linux-kernel - Re: [PATCH v8 2/8] powerpc/vdso: Remove __kernel_datapage_offset and simplify __get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87a6yf34aj.fsf@mpe.ellerman.id.au>
Date:   Fri, 28 Aug 2020 12:14:28 +1000
From:   Michael Ellerman <mpe@...erman.id.au>
To:     Dmitry Safonov <0x7f454c46@...il.com>
Cc:     Christophe Leroy <christophe.leroy@...roup.eu>,
        Benjamin Herrenschmidt <benh@...nel.crashing.org>,
        Paul Mackerras <paulus@...ba.org>, nathanl@...ux.ibm.com,
        linux-arch <linux-arch@...r.kernel.org>,
        Arnd Bergmann <arnd@...db.de>,
        open list <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Vincenzo Frascino <vincenzo.frascino@....com>,
        linuxppc-dev@...ts.ozlabs.org, Will Deacon <will@...nel.org>
Subject: Re: [PATCH v8 2/8] powerpc/vdso: Remove __kernel_datapage_offset and simplify __get_datapage()

Dmitry Safonov <0x7f454c46@...il.com> writes:
> Hello,
>
> On Wed, 26 Aug 2020 at 15:39, Michael Ellerman <mpe@...erman.id.au> wrote:
>> Christophe Leroy <christophe.leroy@...roup.eu> writes:
> [..]
>> > arch_remap() gets replaced by vdso_remap()
>> >
>> > For arch_unmap(), I'm wondering how/what other architectures do, because
>> > powerpc seems to be the only one to erase the vdso context pointer when
>> > unmapping the vdso.
>>
>> Yeah. The original unmap/remap stuff was added for CRIU, which I thought
>> people tested on other architectures (more than powerpc even).
>>
>> Possibly no one really cares about vdso unmap though, vs just moving the
>> vdso.
>>
>> We added a test for vdso unmap recently because it happened to trigger a
>> KAUP failure, and someone actually hit it & reported it.
>
> You right, CRIU cares much more about moving vDSO.
> It's done for each restoree and as on most setups vDSO is premapped and
> used by the application - it's actively tested.
> Speaking about vDSO unmap - that's concerning only for heterogeneous C/R,
> i.e when an application is migrated from a system that uses vDSO to the one
> which doesn't - it's much rare scenario.
> (for arm it's !CONFIG_VDSO, for x86 it's `vdso=0` boot parameter)

Ah OK that explains it.

The case we hit of VDSO unmapping was some strange "library OS" thing
which had explicitly unmapped the VDSO, so also very rare.

> Looking at the code, it seems quite easy to provide/maintain .close() for
> vm_special_mapping. A bit harder to add a test from CRIU side
> (as glibc won't know on restore that it can't use vdso anymore),
> but totally not impossible.
>
>> Running that test on arm64 segfaults:
>>
>>   # ./sigreturn_vdso
>>   VDSO is at 0xffff8191f000-0xffff8191ffff (4096 bytes)
>>   Signal delivered OK with VDSO mapped
>>   VDSO moved to 0xffff8191a000-0xffff8191afff (4096 bytes)
>>   Signal delivered OK with VDSO moved
>>   Unmapped VDSO
>>   Remapped the stack executable
>>   [   48.556191] potentially unexpected fatal signal 11.
>>   [   48.556752] CPU: 0 PID: 140 Comm: sigreturn_vdso Not tainted 5.9.0-rc2-00057-g2ac69819ba9e #190
>>   [   48.556990] Hardware name: linux,dummy-virt (DT)
>>   [   48.557336] pstate: 60001000 (nZCv daif -PAN -UAO BTYPE=--)
>>   [   48.557475] pc : 0000ffff8191a7bc
>>   [   48.557603] lr : 0000ffff8191a7bc
>>   [   48.557697] sp : 0000ffffc13c9e90
>>   [   48.557873] x29: 0000ffffc13cb0e0 x28: 0000000000000000
>>   [   48.558201] x27: 0000000000000000 x26: 0000000000000000
>>   [   48.558337] x25: 0000000000000000 x24: 0000000000000000
>>   [   48.558754] x23: 0000000000000000 x22: 0000000000000000
>>   [   48.558893] x21: 00000000004009b0 x20: 0000000000000000
>>   [   48.559046] x19: 0000000000400ff0 x18: 0000000000000000
>>   [   48.559180] x17: 0000ffff817da300 x16: 0000000000412010
>>   [   48.559312] x15: 0000000000000000 x14: 000000000000001c
>>   [   48.559443] x13: 656c626174756365 x12: 7865206b63617473
>>   [   48.559625] x11: 0000000000000003 x10: 0101010101010101
>>   [   48.559828] x9 : 0000ffff818afda8 x8 : 0000000000000081
>>   [   48.559973] x7 : 6174732065687420 x6 : 64657070616d6552
>>   [   48.560115] x5 : 000000000e0388bd x4 : 000000000040135d
>>   [   48.560270] x3 : 0000000000000000 x2 : 0000000000000001
>>   [   48.560412] x1 : 0000000000000003 x0 : 00000000004120b8
>>   Segmentation fault
>>   #
>>
>> So I think we need to keep the unmap hook. Maybe it should be handled by
>> the special_mapping stuff generically.
>
> I'll cook a patch for vm_special_mapping if you don't mind :-)

That would be great, thanks!

cheers