linux-kernel - Re: [PATCH] x86/ptrace: Remove questionable TS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 19 Jun 2016 23:12:56 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Oleg Nesterov <oleg@...hat.com>
Cc:	Andy Lutomirski <luto@...nel.org>, X86 ML <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Kees Cook <keescook@...omium.org>,
	Borislav Petkov <bp@...en8.de>
Subject: Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace

On Sun, Jun 19, 2016 at 2:19 PM, Oleg Nesterov <oleg@...hat.com> wrote:
> Let me first thank Pedro who has already replied!
>
> And I have to admit I will need to re-read his explanations after
> sleep to (try to) convince myself I fully understans the problems ;)
> Too late for me.
>
> Right now I have nothing to add, but
>
> On 06/18, Andy Lutomirski wrote:
>>
>> @@ -922,16 +922,7 @@ static int putreg32(struct task_struct *child, unsigned regno, u32 value)
>>       R32(esp, sp);
>>
>>       case offsetof(struct user32, regs.orig_eax):
>> -             /*
>> -              * A 32-bit debugger setting orig_eax means to restore
>> -              * the state of the task restarting a 32-bit syscall.
>> -              * Make sure we interpret the -ERESTART* codes correctly
>> -              * in case the task is not actually still sitting at the
>> -              * exit from a 32-bit syscall with TS_COMPAT still set.
>> -              */
>>               regs->orig_ax = value;
>> -             if (syscall_get_nr(child, regs) >= 0)
>> -                     task_thread_info(child)->status |= TS_COMPAT;
>
> I agree it would be nice to remove this code, but then it is not clear
> how/when we should sign-extend regs->ax..
>
> And this leads to another question, why do we actually need to set/clear
> TS_COMPAT in set_personality_ia32() ??

Something's clearly buggy there, considering that
set_personality_64bit() does *not* clear it.

--Andy