linux-kernel - [RFC PATCH] rseq: Fix broken uapi field layout on 32-bit little endian

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220123193154.14565-1-mathieu.desnoyers@efficios.com>
Date:   Sun, 23 Jan 2022 14:31:54 -0500
From:   Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     linux-kernel@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        "Paul E . McKenney" <paulmck@...nel.org>,
        Boqun Feng <boqun.feng@...il.com>,
        "H . Peter Anvin" <hpa@...or.com>, Paul Turner <pjt@...gle.com>,
        linux-api@...r.kernel.org, stable@...r.kernel.org,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Florian Weimer <fw@...eb.enyo.de>,
        Andy Lutomirski <luto@...capital.net>,
        Dave Watson <davejwatson@...com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Russell King <linux@....linux.org.uk>,
        Andi Kleen <andi@...stfloor.org>,
        Christian Brauner <christian.brauner@...ntu.com>,
        Ben Maurer <bmaurer@...com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Josh Triplett <josh@...htriplett.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will.deacon@....com>,
        Michael Kerrisk <mtk.manpages@...il.com>,
        Joel Fernandes <joelaf@...gle.com>
Subject: [RFC PATCH] rseq: Fix broken uapi field layout on 32-bit little endian

The rseq rseq_cs.ptr.{ptr32,padding} uapi endianness handling is
entirely wrong on 32-bit little endian: a preprocessor logic mistake
wrongly uses the big endian field layout on 32-bit little endian
architectures.

Fortunately, those ptr32 accessors were never used within the kernel,
and only meant as a convenience for user-space.

While working on fixing the ppc32 support in librseq [1], I made sure
all 32-bit little endian architectures stopped depending on little
endian byte ordering by using the ptr32 field. It led me to discover
this wrong ptr32 field ordering on little endian.

Because it is already exposed as a UAPI, all we can do for the existing
fields is document the wrong behavior and encourage users to use
alternative mechanisms.

Introduce a new rseq_cs.arch field with correct field ordering. Use this
opportunity to improve the layout so accesses to architecture fields on
both 32-bit and 64-bit architectures are done through the same field
hierarchy, which is much nicer than the previous scheme.

The intended use is now:

* rseq_thread_area->rseq_cs.ptr64: Access the 64-bit value of the rseq_cs
				   pointer. Available on all
                                   architectures (unchanged).

* rseq_thread_area->rseq_cs.arch.ptr: Access the architecture specific
				      layout of the rseq_cs pointer. This
				      is a 32-bit field on 32-bit
				      architectures, and a 64-bit field on
                                      64-bit architectures.

Link: https://git.kernel.org/pub/scm/libs/librseq/librseq.git/ [1]
Fixes: ec9c82e03a74 ("rseq: uapi: Declare rseq_cs field as union, update includes")
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
Cc: Florian Weimer <fw@...eb.enyo.de>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: linux-api@...r.kernel.org
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Boqun Feng <boqun.feng@...il.com>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: Dave Watson <davejwatson@...com>
Cc: Paul Turner <pjt@...gle.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Russell King <linux@....linux.org.uk>
Cc: "H . Peter Anvin" <hpa@...or.com>
Cc: Andi Kleen <andi@...stfloor.org>
Cc: Christian Brauner <christian.brauner@...ntu.com>
Cc: Ben Maurer <bmaurer@...com>
Cc: Steven Rostedt <rostedt@...dmis.org>
Cc: Josh Triplett <josh@...htriplett.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Catalin Marinas <catalin.marinas@....com>
Cc: Will Deacon <will.deacon@....com>
Cc: Michael Kerrisk <mtk.manpages@...il.com>
Cc: Joel Fernandes <joelaf@...gle.com>
Cc: Paul E. McKenney <paulmck@...nel.org>
---
 include/uapi/linux/rseq.h | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/include/uapi/linux/rseq.h b/include/uapi/linux/rseq.h
index 9a402fdb60e9..68f61cdb45db 100644
--- a/include/uapi/linux/rseq.h
+++ b/include/uapi/linux/rseq.h
@@ -108,6 +108,12 @@ struct rseq {
 	 */
 	union {
 		__u64 ptr64;
+
+		/*
+		 * The "ptr" field layout is broken on little-endian
+		 * 32-bit architectures due to wrong preprocessor logic.
+		 * DO NOT USE.
+		 */
 #ifdef __LP64__
 		__u64 ptr;
 #else
@@ -121,6 +127,23 @@ struct rseq {
 #endif /* ENDIAN */
 		} ptr;
 #endif
+
+		/*
+		 * The "arch" field provides architecture accessor for
+		 * the ptr field based on architecture pointer size and
+		 * endianness.
+		 */
+		struct {
+#ifdef __LP64__
+			__u64 ptr;
+#elif defined(__BYTE_ORDER) ? (__BYTE_ORDER == __BIG_ENDIAN) : defined(__BIG_ENDIAN)
+			__u32 padding;		/* Initialized to zero. */
+			__u32 ptr;
+#else
+			__u32 ptr;
+			__u32 padding;		/* Initialized to zero. */
+#endif
+		} arch;
 	} rseq_cs;
 
 	/*
-- 
2.17.1