Re: [Security] DoS on x86_64

["H. Peter Anvin" <hpa@zytor.com>]

On 01/28/2010 02:33 PM, Linus Torvalds wrote:
> 
> 
> On Thu, 28 Jan 2010, H. Peter Anvin wrote:
>>
>> - The actual point of no return in the case of binfmt_elf.c is inside
>> the subroutine flush_old_exec() [which makes sense - the actual process
>> switch shouldn't be dependent on the binfmt] which isn't subject to
>> compat-level macro munging.
> 
> Why worry about it? We already do that additional
> 
> 	SET_PERSONALITY(loc->elf_ex);
> 
> _after_ the flush_old_exec() call anyway in fs/binfmt_elf.c.
> 
> So why not just simply remove the whole early SET_PERSONALITY thing, and 
> only keep that later one? The comment about "lookup of the interpreter" is 
> known to be irrelevant these days, so why don't we just remove it all?
> 
> I have _not_ tested any of this, and maybe there is some crazy reason why 
> this won't work, but I'm not seeing it.
> 
> I think we do have to do that "task_size" thing (which flush_old_exec() 
> also does), because it depends on the personality exactly the same way 
> STACK_TOP does. But why isn't the following patch "obviously correct"?
> 

I was worrying about the use of TASK_SIZE, but I don't see any obvious
uses of it downstream in flush_old_exec() before we return.

So this patch, *plus* removing any delayed side effects from
SET_PERSONALITY() [e.g. the TIF_ABI_PENDING stuff in x86-64 which is
intended to have a forward action from SET_PERSONALITY() to
flush_thread()] might just work.  I will try it out.

	-hpa

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>