kernel-hardening - Re: [PATCH v10 1/3] x86/syscalls: Check address limit on user-mode return

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.20.1707062247520.3239@nanos>
Date: Thu, 6 Jul 2017 22:48:46 +0200 (CEST)
From: Thomas Gleixner <tglx@...utronix.de>
To: Thomas Garnier <thgarnie@...gle.com>
cc: Kees Cook <keescook@...omium.org>, Ingo Molnar <mingo@...hat.com>, 
    "H . Peter Anvin" <hpa@...or.com>, Andy Lutomirski <luto@...nel.org>, 
    Paolo Bonzini <pbonzini@...hat.com>, Rik van Riel <riel@...hat.com>, 
    Oleg Nesterov <oleg@...hat.com>, Josh Poimboeuf <jpoimboe@...hat.com>, 
    Petr Mladek <pmladek@...e.com>, Miroslav Benes <mbenes@...e.cz>, 
    Al Viro <viro@...iv.linux.org.uk>, Arnd Bergmann <arnd@...db.de>, 
    Dave Hansen <dave.hansen@...el.com>, David Howells <dhowells@...hat.com>, 
    Russell King <linux@...linux.org.uk>, 
    Andy Lutomirski <luto@...capital.net>, Will Drewry <wad@...omium.org>, 
    Will Deacon <will.deacon@....com>, 
    Catalin Marinas <catalin.marinas@....com>, 
    Mark Rutland <mark.rutland@....com>, Pratyush Anand <panand@...hat.com>, 
    Chris Metcalf <cmetcalf@...lanox.com>, "x86@...nel.org" <x86@...nel.org>, 
    LKML <linux-kernel@...r.kernel.org>, Linux API <linux-api@...r.kernel.org>, 
    "linux-arm-kernel@...ts.infradead.org" <linux-arm-kernel@...ts.infradead.org>, 
    "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>
Subject: Re: [PATCH v10 1/3] x86/syscalls: Check address limit on user-mode
 return

On Thu, 6 Jul 2017, Thomas Garnier wrote:
> On Wed, Jun 28, 2017 at 10:52 AM, Kees Cook <keescook@...omium.org> wrote:
> >
> > On Tue, Jun 20, 2017 at 1:24 PM, Kees Cook <keescook@...omium.org> wrote:
> > > On Wed, Jun 14, 2017 at 6:12 PM, Thomas Garnier <thgarnie@...gle.com> wrote:
> > >> Ensure the address limit is a user-mode segment before returning to
> > >> user-mode. Otherwise a process can corrupt kernel-mode memory and elevate
> > >> privileges [1].
> > >>
> > >> The set_fs function sets the TIF_SETFS flag to force a slow path on
> > >> return. In the slow path, the address limit is checked to be USER_DS if
> > >> needed.
> > >>
> > >> The addr_limit_user_check function is added as a cross-architecture
> > >> function to check the address limit.
> > >>
> > >> [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=990
> > >>
> > >> Signed-off-by: Thomas Garnier <thgarnie@...gle.com>
> > >
> > > Thanks for reworking this series!
> > >
> > > The bad state correctly BUGs under the LKDTM test:
> > >
> > > [   21.171586] lkdtm: Performing direct entry CORRUPT_USER_DS
> > > [   21.172791] lkdtm: setting bad task size limit
> > > [   21.173742] ------------[ cut here ]------------
> > > [   21.174641] kernel BUG at ./include/linux/syscalls.h:220!
> > > ...
> > > [   21.193166] Call Trace:
> > > [   21.193617]  ? trace_hardirqs_on_thunk+0x1a/0x1c
> > > [   21.194443]  entry_SYSCALL64_slow_path+0x25/0x25
> > >
> > >
> > > Tested-by: Kees Cook <keescook@...omium.org>
> >
> > Is everyone happy with this patch for x86? Does this need anything
> > more/different?
> 
> Asking again. Additional feedback? Anyone wants to pick-it up?

Can do. This needs to be a combo of all 3 I assume as the x86 one contains
the function used by all of them, right?

Thanks,

	tglx

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.