32_restore_sigcontext(struct pt_regs *regs,
>  		buf = compat_ptr(tmp);
>  	} get_user_catch(err);
>  
> +	/*
> +	 * If there is fp state get cookie from the top of the fp state,
> +	 * else get it from the top of the sig frame.
> +	 */
> +
> +	if (tmp != 0)
> +		*user_cookie = compat_ptr(tmp + fpu__getsize(1));
> +	else
> +		*user_cookie = NULL;

user_cookie is is __user, so shouldn't just be poking at it without
get/put_user ? It might fault if someone has engineered a bad stack frame.

Alan