linux-kernel - Re: [patch 1/9] x86/ptrace: Prevent truncation of bitmap size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191107073108.GC30739@gmail.com>
Date:   Thu, 7 Nov 2019 08:31:08 +0100
From:   Ingo Molnar <mingo@...nel.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
        Stephen Hemminger <stephen@...workplumber.org>,
        Willy Tarreau <w@....eu>, Juergen Gross <jgross@...e.com>,
        Sean Christopherson <sean.j.christopherson@...el.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [patch 1/9] x86/ptrace: Prevent truncation of bitmap size


* Thomas Gleixner <tglx@...utronix.de> wrote:

> The active() callback of the IO bitmap regset divides the IO bitmap size by
> the word size (32/64 bit). As the I/O bitmap size is in bytes the active
> check fails for bitmap sizes of 1-3 bytes on 32bit and 1-7 bytes on 64bit.
> 
> Use DIV_ROUND_UP() instead.
> 
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> ---
>  arch/x86/kernel/ptrace.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> --- a/arch/x86/kernel/ptrace.c
> +++ b/arch/x86/kernel/ptrace.c
> @@ -697,7 +697,7 @@ static int ptrace_set_debugreg(struct ta
>  static int ioperm_active(struct task_struct *target,
>  			 const struct user_regset *regset)
>  {
> -	return target->thread.io_bitmap_max / regset->size;
> +	return DIV_ROUND_UP(target->thread.io_bitmap_max, regset->size);
>  }
>  
>  static int ioperm_get(struct task_struct *target,

Reviewed-by: Ingo Molnar <mingo@...nel.org>


But the ioperm core dumping logic in ptrace.c looks a bit weird. For 
example why do we alias REGSET_IOPERM64 to REGSET_XFP:

enum x86_regset {
        REGSET_GENERAL,
        REGSET_FP,
        REGSET_XFP,
        REGSET_IOPERM64 = REGSET_XFP,
        REGSET_XSTATE,
        REGSET_TLS,
        REGSET_IOPERM32,
};

This has been so since the original regset commit (325af5fb1418).

Unless I'm misreading the code this makes either REGSET_XFP or 
REGSET_IOPERM64 misbehave? What am I missing?

Thanks,

	Ingo