linux-kernel - Re: [PATCH] x86/mpx: Correctly report do_mpx_bt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170420120801.GH5077@suse.de>
Date:   Thu, 20 Apr 2017 14:08:01 +0200
From:   Joerg Roedel <jroedel@...e.de>
To:     Dave Hansen <dave.hansen@...ux.intel.com>
Cc:     Joerg Roedel <joro@...tes.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] x86/mpx: Correctly report do_mpx_bt_fault() failures to
 user-space

Hi Dave,

On Mon, Apr 17, 2017 at 08:38:03AM -0700, Dave Hansen wrote:
> Just to be clear, the thing you're calling "correct" is this do_trap(),
> right?
> 
>         do_trap(X86_TRAP_BR, SIGSEGV, "bounds", regs, error_code, NULL);

Yes, because it signals the right trap_nr and error_code to user-space.

> do_mpx_bt_fault() can fail for a bunch of reasons:
>  * unexpected or invalid value in BNDCSR
>  * out of memory (physical or virtual)
>  * unresolvable fault walking/filling bounds tables
>  * !valid and non-empty bad entry in the bounds tables
> 
> This will end up sending a signal that *looks* like a X86_TRAP_BR for
> all of those, including those that are not really bounds-related, like
> unresolvable faults.  We also don't populate enough information in the
> siginfo that gets delivered for userspace to resolve the fault.
> 
> I'm not sure this patch is the right thing.

The problem is, without this patch the trap_nr reported to user-space is
0, which maps to divide-by-zero. I think this is wrong, and since all
failure cases from do_mpx_bt_fault() can only happen in the #BR
exception handler, I think that reporting X86_TRAP_BR for all failure
cases is the right thing to do.

I don't know whether user-space (with this patch) already gets enough
information from do_trap() to handle all of the above cases, but it is a
step in the right direction.


	Joerg