[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87mvl5jgl1.fsf@concordia.ellerman.id.au>
Date: Tue, 26 Jul 2016 12:09:14 +1000
From: Michael Ellerman <mpe@...erman.id.au>
To: David Laight <David.Laight@...LAB.COM>, 'Josh Poimboeuf' <jpoimboe@...hat.com>, Kees Cook <keescook@...omium.org>
Cc: "linux-ia64\@vger.kernel.org" <linux-ia64@...r.kernel.org>, "kernel-hardening\@lists.openwall.com" <kernel-hardening@...ts.openwall.com>, Catalin Marinas <catalin.marinas@....com>, Will Deacon <will.deacon@....com>, Linux-MM <linux-mm@...ck.org>, sparclinux <sparclinux@...r.kernel.org>, Jan Kara <jack@...e.cz>, Christoph Lameter <cl@...ux.com>, Andrea Arcangeli <aarcange@...hat.com>, "x86\@kernel.org" <x86@...nel.org>, Russell King <linux@...linux.org.uk>, Dmitry Vyukov <dvyukov@...gle.com>, David Rientjes <rientjes@...gle.com>, PaX Team <pageexec@...email.hu>, Borislav Petkov <bp@...e.de>, Mathias Krause <minipli@...glemail.com>, linux-arch <linux-arch@...r.kernel.org>, Rik van Riel <riel@...hat.com>, Brad Spengler <spender@...ecurity.net>, Andy Lutomirski <luto@...nel.org>, Andrew Morton <akpm@...ux-foundation.org>, "linux-arm-kernel\@lists.infradead.org" <linux-arm-kernel@...ts.infradead.org>, Laura Abbott <labbott@...oraproject.org>, Tony Luck <tony.luck@...el.com>, Ard Biesh
euvel <ard.biesheuvel@...aro.org>, LKML <linux-kernel@...r.kernel.org>, Fenghua Yu <fenghua.yu@...el.com>, Pekka Enberg <penberg@...nel.org>, Daniel Micay <danielmicay@...il.com>, Casey Schaufler <casey@...aufler-ca.com>, Joonsoo Kim <iamjoonsoo.kim@....com>, "linuxppc-dev\@lists.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>, "David S. Miller" <davem@...emloft.net>
Subject: RE: [PATCH v3 02/11] mm: Hardened usercopy
David Laight <David.Laight@...LAB.COM> writes:
> From: Josh Poimboeuf
>> Sent: 22 July 2016 18:46
>> >
>> > e.g. then if the pointer was in the thread_info, the second test would
>> > fail, triggering the protection.
>>
>> FWIW, this won't work right on x86 after Andy's
>> CONFIG_THREAD_INFO_IN_TASK patches get merged.
>
> What ends up in the 'thread_info' area?
It depends on the arch.
> If it contains the fp save area then programs like gdb may end up requesting
> copy_in/out directly from that area.
On the arches I've seen thread_info doesn't usually contain register save areas,
but if it did then it would be up to the arch helper to allow that copy to go
through.
However given thread_info generally contains lots of low level flags that would
be a good target for an attacker, the best way to cope with ptrace wanting to
copy to/from it would be to use a temporary, and prohibit copying directly
to/from thread_info - IMHO.
cheers
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
