linux-kernel - Re: gdbserver + fsgsbase kaputt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrXkePULoyH85bmUGfCbvn4M9xxQOK9v_UL_+BkwUDrt1Q@mail.gmail.com>
Date:   Mon, 11 Jan 2021 19:31:43 -0800
From:   Andy Lutomirski <luto@...nel.org>
To:     Tom de Vries <tdevries@...e.de>
Cc:     Andy Lutomirski <luto@...nel.org>, Borislav Petkov <bp@...en8.de>,
        "Chang S. Bae" <chang.seok.bae@...el.com>, tdevries@...e.com,
        x86-ml <x86@...nel.org>, lkml <linux-kernel@...r.kernel.org>
Subject: Re: gdbserver + fsgsbase kaputt

On Mon, Jan 11, 2021 at 3:52 PM Tom de Vries <tdevries@...e.de> wrote:
>
> On 1/12/21 12:40 AM, Andy Lutomirski wrote:
> > On Mon, Jan 11, 2021 at 1:06 PM Andy Lutomirski <luto@...capital.net> wrote:
> >>
> >>
> >>> On Jan 11, 2021, at 12:00 PM, Borislav Petkov <bp@...en8.de> wrote:
> >>>
> >>
> >>
> >>> Or do you mean I should add "unsafe_fsgsbase" to grub cmdline and bisect
> >>> with fsgsbase enabled in all test kernels?
> >>
> >> Yes. But I can also look myself in a bit.
> >>
> >
> > Tom, if I reproduce it in an interactive gdb and play a bit, I get:
> >
> > Program received signal SIGSEGV, Segmentation fault.
> > 0xf7df2cb6 in init_cacheinfo () from target:/lib/libc.so.6
> > (gdb) p $gs = $gs
> > $1 = 99
> > (gdb) si
> >
> > Program terminated with signal SIGSEGV, Segmentation fault.
> > The program no longer exists.
> >
> > That's gdb itself crashing.  Any idea what's wrong?
> >
>
> The first "Program received signal SIGSEGV, Segmentation fault" means
> that gdb intercepts the sigsegv, and allows you to inspect it f.i. by
> printing $_siginfo.  The inferior is still live at this point.
>
> Then when trying to continue using si,  the signal is passed on to the
> inferior, which means it'll be terminated.
>
> AFAIU, gdb has not crashed, and behaves as expected.  See below for a
> similar scenario.
>
> Thanks,
> - Tom
>
> ...
> $ cat test2.c
> int
> main (void)
> {
>   *((int *)0) = 0;
>   return 0;
> }
> $ gcc test2.c
> $ ./a.out
> Segmentation fault (core dumped)
> $ gdb -q ./a.out
> Reading symbols from ./a.out...
> (gdb) r
> Starting program: /home/vries/a.out
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x00000000004004a0 in main ()
> (gdb) si
>
> Program terminated with signal SIGSEGV, Segmentation fault.
> The program no longer exists.
> (gdb)
> ...
>

Hah, you're right.  Is there an easy way to tell gdb to suppress the
first signal and try again?