linux-kernel - Re: ptrace vs FSGSBASE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160502153508.GA7874@redhat.com>
Date:	Mon, 2 May 2016 17:35:08 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	X86 ML <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Roland McGrath <roland@...k.frob.com>,
	Andi Kleen <andi@...stfloor.org>,
	Borislav Petkov <bp@...en8.de>, Brian Gerst <brgerst@...il.com>
Subject: Re: ptrace vs FSGSBASE

On 05/02, Andy Lutomirski wrote:
>
> On Mon, May 2, 2016 at 7:27 AM, Oleg Nesterov <oleg@...hat.com> wrote:
> >>
> >> 1. I read fs_base using ptrace.  I think I should get the actual
> >> fs_base without any nonsense.
> >
> > Which fs_base? The member of user_regs_struct? But this structure/layout
> > is just the ABI, so to me it seems correct that getreg() tries to look
> > at ->fs and/or ->fsindex.
>
> Yeah, the member of user_regs_struct.

Still can't understand this... user_regs_struct is just the set of offsets
we use to "name" the registers for getreg/putreg. We simply do not have
"the actual fs_base" we could use in getreg(), we need to calculate it.

> > I can't understand what does "atomically" mean in this context.
>
> I mean "change fs and fs_base to these two values in a single syscall
> so that the kernel can do something intelligent."
>
> Let me give some background:
> [... snip ...]

Thanks Andy. I need to re-read your explanation, but it seems I am starting
to understand. And yes, I didn't bother to look at putreg() when I wrote
my reply.

> If you write, say, 0x2b to
> fs and 12345 to fs_base using the ptrace API, you'd end up with FS ==
> 0x2b and FSBASE == 0,

Hmm. I can be easily wrong again but afaics in this case do_arch_prctl()
will change fs/fs_base first and set

	fsindex = FS_TLS_SEL
	fs = 0

and then... and then I simply can't understand what set_segment_reg(fs)
will/should do in this case. Nor I can understand the "thread.fs != value"
check before do_arch_prctl(ARCH_SET_FS). Confused.

Oleg.