linux-kernel - RE: in_compat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <113ae3678beb4d33882506a85b398362@AcuMS.aculab.com>
Date:   Wed, 6 Jan 2021 09:42:33 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Andy Lutomirski' <luto@...nel.org>
CC:     "Eric W. Biederman" <ebiederm@...ssion.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        Christoph Hellwig <hch@....de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        X86 ML <x86@...nel.org>
Subject: RE: in_compat_syscall() on x86

From: Andy Lutomirski
> Sent: 05 January 2021 17:35
> 
> On Tue, Jan 5, 2021 at 1:53 AM David Laight <David.Laight@...lab.com> wrote:
> > ...
...
> > > > I also wondered about resetting it to zero when an x32 system call
> > > > exits (rather than entry to a 64bit one).
> > > >
> > > > For ia32 the flag is set (with |=) on every syscall entry.
> > > > Even though I'm pretty sure it can only change during exec.
> > >
> > > It can change for every syscall. I have tests that do this.
> >
> > Do they still work?
> 
> They seem to.
> 
> > I don't think the ia32 flag is cleared anywhere.
> 
> It's hiding in arch_exit_to_user_mode_prepare().

No wonder I don't notice.
There is a RMW to clear TS_COMPAT | TS_I386_REGS_POKED as (about)
the very last thing done before returning to user.

Short or renaming the 'status' field and fixing the compilation errors
I can't see an obvious way of detecting any other status flag bits.

If none are used (or a different field is used) then an unconditional
write of the syscall type in the entry paths would remove the need for
the clear in the syscall exit path.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)