linux-kernel - Re: [PATCH v2 13/19] x86/signal: Check if vdso_image

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Nov 2020 15:43:30 -0800
From:   Andy Lutomirski <luto@...nel.org>
To:     Dmitry Safonov <dima@...sta.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Dmitry Safonov <0x7f454c46@...il.com>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Andy Lutomirski <luto@...nel.org>,
        Arnd Bergmann <arnd@...db.de>, Borislav Petkov <bp@...en8.de>,
        Catalin Marinas <catalin.marinas@....com>,
        Christophe Leroy <christophe.leroy@...roup.eu>,
        Guo Ren <guoren@...nel.org>, "H. Peter Anvin" <hpa@...or.com>,
        Ingo Molnar <mingo@...hat.com>,
        Oleg Nesterov <oleg@...hat.com>,
        Russell King <linux@...linux.org.uk>,
        Thomas Bogendoerfer <tsbogend@...ha.franken.de>,
        Thomas Gleixner <tglx@...utronix.de>,
        Vincenzo Frascino <vincenzo.frascino@....com>,
        Will Deacon <will@...nel.org>, X86 ML <x86@...nel.org>
Subject: Re: [PATCH v2 13/19] x86/signal: Check if vdso_image_32 is mapped
 before trying to land on it

On Mon, Nov 23, 2020 at 4:29 PM Dmitry Safonov <dima@...sta.com> wrote:
>
> Provide current_has_vdso_image_32() helper and check it apriory landing
> attempt on vdso vma.
> The helper is a macro, not a static inline funciton to avoid
> linux/sched/task_stack.h inclusion in asm/vdso.h.

Can you make this more general?  For example:

current_has_vdso(&vdso_image_whatever)

also:

> diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
> index 18d8f17f755c..d9ab58cc765b 100644
> --- a/arch/x86/entry/common.c
> +++ b/arch/x86/entry/common.c
> @@ -142,11 +142,16 @@ static noinstr bool __do_fast_syscall_32(struct pt_regs *regs)
>  /* Returns 0 to return using IRET or 1 to return using SYSEXIT/SYSRETL. */
>  __visible noinstr long do_fast_syscall_32(struct pt_regs *regs)
>  {
> +       unsigned long landing_pad;
> +
> +       if (!current_has_vdso_image_32())
> +               force_sigsegv(SIGSEGV);

Falling through seems incorrect here.  I would instead write 0 to rip,
do the force_sigsegv(), and exit, making sure that exiting goes
through the correct path.