linux-kernel - Re: [PATCH] fanotify: Fix sys_fanotify

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 1 Dec 2020 11:10:48 -0800
From:   Andy Lutomirski <luto@...nel.org>
To:     Catalin Marinas <catalin.marinas@....com>
Cc:     Andy Lutomirski <luto@...nel.org>,
        linux-arch <linux-arch@...r.kernel.org>,
        Brian Gerst <brgerst@...il.com>,
        LKML <linux-kernel@...r.kernel.org>, X86 ML <x86@...nel.org>,
        Borislav Petkov <bp@...en8.de>,
        Thomas Gleixner <tglx@...utronix.de>, Jan Kara <jack@...e.cz>,
        Paweł Jasiak <pawel@...iak.xyz>,
        Russell King <linux@...linux.org.uk>
Subject: Re: [PATCH] fanotify: Fix sys_fanotify_mark() on native x86-32

On Tue, Dec 1, 2020 at 11:00 AM Catalin Marinas <catalin.marinas@....com> wrote:
>
> On Tue, Dec 01, 2020 at 09:34:32AM -0800, Andy Lutomirski wrote:
> > On Tue, Dec 1, 2020 at 9:23 AM Andy Lutomirski <luto@...nel.org> wrote:
> > > On Mon, Nov 30, 2020 at 2:31 PM Brian Gerst <brgerst@...il.com> wrote:
> > > > Commit 121b32a58a3a converted native x86-32 which take 64-bit arguments to
> > > > use the compat handlers to allow conversion to passing args via pt_regs.
> > > > sys_fanotify_mark() was however missed, as it has a general compat handler.
> > > > Add a config option that will use the syscall wrapper that takes the split
> > > > args for native 32-bit.
> > > >
> > > > Reported-by: Paweł Jasiak <pawel@...iak.xyz>
> > > > Fixes: 121b32a58a3a ("x86/entry/32: Use IA32-specific wrappers for syscalls taking 64-bit arguments")
> > > > Signed-off-by: Brian Gerst <brgerst@...il.com>
> > > > ---
> > > >  arch/Kconfig                       |  6 ++++++
> > > >  arch/x86/Kconfig                   |  1 +
> > > >  fs/notify/fanotify/fanotify_user.c | 17 +++++++----------
> > > >  include/linux/syscalls.h           | 24 ++++++++++++++++++++++++
> > > >  4 files changed, 38 insertions(+), 10 deletions(-)
> > > >
> > > > diff --git a/arch/Kconfig b/arch/Kconfig
> > > > index 090ef3566c56..452cc127c285 100644
> > > > --- a/arch/Kconfig
> > > > +++ b/arch/Kconfig
> > > > @@ -1045,6 +1045,12 @@ config HAVE_STATIC_CALL_INLINE
> > > >         bool
> > > >         depends on HAVE_STATIC_CALL
> > > >
> > > > +config ARCH_SPLIT_ARG64
> > > > +       bool
> > > > +       help
> > > > +          If a 32-bit architecture requires 64-bit arguments to be split into
> > > > +          pairs of 32-bit arguemtns, select this option.
> > >
> > > You misspelled arguments.  You might also want to clarify that, for
> > > 64-bit arches, this means that compat syscalls split their arguments.
> >
> > No, that's backwards.  Maybe it should be depends !64BIT instead.
> >
> > But I'm really quite confused about something: what's special about
> > x86 here?  Are there really Linux arches (compat or 32-bit native)
> > that *don't* split arguments like this?  Sure, some arches probably
> > work the same way that x86 used to in which the compiler did the
> > splitting by magic for us, but that was always a bit of a kludge.
>
> On arm32 we rely on the compiler splitting a 64-bit argument in two
> consecutive registers. But I wouldn't say it's a kludge (well, mostly)
> as that's part of the arm procedure calling standard. Currently arm32
> doesn't pass the syscall arguments through a read from pt_regs, so all
> is handled transparently.
>
> On arm64 compat, we need to re-assemble the arguments with some
> wrappers explicitly (arch/arm64/kernel/sys32.c) or call the generic
> wrapper like in the compat_sys_fanotify_mark() case.
>
> > Could this change maybe be made unconditional?
>
> I think it's fine in this particular case.
>
> I don't think it's valid in general because of the arm (and maybe
> others) requirement that the first register of a 64-bit argument is an
> even number (IIRC, Russell should know better). If the u64 mask was an
> argument before or after the current position, the compiler would have
> introduced a pad register but not if the arg is split in two u32.
>

So I guess Brian's macro is more like "this is a 32-bit arch that
needs to split 64-bit syscall args but naively splitting them is
correct", which is true on x86_32 but not necessarily on arm.

Should we consider having a real program that runs as part of the
build generate the syscall wrappers?  The logic involved is pushing
the bounds of C macro magic and human comprehension.

--Andy