[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 9 Mar 2017 19:39:12 +0900
From: Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
To: Thomas Garnier <thgarnie@...gle.com>
Cc: David Howells <dhowells@...hat.com>,
Dave Hansen <dave.hansen@...el.com>, Arnd Bergmann <arnd@...db.de>,
Al Viro <viro@...iv.linux.org.uk>,
René Nyffenegger <mail@...enyffenegger.ch>,
Andrew Morton <akpm@...ux-foundation.org>,
Kees Cook <keescook@...omium.org>,
"Paul E . McKenney" <paulmck@...ux.vnet.ibm.com>,
"David S . Miller" <davem@...emloft.net>,
Andy Lutomirski <luto@...nel.org>,
Ard Biesheuvel <ard.biesheuvel@...aro.org>,
Nicolas Pitre <nicolas.pitre@...aro.org>,
Petr Mladek <pmladek@...e.com>,
Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
Helge Deller <deller@....de>, Rik van Riel <riel@...hat.com>,
Ingo Molnar <mingo@...nel.org>, Oleg Nesterov <oleg@...hat.com>,
John Stultz <john.stultz@...aro.org>,
Thomas Gleixner <tglx@...utronix.de>,
Pavel Tikhomirov <ptikhomirov@...tuozzo.com>,
Frederic Weisbecker <fweisbec@...il.com>,
Stephen Smalley <sds@...ho.nsa.gov>,
Stanislav Kinsburskiy <skinsbursky@...tuozzo.com>,
Ingo Molnar <mingo@...hat.com>, "H . Peter Anvin" <hpa@...or.com>,
Paolo Bonzini <pbonzini@...hat.com>, Borislav Petkov <bp@...en8.de>,
Josh Poimboeuf <jpoimboe@...hat.com>,
Brian Gerst <brgerst@...il.com>, Jan Beulich <JBeulich@...e.com>,
Christian Borntraeger <borntraeger@...ibm.com>,
"Luis R . Rodriguez" <mcgrof@...nel.org>,
He Chen <he.chen@...ux.intel.com>,
Russell King <linux@...linux.org.uk>,
Will Deacon <will.deacon@....com>,
Catalin Marinas <catalin.marinas@....com>,
Mark Rutland <mark.rutland@....com>,
James Morse <james.morse@....com>,
Pratyush Anand <panand@...hat.com>,
Vladimir Murzin <vladimir.murzin@....com>,
Chris Metcalf <cmetcalf@...lanox.com>,
Andre Przywara <andre.przywara@....com>, linux-api@...r.kernel.org,
linux-kernel@...r.kernel.org, x86@...nel.org,
linux-arm-kernel@...ts.infradead.org,
kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH v2 1/4] syscalls: Restore address limit after a syscall
Hello,
On (03/08/17 17:24), Thomas Garnier wrote:
> This patch ensures a syscall does not return to user-mode with a kernel
> address limit. If that happened, a process can corrupt kernel-mode
> memory and elevate privileges.
I like the patch set.
a side note (perhaps a bit irrelevant), the WARN backtrace does not
really tell more than "incorrect get_fs() on user-mode return" message
does
incorrect get_fs() on user-mode return
------------[ cut here ]------------
kernel BUG at kernel/sys.c:2467!
invalid opcode: 0000 [#1] PREEMPT SMP
Modules linked in: FOO
CPU: 2 PID: 355 Comm: BAR
Hardware name: BUZ
task: ffff8801329f4e00 task.stack: ffffc900005d8000
RIP: 0010:verify_pre_usermode_state+0x31/0x34
RSP: 0018:ffffc900005dbf48 EFLAGS: 00010096
RAX: 0000000000000026 RBX: 0000000000000002 RCX: 0000000000000001
RDX: 0000000000000046 RSI: ffff880130cead88 RDI: ffffffff81095594
RBP: ffffc900005dbf48 R08: 0000000000000001 R09: 0000000000000001
R10: ffffc900005dbd58 R11: ffff8801329f4e00 R12: 0000000000000002
R13: 0000000000000001 R14: 00007fb6c6a7b5e0 R15: 0000000000000002
FS: 00007fb6c70d3b40(0000) GS:ffff880137d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd9d94f8f8 CR3: 00000001295b2000 CR4: 00000000000006e0
Call Trace:
entry_SYSCALL_64_fastpath+0x3a/0xb2
RIP: 0033:0x7fb6c67ba3c0
RSP: 002b:00007ffd9d94f5c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: 0000000000000002 RBX: 0000000000000000 RCX: 00007fb6c67ba3c0
RDX: 0000000000000002 RSI: 0000000000ba7310 RDI: 0000000000000001
RBP: 0000000000000001 R08: 00007fb6c6a7c740 R09: 00007fb6c70d3b40
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: 48 8b 14 25 40 c5 00 00 48 b8 00 f0 ff ff ff 7f 00 00 48 39 82 28 11 00 00 74 12 55 48 c7 c7 9b f5 78 81 48 89 e5 e8 14 19 0b 00 <0f> 0b c3 66 66 66 66 90 55 48 89 e5 53 48 8b 47 50 48 89 fb 48
may be some day someone would be interested in something like
"incorrect get_fs() on user-mode return from %pS"
and set_fs() would save _RET_IP_.
just a side note.
-ss
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
