linux-kernel - Re: [PATCH v5 24/25] ptrace: add PTRACE_GET_SYSCALL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 12 Dec 2018 19:00:17 +0100
From:   Oleg Nesterov <oleg@...hat.com>
To:     "Dmitry V. Levin" <ldv@...linux.org>
Cc:     Andy Lutomirski <luto@...nel.org>,
        Elvira Khabirova <lineprinter@...linux.org>,
        Eugene Syromyatnikov <esyr@...hat.com>,
        Kees Cook <keescook@...omium.org>,
        Jann Horn <jannh@...gle.com>, linux-api@...r.kernel.org,
        strace-devel@...ts.strace.io, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5 24/25] ptrace: add PTRACE_GET_SYSCALL_INFO request

On 12/11, Dmitry V. Levin wrote:
>
> > > Still can't understand... are you saying that without (say) __pad2[4]
> > > sizeof(ptrace_syscall_info) or offsetofend(ptrace_syscall_info, seccomp)
> > > will depend on arch? Or what? I am just curious.
> >
> > Yes, without padding these sizes will depend on architecture:
>
> > $ cat t.c
> > #include <linux/types.h>
> > int main() {
> > 	struct s {
> > 		__u64 nr;
> > 		__u64 args[6];
> > 		__u32 ret_data;
> > 	};
> > 	return sizeof(struct s);
> > }
> >
> > $ gcc -m64 -Wall -O2 t.c && ./a.out; echo $?
> > 64
> > $ gcc -m32 -Wall -O2 t.c && ./a.out; echo $?
> > 60
> >
> > This happens because __u64 has 32-bit alignment on some 32-bit
> > architectures like x86.
> >
> > There is also m68k where __u32 has 16-bit alignment.

OK, thanks,

> Said that, I think it would be better if PTRACE_GET_SYSCALL_INFO
> did not take these trailing pads into account, e.g.
>
> -       return offsetofend(struct ptrace_syscall_info, seccomp);
> +       return offsetofend(struct ptrace_syscall_info, seccomp.ret_data);
> ...
> -       return offsetofend(struct ptrace_syscall_info, exit);
> +       return offsetofend(struct ptrace_syscall_info, exit.is_error);
>
> The reason is that it would allow to fill these trailing pads with
> something useful in the future.

Agreed.

But this way everything looks even more confusing. To me it would be
better to simply remove these pads, but I won't insist.

Oleg.