linux-kernel - Re: [BUG] x86: 32-bit uprobes are broken

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aV6BO4joxggeUut4@redhat.com>
Date: Wed, 7 Jan 2026 16:52:27 +0100
From: Oleg Nesterov <oleg@...hat.com>
To: Peter Zijlstra <peterz@...radead.org>
Cc: Andrii Nakryiko <andrii@...nel.org>, Borislav Petkov <bp@...en8.de>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	David Hildenbrand <david@...nel.org>,
	"H. Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...hat.com>,
	Jiri Olsa <jolsa@...nel.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Paulo Andrade <pandrade@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>, linux-kernel@...r.kernel.org,
	x86@...nel.org
Subject: Re: [BUG] x86: 32-bit uprobes are broken

On 01/07, Peter Zijlstra wrote:
>
> On Wed, Jan 07, 2026 at 03:32:53PM +0100, Oleg Nesterov wrote:
> > This patch
> >
> > 	--- a/kernel/events/uprobes.c
> > 	+++ b/kernel/events/uprobes.c
> > 	@@ -1710,8 +1710,11 @@ static int xol_add_vma(struct mm_struct *mm, struct xol_area *area)
> >
> > 		if (!area->vaddr) {
> > 			/* Try to map as high as possible, this is only a hint. */
> > 	+		if (test_thread_flag(TIF_ADDR32))
> > 	+			current_thread_info()->status |= TS_COMPAT;
> > 			area->vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE,
> > 							PAGE_SIZE, 0, 0);
> > 	+		current_thread_info()->status &= ~TS_COMPAT;
> > 			if (IS_ERR_VALUE(area->vaddr)) {
> > 				ret = area->vaddr;
> > 				goto fail;
>
> Urgh. Also I'm a little bit confused; set_personality_ia32(), which is
> what sets TIF_ADDR32 (afaict) would also set TS_COMPAT, no?

Yep. But TS_COMPAT is per syscall, not per task. It is cleared in
arch_exit_to_user_mode_prepare(), in this case after sys_execve() syscall.

Oleg.