linux-kernel - Re: [PATCH v2 13/19] x86/signal: Check if vdso_image

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 26 Nov 2020 20:00:17 +0000
From:   Dmitry Safonov <dima@...sta.com>
To:     Andy Lutomirski <luto@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Dmitry Safonov <0x7f454c46@...il.com>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Arnd Bergmann <arnd@...db.de>, Borislav Petkov <bp@...en8.de>,
        Catalin Marinas <catalin.marinas@....com>,
        Christophe Leroy <christophe.leroy@...roup.eu>,
        Guo Ren <guoren@...nel.org>, "H. Peter Anvin" <hpa@...or.com>,
        Ingo Molnar <mingo@...hat.com>,
        Oleg Nesterov <oleg@...hat.com>,
        Russell King <linux@...linux.org.uk>,
        Thomas Bogendoerfer <tsbogend@...ha.franken.de>,
        Thomas Gleixner <tglx@...utronix.de>,
        Vincenzo Frascino <vincenzo.frascino@....com>,
        Will Deacon <will@...nel.org>, X86 ML <x86@...nel.org>
Subject: Re: [PATCH v2 13/19] x86/signal: Check if vdso_image_32 is mapped
 before trying to land on it

On 11/24/20 11:43 PM, Andy Lutomirski wrote:
> On Mon, Nov 23, 2020 at 4:29 PM Dmitry Safonov <dima@...sta.com> wrote:
>>
>> Provide current_has_vdso_image_32() helper and check it apriory landing
>> attempt on vdso vma.
>> The helper is a macro, not a static inline funciton to avoid
>> linux/sched/task_stack.h inclusion in asm/vdso.h.
> 
> Can you make this more general?  For example:
> 
> current_has_vdso(&vdso_image_whatever)

Sounds good, will do.

> 
> also:
> 
>> diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
>> index 18d8f17f755c..d9ab58cc765b 100644
>> --- a/arch/x86/entry/common.c
>> +++ b/arch/x86/entry/common.c
>> @@ -142,11 +142,16 @@ static noinstr bool __do_fast_syscall_32(struct pt_regs *regs)
>>  /* Returns 0 to return using IRET or 1 to return using SYSEXIT/SYSRETL. */
>>  __visible noinstr long do_fast_syscall_32(struct pt_regs *regs)
>>  {
>> +       unsigned long landing_pad;
>> +
>> +       if (!current_has_vdso_image_32())
>> +               force_sigsegv(SIGSEGV);
> 
> Falling through seems incorrect here.  I would instead write 0 to rip,
> do the force_sigsegv(), and exit, making sure that exiting goes
> through the correct path.
> 

Something like this?

:       if (!current_has_vdso(&vdso_image_32)) {
:               regs->ax = -EFAULT;
:               regs->ip = 0;
:               force_sigsegv(SIGSEGV);
:               syscall_exit_to_user_mode(regs);
:       }

Thanks,
          Dmitry