linux-kernel - Re: [PATCH 1/1] get_nr_restart_syscall() should return __NR_ia32_restart_syscall if __USER32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170329150535.GA22925@redhat.com>
Date:   Wed, 29 Mar 2017 17:05:35 +0200
From:   Oleg Nesterov <oleg@...hat.com>
To:     Andy Lutomirski <luto@...nel.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Denys Vlasenko <dvlasenk@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...hat.com>,
        Jan Kratochvil <jan.kratochvil@...hat.com>,
        Pedro Alves <palves@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>, X86 ML <x86@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/1] get_nr_restart_syscall() should return
 __NR_ia32_restart_syscall if __USER32_CS

On 03/28, Oleg Nesterov wrote:
>
> On 03/28, Andy Lutomirski wrote:
> >
> > How about we store the syscall arch to be restored in task_struct
> > along with restart_block?
>
> Yes, perhaps we will have to finally do this. Not really nice too.

OK, how about the hack below?

I do not want to a new member into task_struct/restart_block, so the
patch below adds a sticky TS_COMPAT bit which logically is a member
of "struct restart_block".

TS_I386_REGS_POKED must die, I think. But this needs another discussion.

Oleg.


diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index b83c61c..a94bb5e 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -249,6 +249,17 @@ __visible inline void syscall_return_slowpath(struct pt_regs *regs)
 		local_irq_enable();
 
 	/*
+	 * Do this before debugger can change the regs.
+	 */
+	if (IS_ENABLED(CONFIG_IA32_EMULATION) &&
+	    unlikely(regs->ax == -ERESTART_RESTARTBLOCK)) {
+		if (current->thread.status & TS_COMPAT)
+			current->thread.status |= TS_COMPAT_XXX;
+		else
+			current->thread.status &= ~TS_COMPAT_XXX;
+	}
+
+	/*
 	 * First do one-time work.  If these work items are enabled, we
 	 * want to run them exactly once per syscall exit with IRQs on.
 	 */
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 1be64da..87179ab 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -477,6 +477,7 @@ struct thread_struct {
  * have to worry about atomic accesses.
  */
 #define TS_COMPAT		0x0002	/* 32bit syscall active (64BIT)*/
+#define TS_COMPAT_XXX		0x0008
 
 /*
  * Set IOPL bits in EFLAGS from given mask
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 763af1d..b3b98ff 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -785,7 +785,7 @@ static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs)
 	 * than the tracee.
 	 */
 #ifdef CONFIG_IA32_EMULATION
-	if (current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED))
+	if (current->thread.status & TS_COMPAT_XXX)
 		return __NR_ia32_restart_syscall;
 #endif
 #ifdef CONFIG_X86_X32_ABI