| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAG48ez03ujGFDOFCsiWFYk2caGvg0ak3GpTHKLKS7-dahC_F5Q@mail.gmail.com>
Date: Thu, 6 Sep 2018 13:10:27 +0200
From: Jann Horn <jannh@...gle.com>
To: Andy Lutomirski <luto@...nel.org>, Ingo Molnar <mingo@...hat.com>
Cc: Thomas Gleixner <tglx@...utronix.de>,
"H . Peter Anvin" <hpa@...or.com>,
"the arch/x86 maintainers" <x86@...nel.org>, bpetkov@...e.de,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
kernel list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] x86/process: don't mix user/kernel regs in 64bit __show_regs
On Fri, Aug 31, 2018 at 10:12 PM Andy Lutomirski <luto@...nel.org> wrote:
>
> On Fri, Aug 31, 2018 at 12:41 PM, Jann Horn <jannh@...gle.com> wrote:
> > When the kernel.print-fatal-signals sysctl has been enabled (I don't know
> > whether anyone actually enables it), a simple userspace crash will cause
> > the kernel to write a crash dump that contains, among other things, the
> > kernel gsbase into dmesg.
> >
> > As suggested by Andy, limit output to pt_regs, FS_BASE and KERNEL_GS_BASE
> > in this case.
> >
> > This also moves the bitness-specific logic from show_regs() into
> > process_{32,64}.c.
> >
> > Signed-off-by: Jann Horn <jannh@...gle.com>
> > Fixes: 45807a1df9f5 ("vdso: print fatal signals")
> > ---
> > @Andy: Does this look like what you had in mind?
>
> Yes.
>
> Although there's another option: remove print-fatal-signals.
Who wants to decide? Ingo, it's your feature - what do you think?
> > Does this need a CC stable tag? I haven't put one on it for now.
>
> Probably.
>
> >
> > arch/x86/include/asm/kdebug.h | 12 +++++++++++-
> > arch/x86/kernel/dumpstack.c | 11 +++--------
> > arch/x86/kernel/process_32.c | 4 ++--
> > arch/x86/kernel/process_64.c | 12 ++++++++++--
> > 4 files changed, 26 insertions(+), 13 deletions(-)
> >
> > diff --git a/arch/x86/include/asm/kdebug.h b/arch/x86/include/asm/kdebug.h
> > index 395c9631e000..75f1e35e7c15 100644
> > --- a/arch/x86/include/asm/kdebug.h
> > +++ b/arch/x86/include/asm/kdebug.h
> > @@ -22,10 +22,20 @@ enum die_val {
> > DIE_NMIUNKNOWN,
> > };
> >
> > +enum show_regs_mode {
> > + SHOW_REGS_SHORT,
> > + /*
> > + * For when userspace crashed, but we don't think it's our fault, and
> > + * therefore don't print kernel registers.
> > + */
> > + SHOW_REGS_USER,
> > + SHOW_REGS_ALL
> > +};
> > +
> > extern void die(const char *, struct pt_regs *,long);
> > extern int __must_check __die(const char *, struct pt_regs *, long);
> > extern void show_stack_regs(struct pt_regs *regs);
> > -extern void __show_regs(struct pt_regs *regs, int all);
> > +extern void __show_regs(struct pt_regs *regs, enum show_regs_mode);
> > extern void show_iret_regs(struct pt_regs *regs);
> > extern unsigned long oops_begin(void);
> > extern void oops_end(unsigned long, struct pt_regs *, int signr);
> > diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
> > index 9c8652974f8e..574fe5d97ba2 100644
> > --- a/arch/x86/kernel/dumpstack.c
> > +++ b/arch/x86/kernel/dumpstack.c
> > @@ -135,7 +135,7 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
> > * they can be printed in the right context.
> > */
> > if (!partial && on_stack(info, regs, sizeof(*regs))) {
> > - __show_regs(regs, 0);
> > + __show_regs(regs, SHOW_REGS_SHORT);
> >
> > } else if (partial && on_stack(info, (void *)regs + IRET_FRAME_OFFSET,
> > IRET_FRAME_SIZE)) {
> > @@ -333,7 +333,7 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
> > oops_exit();
> >
> > /* Executive summary in case the oops scrolled away */
> > - __show_regs(&exec_summary_regs, true);
> > + __show_regs(&exec_summary_regs, SHOW_REGS_ALL);
> >
> > if (!signr)
> > return;
> > @@ -393,14 +393,9 @@ void die(const char *str, struct pt_regs *regs, long err)
> >
> > void show_regs(struct pt_regs *regs)
> > {
> > - bool all = true;
> > -
> > show_regs_print_info(KERN_DEFAULT);
> >
> > - if (IS_ENABLED(CONFIG_X86_32))
> > - all = !user_mode(regs);
> > -
> > - __show_regs(regs, all);
> > + __show_regs(regs, user_mode(regs) ? SHOW_REGS_USER : SHOW_REGS_ALL);
> >
> > /*
> > * When in-kernel, we also print out the stack at the time of the fault..
> > diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
> > index 2924fd447e61..5046a3c9dec2 100644
> > --- a/arch/x86/kernel/process_32.c
> > +++ b/arch/x86/kernel/process_32.c
> > @@ -59,7 +59,7 @@
> > #include <asm/intel_rdt_sched.h>
> > #include <asm/proto.h>
> >
> > -void __show_regs(struct pt_regs *regs, int all)
> > +void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
> > {
> > unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L;
> > unsigned long d0, d1, d2, d3, d6, d7;
> > @@ -85,7 +85,7 @@ void __show_regs(struct pt_regs *regs, int all)
> > printk(KERN_DEFAULT "DS: %04x ES: %04x FS: %04x GS: %04x SS: %04x EFLAGS: %08lx\n",
> > (u16)regs->ds, (u16)regs->es, (u16)regs->fs, gs, ss, regs->flags);
> >
> > - if (!all)
> > + if (mode != SHOW_REGS_ALL)
> > return;
> >
> > cr0 = read_cr0();
> > diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
> > index a451bc374b9b..ea5ea850348d 100644
> > --- a/arch/x86/kernel/process_64.c
> > +++ b/arch/x86/kernel/process_64.c
> > @@ -62,7 +62,7 @@
> > __visible DEFINE_PER_CPU(unsigned long, rsp_scratch);
> >
> > /* Prints also some state that isn't saved in the pt_regs */
> > -void __show_regs(struct pt_regs *regs, int all)
> > +void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
> > {
> > unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L, fs, gs, shadowgs;
> > unsigned long d0, d1, d2, d3, d6, d7;
> > @@ -87,9 +87,17 @@ void __show_regs(struct pt_regs *regs, int all)
> > printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n",
> > regs->r13, regs->r14, regs->r15);
> >
> > - if (!all)
> > + if (mode == SHOW_REGS_SHORT)
> > return;
> >
> > + if (mode == SHOW_REGS_USER) {
> > + rdmsrl(MSR_FS_BASE, fs);
> > + rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
> > + printk(KERN_DEFAULT "FS: %016lx GS: %016lx\n",
> > + fs, shadowgs);
> > + return;
> > + }
> > +
> > asm("movl %%ds,%0" : "=r" (ds));
> > asm("movl %%cs,%0" : "=r" (cs));
> > asm("movl %%es,%0" : "=r" (es));
> > --
> > 2.19.0.rc1.350.ge57e33dbd1-goog
> >
Powered by blists - more mailing lists