linux-kernel - Re: [PATCH v8 13/28] x86/insn-eval: Add utility function to get segment descriptor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 27 Sep 2017 17:39:28 +0000
From:   "Neri, Ricardo" <ricardo.neri@...el.com>
To:     "bp@...e.de" <bp@...e.de>
CC:     "dvyukov@...gle.com" <dvyukov@...gle.com>,
        "mst@...hat.com" <mst@...hat.com>,
        "adam.buchbinder@...il.com" <adam.buchbinder@...il.com>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "keescook@...omium.org" <keescook@...omium.org>,
        "hpa@...or.com" <hpa@...or.com>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
        "slaoub@...il.com" <slaoub@...il.com>,
        "vbabka@...e.cz" <vbabka@...e.cz>,
        "Ren, Qiaowei" <qiaowei.ren@...el.com>,
        "mhiramat@...nel.org" <mhiramat@...nel.org>,
        "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "jslaby@...e.cz" <jslaby@...e.cz>,
        "thgarnie@...gle.com" <thgarnie@...gle.com>,
        "cmetcalf@...lanox.com" <cmetcalf@...lanox.com>,
        "lstoakes@...il.com" <lstoakes@...il.com>,
        "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "luto@...nel.org" <luto@...nel.org>,
        "Gortmaker, Paul (Wind River)" <paul.gortmaker@...driver.com>,
        "shuah@...nel.org" <shuah@...nel.org>,
        "acme@...hat.com" <acme@...hat.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "ray.huang@....com" <ray.huang@....com>,
        "x86@...nel.org" <x86@...nel.org>,
        "Hunter, Adrian" <adrian.hunter@...el.com>,
        "colin.king@...onical.com" <colin.king@...onical.com>,
        "brgerst@...il.com" <brgerst@...il.com>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "Shankar, Ravi V" <ravi.v.shankar@...el.com>,
        "corbet@....net" <corbet@....net>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v8 13/28] x86/insn-eval: Add utility function to get
 segment descriptor

On Tue, 2017-09-26 at 20:05 +0200, Borislav Petkov wrote:
> On Fri, Aug 18, 2017 at 05:27:54PM -0700, Ricardo Neri wrote:
> > 
> > The segment descriptor contains information that is relevant to how
> > linear
> > addresses need to be computed. It contains the default size of
> > addresses
> > as well as the base address of the segment. Thus, given a segment
> > selector, we ought look at segment descriptor to correctly
> > calculate the
> 		    ^
> 		    to

I will correct this syntax error.
> 
> > 
> > linear address.
> > 
> > In protected mode, the segment selector might indicate a segment
> > descriptor from either the global descriptor table or a local
> > descriptor
> > table. Both cases are considered in this function.
> > 
> > This function is a prerequisite for functions in subsequent commits
> > that
> > will obtain the aforementioned attributes of the segment
> > descriptor.
> > 
> > Cc: Dave Hansen <dave.hansen@...ux.intel.com>
> > Cc: Adam Buchbinder <adam.buchbinder@...il.com>
> > Cc: Colin Ian King <colin.king@...onical.com>
> > Cc: Lorenzo Stoakes <lstoakes@...il.com>
> > Cc: Qiaowei Ren <qiaowei.ren@...el.com>
> > Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
> > Cc: Masami Hiramatsu <mhiramat@...nel.org>
> > Cc: Adrian Hunter <adrian.hunter@...el.com>
> > Cc: Kees Cook <keescook@...omium.org>
> > Cc: Thomas Garnier <thgarnie@...gle.com>
> > Cc: Peter Zijlstra <peterz@...radead.org>
> > Cc: Borislav Petkov <bp@...e.de>
> > Cc: Dmitry Vyukov <dvyukov@...gle.com>
> > Cc: Ravi V. Shankar <ravi.v.shankar@...el.com>
> > Cc: x86@...nel.org
> > Signed-off-by: Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>
> > ---
> >  arch/x86/lib/insn-eval.c | 55
> > ++++++++++++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 55 insertions(+)
> > 
> > diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
> > index 86f58ce6c302..9cf2c49afc15 100644
> > --- a/arch/x86/lib/insn-eval.c
> > +++ b/arch/x86/lib/insn-eval.c
> > @@ -6,9 +6,13 @@
> >  #include <linux/kernel.h>
> >  #include <linux/string.h>
> >  #include <linux/ratelimit.h>
> > +#include <linux/mmu_context.h>
> > +#include <asm/desc_defs.h>
> > +#include <asm/desc.h>
> >  #include <asm/inat.h>
> >  #include <asm/insn.h>
> >  #include <asm/insn-eval.h>
> > +#include <asm/ldt.h>
> >  #include <asm/vm86.h>
> >  
> >  enum reg_type {
> > @@ -402,6 +406,57 @@ static int get_reg_offset(struct insn *insn,
> > struct pt_regs *regs,
> >  }
> >  
> >  /**
> > + * get_desc() - Obtain address of segment descriptor
> 		   Get segment descriptor.
> 
> > 
> > + * @sel:	Segment selector
> > + *
> > + * Given a segment selector, obtain a pointer to the segment
> > descriptor.
> > + * Both global and local descriptor tables are supported.
> > + *
> > + * Return: pointer to segment descriptor on success. NULL on
> > error.
> > + */
> > +static struct desc_struct *get_desc(unsigned short sel)
> I've simplified this function to be more readable, here's a diff
> ontop.
> 
> More specifically, if you flip the logic and move @desc inside the
> if,
> you don't need to have mutex_unlock() twice in there.
> 
> And having a local @ldt ptr makes the selector check more readable.
> 
> ---
> diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
> index 9cf2c49afc15..48af787cb160 100644
> --- a/arch/x86/lib/insn-eval.c
> +++ b/arch/x86/lib/insn-eval.c
> @@ -417,24 +417,24 @@ static int get_reg_offset(struct insn *insn,
> struct pt_regs *regs,
>  static struct desc_struct *get_desc(unsigned short sel)
>  {
>  	struct desc_ptr gdt_desc = {0, 0};
> -	struct desc_struct *desc = NULL;
>  	unsigned long desc_base;
>  
>  #ifdef CONFIG_MODIFY_LDT_SYSCALL
>  	if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
> +		struct desc_struct *desc = NULL;
> +		struct ldt_struct *ldt;
> +
>  		/* Bits [15:3] contain the index of the desired
> entry. */
>  		sel >>= 3;
>  
>  		mutex_lock(&current->active_mm->context.lock);
> -		/* The size of the LDT refers to the number of
> entries. */
> -		if (!current->active_mm->context.ldt ||
> -		    sel >= current->active_mm->context.ldt-
> >nr_entries) {
> -			mutex_unlock(&current->active_mm-
> >context.lock);
> -			return NULL;
> -		}
>  
> -		desc = &current->active_mm->context.ldt-
> >entries[sel];
> +		ldt = current->active_mm->context.ldt;
> +		if (ldt && sel < ldt->nr_entries)
> +			desc = &ldt->entries[sel];
> +
>  		mutex_unlock(&current->active_mm->context.lock);
> +
>  		return desc;
>  	}
>  #endif
> @@ -452,8 +452,7 @@ static struct desc_struct *get_desc(unsigned
> short sel)
>  	if (desc_base > gdt_desc.size)
>  		return NULL;
>  
> -	desc = (struct desc_struct *)(gdt_desc.address + desc_base);
> -	return desc;
> +	return (struct desc_struct *)(gdt_desc.address + desc_base);

I have incorporated these changes in my code.

Thanks and BR,
Ricardo