From: Oleg Nesterov <oleg@redhat.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>, X86 ML <x86@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Kees Cook <keescook@chromium.org>, Borislav Petkov <bp@alien8.de>
Subject: the usage of __SYSCALL_MASK in entry_SYSCALL_64/do_syscall_64 is not consistent
Date: Mon, 20 Jun 2016 19:53:11 +0200 [thread overview]
Message-ID: <20160620175311.GA24505@redhat.com> (raw)
In-Reply-To: <CALCETrXsg+5OencMrMrr6qZ8YmYj7UWqeAJMESHa5NqNMfcokg@mail.gmail.com>
On 06/19, Andy Lutomirski wrote:
>
> Something's clearly buggy there,
The usage of __X32_SYSCALL_BIT doesn't look right too. Nothing serious
but still.
Damn, initially I thought I have found the serious bug in entry_64.S
and it took me some time to understand why my exploit doesn't work ;)
So I learned that
andl $__SYSCALL_MASK, %eax
in entry_SYSCALL_64_fastpath() zero-extends %rax and thus
cmpl $__NR_syscall_max, %eax
...
call *sys_call_table(, %rax, 8)
is correct (rax <= __NR_syscall_max).
OK, so entry_64.S simply "ignores" the upper bits if CONFIG_X86_X32_ABI.
Fine, but this doesn't match the
if (likely((nr & __SYSCALL_MASK) < NR_syscalls))
check in do_syscall_64(). So this test-case
#include <stdio.h>
int main(void)
{
// __NR_exit == 0x3c
asm volatile ("movq $0xFFFFFFFF0000003c, %rax; syscall");
printf("I didn't exit because I am traced\n");
return 0;
}
silently exits if not traced, otherwise it calls printf().
Should we do something or we do not care?
Oleg.
next prev parent reply other threads:[~2016-06-20 18:03 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-18 10:21 [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Andy Lutomirski
2016-06-18 13:55 ` Pedro Alves
2016-06-18 14:41 ` Pedro Alves
2016-06-18 17:02 ` Andy Lutomirski
2016-06-19 22:09 ` Andy Lutomirski
2016-06-20 10:27 ` Pedro Alves
2016-06-20 15:24 ` Oleg Nesterov
2016-06-20 16:30 ` Andy Lutomirski
2016-06-20 16:14 ` Oleg Nesterov
2016-06-20 17:25 ` Andy Lutomirski
2016-06-20 10:07 ` Pedro Alves
2016-06-20 11:12 ` Jan Kratochvil
2016-06-18 17:48 ` Kees Cook
2016-06-19 21:19 ` Oleg Nesterov
2016-06-19 22:23 ` Andy Lutomirski
2016-06-20 6:12 ` Andy Lutomirski
2016-06-20 15:31 ` Oleg Nesterov
2016-06-20 17:53 ` Oleg Nesterov [this message]
2016-06-21 19:01 ` the usage of __SYSCALL_MASK in entry_SYSCALL_64/do_syscall_64 is not consistent Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160620175311.GA24505@redhat.com \
--to=oleg@redhat.com \
--cc=bp@alien8.de \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=luto@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.