From: Kees Cook <keescook@chromium.org>
To: Mark Brown <broonie@kernel.org>
Cc: "Josh Poimboeuf" <jpoimboe@redhat.com>,
"Mark Rutland" <mark.rutland@arm.com>,
"Vito Caputo" <vcaputo@pengaru.com>,
"Jann Horn" <jannh@google.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
"Ingo Molnar" <mingo@redhat.com>,
"Borislav Petkov" <bp@alien8.de>,
"H. Peter Anvin" <hpa@zytor.com>, "Jens Axboe" <axboe@kernel.dk>,
"Peter Zijlstra" <peterz@infradead.org>,
"Stefan Metzmacher" <metze@samba.org>,
"Andy Lutomirski" <luto@kernel.org>,
"Lai Jiangshan" <laijs@linux.alibaba.com>,
"Christian Brauner" <christian.brauner@ubuntu.com>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Kenta.Tada@sony.com" <Kenta.Tada@sony.com>,
"Daniel Bristot de Oliveira" <bristot@redhat.com>,
"Michael Weiß" <michael.weiss@aisec.fraunhofer.de>,
"Anand K Mistry" <amistry@google.com>,
"Alexey Gladkov" <legion@kernel.org>,
"Michal Hocko" <mhocko@suse.com>, "Helge Deller" <deller@gmx.de>,
"Dave Hansen" <dave.hansen@linux.intel.com>,
"Andrea Righi" <andrea.righi@canonical.com>,
"Ohhoon Kwon" <ohoono.kwon@samsung.com>,
"Kalesh Singh" <kaleshsingh@google.com>,
"YiFei Zhu" <yifeifz2@illinois.edu>,
"Eric W. Biederman" <ebiederm@xmission.com>,
"Qi Zheng" <zhengqi.arch@bytedance.com>,
linux-kernel@vger.kernel.org, x86@kernel.org,
linux-fsdevel@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Re: [PATCH] proc: Disable /proc/$pid/wchan
Date: Wed, 29 Sep 2021 12:26:30 -0700 [thread overview]
Message-ID: <202109291224.8C538667@keescook> (raw)
In-Reply-To: <20210929190042.GU4199@sirena.org.uk>
On Wed, Sep 29, 2021 at 08:00:42PM +0100, Mark Brown wrote:
> On Wed, Sep 29, 2021 at 11:54:55AM -0700, Kees Cook wrote:
> > On Mon, Sep 27, 2021 at 01:50:56PM -0700, Josh Poimboeuf wrote:
>
> > > Even with that patch, it doesn't lock the task's runqueue before reading
> > > the stack, so there's still the possibility of the task running on
> > > another CPU and the unwinder going off the rails a bit, which might be
> > > used by an attacker in creative ways similar to the /proc/<pid>/stack
> > > vulnerability Jann mentioned earlier.
>
> > Since I think we're considering get_wchan() to be slow-path, can we just
> > lock the runqueue and use arch_stack_walk_reliable()?
>
> Unfortunately arch_stack_walk_reliable() is only available for powerpc,
> s390 and x86 currently - work is in progress to implement it for arm64
> as well but it's not there yet.
Strictly speaking, we're only trying to fix this for x86+ORC. The other
architectures (or non-ORC x86) already have their own non-ORC unwinders
behind get_wchan(). They may have similar weaknesses (which should
certainly be fixed), I think the first step here is to restore wchan
under x86+ORC.
--
Kees Cook
next prev parent reply other threads:[~2021-09-29 19:26 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-23 23:31 [PATCH] proc: Disable /proc/$pid/wchan Kees Cook
2021-09-23 23:38 ` Kees Cook
2021-09-24 13:31 ` Peter Zijlstra
2021-09-23 23:49 ` Vito Caputo
2021-09-24 0:08 ` Jann Horn
2021-09-24 0:22 ` Vito Caputo
2021-09-24 1:16 ` Kees Cook
2021-09-24 1:34 ` Vito Caputo
2021-09-24 1:42 ` Kees Cook
2021-09-24 13:54 ` Mark Rutland
2021-09-24 14:26 ` Kees Cook
2021-09-27 9:03 ` Mark Rutland
2021-09-27 18:07 ` Kees Cook
2021-09-27 20:50 ` Josh Poimboeuf
2021-09-29 18:54 ` Kees Cook
2021-09-29 19:00 ` Mark Brown
2021-09-29 19:26 ` Kees Cook [this message]
2021-09-29 19:40 ` Peter Zijlstra
2021-09-29 21:10 ` Josh Poimboeuf
2021-09-27 9:16 ` David Laight
2021-09-29 8:48 ` Peter Zijlstra
2021-09-24 2:13 ` Andrew Morton
2021-09-24 6:04 ` Kees Cook
2021-09-24 13:29 ` Peter Zijlstra
2021-09-30 18:05 ` Stephen Brennan
2021-09-30 18:12 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202109291224.8C538667@keescook \
--to=keescook@chromium.org \
--cc=Kenta.Tada@sony.com \
--cc=akpm@linux-foundation.org \
--cc=amistry@google.com \
--cc=andrea.righi@canonical.com \
--cc=axboe@kernel.dk \
--cc=bp@alien8.de \
--cc=bristot@redhat.com \
--cc=broonie@kernel.org \
--cc=christian.brauner@ubuntu.com \
--cc=dave.hansen@linux.intel.com \
--cc=deller@gmx.de \
--cc=ebiederm@xmission.com \
--cc=hpa@zytor.com \
--cc=jannh@google.com \
--cc=jpoimboe@redhat.com \
--cc=kaleshsingh@google.com \
--cc=laijs@linux.alibaba.com \
--cc=legion@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mark.rutland@arm.com \
--cc=metze@samba.org \
--cc=mhocko@suse.com \
--cc=michael.weiss@aisec.fraunhofer.de \
--cc=mingo@redhat.com \
--cc=ohoono.kwon@samsung.com \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=vcaputo@pengaru.com \
--cc=x86@kernel.org \
--cc=yifeifz2@illinois.edu \
--cc=zhengqi.arch@bytedance.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.