lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 20 Aug 2020 14:09:15 -0700 From: Kees Cook <keescook@...omium.org> To: Thomas Gleixner <tglx@...utronix.de> Cc: Kyle Huey <me@...ehuey.com>, Robert O'Callahan <rocallahan@...il.com>, LKML <linux-kernel@...r.kernel.org>, "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>, linux-arch@...r.kernel.org, Will Deacon <will@...nel.org>, Arnd Bergmann <arnd@...db.de>, Mark Rutland <mark.rutland@....com>, Keno Fischer <keno@...iacomputing.com>, Paolo Bonzini <pbonzini@...hat.com>, kvm list <kvm@...r.kernel.org>, Gabriel Krisman Bertazi <krisman@...labora.com>, Sean Christopherson <sean.j.christopherson@...el.com> Subject: Re: [REGRESSION] x86/entry: Tracer no longer has opportunity to change the syscall number at entry via orig_ax On Wed, Aug 19, 2020 at 09:44:39PM +0200, Thomas Gleixner wrote: > On Wed, Aug 19 2020 at 10:14, Kyle Huey wrote: > > tl;dr: after 27d6b4d14f5c3ab21c4aef87dd04055a2d7adf14 ptracer > > modifications to orig_ax in a syscall entry trace stop are not honored > > and this breaks our code. > > My fault and I have no idead why none of the silly test cases > noticed. Fix below. Hmm, which were you trying? Looking just now, I see that the seccomp selftests were failing for all their syscall-changing tests. Regardless, I can confirm both the failure and the fix. Reported-by: Kyle Huey <me@...ehuey.com> Tested-by: Kees Cook <keescook@...omium.org> Acked-by: Kees Cook <keescook@...omium.org> kernelci.org is *so* close to having the kernel selftests actually running with their builds. :) https://github.com/kernelci/kernelci-core/issues/331 -Kees > > Thanks, > > tglx > --- > diff --git a/kernel/entry/common.c b/kernel/entry/common.c > index 9852e0d62d95..fcae019158ca 100644 > --- a/kernel/entry/common.c > +++ b/kernel/entry/common.c > @@ -65,7 +65,8 @@ static long syscall_trace_enter(struct pt_regs *regs, long syscall, > > syscall_enter_audit(regs, syscall); > > - return ret ? : syscall; > + /* The above might have changed the syscall number */ > + return ret ? : syscall_get_nr(current, regs); > } > > noinstr long syscall_enter_from_user_mode(struct pt_regs *regs, long syscall) -- Kees Cook
Powered by blists - more mailing lists