From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754377AbaA0WdU (ORCPT ); Mon, 27 Jan 2014 17:33:20 -0500 Received: from zeniv.linux.org.uk ([195.92.253.2]:44421 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753897AbaA0WdT (ORCPT ); Mon, 27 Jan 2014 17:33:19 -0500 Date: Mon, 27 Jan 2014 22:32:57 +0000 From: Al Viro To: Linus Torvalds Cc: Andy Lutomirski , Peter Anvin , Ingo Molnar , Thomas Gleixner , Peter Zijlstra , the arch/x86 maintainers , Linux Kernel Mailing List Subject: Re: [RFC] de-asmify the x86-64 system call slowpath Message-ID: <20140127223257.GE10323@ZenIV.linux.org.uk> References: <20140127002255.GA10323@ZenIV.linux.org.uk> <20140127074208.GB10323@ZenIV.linux.org.uk> <52E6D866.604@amacapital.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jan 27, 2014 at 02:17:23PM -0800, Linus Torvalds wrote: > On Mon, Jan 27, 2014 at 2:06 PM, Andy Lutomirski wrote: > > > > It's not just ip and sp -- cs matters here, too, I think. > > For signal *delivery*, CS will always be __USER_CS, and %rcx can be > crap, so sysret should be fine. We could easily check that %rip is > valid in the whole slow-path instead of saying "return 1 if we did > do_signal()". do_signal() is also a place where arbitrary changes to regs might've been done by tracer, so regs->cs might need to be checked in the same place where we validate regs->rip ;-/