linux-kernel - Re: [PATCH 08/11] signal/arm: Document conflicts with SI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180116174120.GB22781@e103592.cambridge.arm.com>
Date:   Tue, 16 Jan 2018 17:41:21 +0000
From:   Dave Martin <Dave.Martin@....com>
To:     Russell King - ARM Linux <linux@...linux.org.uk>
Cc:     "Eric W. Biederman" <ebiederm@...ssion.com>,
        linux-arch@...r.kernel.org, Al Viro <viro@...iv.linux.org.uk>,
        linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        Oleg Nesterov <oleg@...hat.com>
Subject: Re: [PATCH 08/11] signal/arm: Document conflicts with SI_USER and
 SIGFPE

On Mon, Jan 15, 2018 at 05:49:47PM +0000, Russell King - ARM Linux wrote:
> On Thu, Jan 11, 2018 at 06:59:37PM -0600, Eric W. Biederman wrote:
> > Setting si_code to 0 results in a userspace seeing an si_code of 0.
> > This is the same si_code as SI_USER.  Posix and common sense requires
> > that SI_USER not be a signal specific si_code.  As such this use of 0
> > for the si_code is a pretty horribly broken ABI.
> > 
> > Further use of si_code == 0 guaranteed that copy_siginfo_to_user saw a
> > value of __SI_KILL and now sees a value of SIL_KILL with the result
> > that uid and pid fields are copied and which might copying the si_addr
> > field by accident but certainly not by design.  Making this a very
> > flakey implementation.
> > 
> > Utilizing FPE_FIXME, siginfo_layout will now return SIL_FAULT and the
> > appropriate fields will be reliably copied.
> 
> So what do you suggest when none of the SIGFPE FPE_xxx codes match the
> condition that "we don't know what happened" ?  Raise a SIGKILL instead
> maybe?  We will have dumped the VFP state into the kernel log at this
> point, things are pretty much fscked.
> 
> It's probably an impossible condition unless the hardware has failed,
> no one has knowingly reported getting such a dump in their kernel log,
> so it's something that could very likely be changed in some way
> without anyone noticing.

arm64 can optionally not tell you exactly what exception(s) happened for 
vector operations.  This may also be true for 32-bit.

Unfortunately, there's nothing sensible to report in this case, and
there is no such constant as FPE_UNKNOWN.

Currently arm64 sets si_code to 0, which doesn't match any FPE_*
constant (but unfortunately matches SI_USER) -- defining a new, distinct
FPE_UNKNOWN is probably no worse than that. 

I'm not sure yet whether a similar argument applies for 32-bit.

Cheers
---Dave