linux-kernel - Re: [PATCH] futex: use fault

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 8 Dec 2017 20:42:28 +0800
From:   "chengjian (D)" <cj.chengjian@...wei.com>
To:     Peter Zijlstra <peterz@...radead.org>
CC:     <tglx@...utronix.de>, <mingo@...hat.com>, <dvhart@...radead.org>,
        <linux-kernel@...r.kernel.org>, <xiexiuqi@...wei.com>,
        <huawei.libin@...wei.com>, <dvhart@...radead.org>
Subject: Re: [PATCH] futex: use fault_in to avoid infinite loop



On 2017/12/7 5:40, Peter Zijlstra wrote:
> @@ -3262,6 +3262,8 @@ static int futex_wait_requeue_pi(u32 __user 
> *uaddr, unsigned int flags,
>   SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
>   		size_t, len)
>   {
> +	unsigned long address = (unsigned long)head;
> +
>   	if (!futex_cmpxchg_enabled)
>   		return -ENOSYS;
>   	/*
> @@ -3270,6 +3272,9 @@ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
>   	if (unlikely(len != sizeof(*head)))
>   		return -EINVAL;
>   
> +	if (unlikely(address % __alignof__(*head)))
> +		return -EMORON;
> +

Yeah, This looks nicer. It solved the problem fundamentally
Also for other architecture, such as arm32 which will also
cause a crash without this PATCH.
If we incoming a misaligned address from user space,
the system call will return directly  with a new errno(EMORON).


BUT

	int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi)
	{
	retry:
		//......

		/* return -EFAULT */
         	if (cmpxchg_futex_value_locked (& nval, uaddr, uval, mval)) {
			/* always return 0 */
			if (fault_in_user_writeable(uaddr))
				return -1;	/* never here */
		goto retry; /* then goto retry */

		//......
	}

Does it correct here?
if we get other exception here next time, does kernel push himself into 
a new  infinite loop ?


Thanks.

CHENG Jian