linux-kernel - Re: System call number masking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrWo2TFWR6gW3sw4LBYuNdeVeaw8V54DGDNde3we9mLv9A@mail.gmail.com>
Date:	Thu, 14 Apr 2016 10:48:31 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Ben Hutchings <ben@...adent.org.uk>
Cc:	Andy Lutomirski <luto@...nel.org>, X86 ML <x86@...nel.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: System call number masking

On Thu, Apr 14, 2016 at 10:22 AM, Ben Hutchings <ben@...adent.org.uk> wrote:
> I'm updating my x32-as-boot-time-option patch for 4.6, and I noticed a
> subtle change in system call number masking on x86_64 as a result of
> moving the slow path into C.
>
> Previously we would mask out the upper 32 bits before doing anything
> with the system call number, both on the slow and fast paths, if and
> only if x32 was enabled.

I always thought that the old behavior was nonsensical.  The behavior
should be the same regardless of config options.

>
> Now we always mask out the upper 32 bits on the slow path, so it's not
> quite consistent with the fast path if x32 is disabled.  A system call
> that would be rejected by the fast path can succeed on the slow path.
> I don't know whether this causes any problems, but it seems
> undesirable.
>
> But it's also undesirable that the behaviour of system call numbers not
> assigned to x32 also varies depending on whether x32 is enabled.
> Should we always mask out the upper 32 bits on the fast path?
>

I think we should.  Alternatively, the ja 1f that takes us back out if
the syscall nr is invalid could be changed to jump to the slow path,
thus avoiding an instruction in the fast path and keeping the code a
bit cleaner.

--Andy