linux-kernel - Re: [PATCH v3 09/51] x86/dumpstack: fix x86_32 kernel_stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 14 Aug 2016 00:26:29 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Josh Poimboeuf <jpoimboe@...hat.com>
Cc:	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...nel.org>,
	"H . Peter Anvin" <hpa@...or.com>, X86 ML <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Brian Gerst <brgerst@...il.com>,
	Kees Cook <keescook@...omium.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Byungchul Park <byungchul.park@....com>,
	Nilay Vaish <nilayvaish@...il.com>
Subject: Re: [PATCH v3 09/51] x86/dumpstack: fix x86_32 kernel_stack_pointer()
 previous stack access

On Fri, Aug 12, 2016 at 7:28 AM, Josh Poimboeuf <jpoimboe@...hat.com> wrote:
> On x86_32, when an interrupt happens from kernel space, SS and SP aren't
> pushed and the existing stack is used.  So pt_regs is effectively two
> words shorter, and the previous stack pointer is normally the memory
> after the shortened pt_regs, aka '&regs->sp'.
>
> But in the rare case where the interrupt hits right after the stack
> pointer has been changed to point to an empty stack, like for example
> when call_on_stack() is used, the address immediately after the
> shortened pt_regs is no longer on the stack.  In that case, instead of
> '&regs->sp', the previous stack pointer should be retrieved from the
> beginning of the current stack page.
>
> kernel_stack_pointer() wants to do that, but it forgets to dereference
> the pointer.  So instead of returning a pointer to the previous stack,
> it returns a pointer to the beginning of the current stack.
>
> Fixes: 0788aa6a23cb ("x86: Prepare removal of previous_esp from i386 thread_info structure")
> Signed-off-by: Josh Poimboeuf <jpoimboe@...hat.com>

This seems like a valid fix, but I'm not sure I agree with the intent
of the code.  &regs->sp really is the previous stack pointer in the
sense that the stack pointer was &regs->sp when the entry happened.
>From an unwinder's perspective, how is:

movl [whatever], $esp
<-- interrupt

any different from:

movl [whatever], $esp
pushl [something]
<-- interrupt

Also, does x86_32 do this type of stack switching at all?  AFAICS
32-bit kernels don't use IRQ stacks in the first place.  Do they?  Am
I just missing the code that does it?

--Andy