linux-kernel - [PATCH v7 01/18] x86/fsgsbase/64: Fix ARCH_SET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed,  8 May 2019 03:02:16 -0700
From:   "Chang S. Bae" <chang.seok.bae@...el.com>
To:     Andy Lutomirski <luto@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>,
        "H . Peter Anvin" <hpa@...or.com>, Andi Kleen <ak@...ux.intel.com>
Cc:     Ravi Shankar <ravi.v.shankar@...el.com>,
        "Chang S . Bae" <chang.seok.bae@...el.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH v7 01/18] x86/fsgsbase/64: Fix ARCH_SET_FS/GS behaviors for a remote task

When a ptracer writes to a ptracee's FS/GSBASE with a different value,
the selector is also cleared. This behavior is not straightforward.

The change will make the behavior simple and sensible, as it will
(only) update the base when requested. Also, the condition check for
comparing the base is removed to make more simple. It might save a few
cycles, but this path is not performance critical.

The only recognizable downside of this change is when writing the base
if the selector is already nonzero. The base will be reloaded according
to the selector. But the case is highly unexpected in real usages.

Suggested-by: Andy Lutomirski <luto@...nel.org>
Signed-off-by: Chang S. Bae <chang.seok.bae@...el.com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Ingo Molnar <mingo@...nel.org>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Andi Kleen <ak@...ux.intel.com>
---
 arch/x86/kernel/process_64.c | 21 +++++++++------------
 arch/x86/kernel/ptrace.c     | 14 ++------------
 2 files changed, 11 insertions(+), 24 deletions(-)

diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index f8e1af3..32d12c6 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -719,13 +719,13 @@ long do_arch_prctl_64(struct task_struct *task, int option, unsigned long arg2)
 			return -EPERM;
 
 		preempt_disable();
-		/*
-		 * ARCH_SET_GS has always overwritten the index
-		 * and the base. Zero is the most sensible value
-		 * to put in the index, and is the only value that
-		 * makes any sense if FSGSBASE is unavailable.
-		 */
 		if (task == current) {
+			/*
+			 * For the request to set the current task's base,
+			 * first to load with zero selector, then write
+			 * the base value to be effective on a non-FSGSBASE
+			 * system.
+			 */
 			loadseg(GS, 0);
 			x86_gsbase_write_cpu_inactive(arg2);
 
@@ -736,7 +736,6 @@ long do_arch_prctl_64(struct task_struct *task, int option, unsigned long arg2)
 			task->thread.gsbase = arg2;
 
 		} else {
-			task->thread.gsindex = 0;
 			x86_gsbase_write_task(task, arg2);
 		}
 		preempt_enable();
@@ -751,11 +750,10 @@ long do_arch_prctl_64(struct task_struct *task, int option, unsigned long arg2)
 			return -EPERM;
 
 		preempt_disable();
-		/*
-		 * Set the selector to 0 for the same reason
-		 * as %gs above.
-		 */
 		if (task == current) {
+			/*
+			 * Same here as %gs handling above
+			 */
 			loadseg(FS, 0);
 			x86_fsbase_write_cpu(arg2);
 
@@ -765,7 +763,6 @@ long do_arch_prctl_64(struct task_struct *task, int option, unsigned long arg2)
 			 */
 			task->thread.fsbase = arg2;
 		} else {
-			task->thread.fsindex = 0;
 			x86_fsbase_write_task(task, arg2);
 		}
 		preempt_enable();
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 4b8ee05..3309cfe 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -396,22 +396,12 @@ static int putreg(struct task_struct *child,
 	case offsetof(struct user_regs_struct,fs_base):
 		if (value >= TASK_SIZE_MAX)
 			return -EIO;
-		/*
-		 * When changing the FS base, use do_arch_prctl_64()
-		 * to set the index to zero and to set the base
-		 * as requested.
-		 */
-		if (child->thread.fsbase != value)
-			return do_arch_prctl_64(child, ARCH_SET_FS, value);
+		x86_fsbase_write_cpu(child, value);
 		return 0;
 	case offsetof(struct user_regs_struct,gs_base):
-		/*
-		 * Exactly the same here as the %fs handling above.
-		 */
 		if (value >= TASK_SIZE_MAX)
 			return -EIO;
-		if (child->thread.gsbase != value)
-			return do_arch_prctl_64(child, ARCH_SET_GS, value);
+		x86_gsbase_write_cpu(child, value);
 		return 0;
 #endif
 	}
-- 
2.7.4