linux-kernel - Re: get_arg_page() && ptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 12 Sep 2018 13:42:08 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Oleg Nesterov <oleg@...hat.com>
Cc:     Rik van Riel <riel@...hat.com>, Michal Hocko <mhocko@...e.com>,
        Stanislav Kozina <skozina@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: get_arg_page() && ptr_size accounting

On Wed, Sep 12, 2018 at 5:27 AM, Oleg Nesterov <oleg@...hat.com> wrote:
> On 09/11, Kees Cook wrote:
>>
>> Oh, I like this patch! This is much cleaner.
>
> it's pity. cause this means I will have to actually test this change and
> (worse) write the changelog ;)

Hehe. I know this pain well! :)

>> > @@ -410,11 +365,6 @@ static int bprm_mm_init(struct linux_binprm *bprm)
>> >         if (!mm)
>> >                 goto err;
>> >
>> > -       /* Save current stack limit for all calculations made during exec. */
>> > -       task_lock(current->group_leader);
>> > -       bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK];
>> > -       task_unlock(current->group_leader);
>> > -
>>
>> I would prefer this hunk stay here since it will be more robust
>> against weird arch-specific things happening against rlim_stack. I had
>> to clean up some of these tests in arch code, so I'm nervous about
>> moving this further away. Here is before we call arch_bprm_mm_init(),
>> and I think it's better to do this as early as possible.
>
> Well, I don't reaally agree but I won't argue, this is cosmetic at least
> right now.

Probably what it deserves is a better comment to capture what I said
above. Maybe:

-    /* Save current stack limit for all calculations made during exec. */
+    /* Do this before any arch-specific calls, like arch_bprm_mm_init(),
+     * so that bprm->rlim_stack is available for the architecture to use
+     * in case it needs it earlier that mm layout time.
+     */

>> BTW, in re-reading create_elf_tables() and its calculation of "items",
>> I realize the above should actually include the trailing NULL pointers
>> and argc, so it should be:
>>
>> ptr_size = (1 + bprm->argc + 1 + bprm->envc + 1) * sizeof(void *);
>
> Yes, I noticed this too. But can we do this later please?

Sure!

>> > -       unsigned long p; /* current top of mem */
>> > +       unsigned long p, p_min; /* current top of mem */
>>
>> Can you split this out to a separate line (with a new comment) to
>> avoid comment-confusion? Something like:
>>
>> unsigned long p; /* current top of mem */
>> unsigned long p_min; /* the minimum allowed mem position */
>
> OK, but "minimum allowed mem position" explains nothing... The comment
> should explain that ->p_min (can you suggest a better name?) is artificial
> marker pre-computed for rlim-like checks in copy_strings()...

How about something like:

... p; /* top of memory array reserved for stack */
... p_min; /* bottom of stack as computed in prepare_arg_pages() */

(Is "p" really only used for stack reservation tracking?)

> BTW. I think we can simply kill count(). But this needs another cleanup
> and dicsussion.

Hm, I think we need count for doing the sanity checking and allowing
the cond_resched() calls.

-Kees

-- 
Kees Cook
Pixel Security