linux-kernel - Re: [tip:x86/mpx] x86/insn-eval: Add utility function to get segment descriptor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171205183845.GO3165@worktop.lehotels.local>
Date:   Tue, 5 Dec 2017 19:38:45 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Borislav Petkov <bp@...e.de>
Cc:     Thomas Gleixner <tglx@...utronix.de>, qiaowei.ren@...el.com,
        luto@...nel.org, adam.buchbinder@...il.com, mst@...hat.com,
        mhiramat@...nel.org, dave.hansen@...ux.intel.com, mingo@...nel.org,
        linux-kernel@...r.kernel.org, colin.king@...onical.com,
        jslaby@...e.cz, pbonzini@...hat.com, cmetcalf@...lanox.com,
        akpm@...ux-foundation.org, vbabka@...e.cz, acme@...hat.com,
        brgerst@...il.com, shuah@...nel.org, paul.gortmaker@...driver.com,
        lstoakes@...il.com, hpa@...or.com, thgarnie@...gle.com,
        keescook@...omium.org, adrian.hunter@...el.com,
        ricardo.neri-calderon@...ux.intel.com, ray.huang@....com,
        dvyukov@...gle.com, ravi.v.shankar@...el.com, slaoub@...il.com,
        corbet@....net, linux-tip-commits@...r.kernel.org
Subject: Re: [tip:x86/mpx] x86/insn-eval: Add utility function to get segment
 descriptor

On Tue, Dec 05, 2017 at 07:14:56PM +0100, Borislav Petkov wrote:
> On Tue, Dec 05, 2017 at 06:48:44PM +0100, Peter Zijlstra wrote:
> > This is broken right? You unlock and then return @desc, which afaict can
> > at that point get freed by free_ldt_struct().
> > 
> > Something like the below ought to cure; although its not entirely
> > pretty either.
> 
> Right.
> 
> Or, instead of introducing all the locking, we could also not do
> anything because all that code runs inside fixup_umip_exception() so the
> desc will be valid there.

Sorry what? So either this code is broken because it has IRQs enabled,
or its broken because its trying to acquire a mutex with IRQs disabled.
Which is it?