All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
	Andy Lutomirski <luto@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	linux-kernel <linux-kernel@vger.kernel.org>,
	linux-api <linux-api@vger.kernel.org>,
	Peter Zijlstra <peterz@infradead.org>,
	"Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
	Boqun Feng <boqun.feng@gmail.com>,
	Dave Watson <davejwatson@fb.com>, Paul Turner <pjt@google.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Russell King <linux@arm.linux.org.uk>,
	Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
	Andi Kleen <andi@firstfloor.org>, Chris Lameter <cl@linux.com>,
	Ben Maurer <bmaurer@fb.com>, rostedt <rostedt@goodmis.org>,
	Josh Triplett <josh@joshtriplett.org>,
	Catalin Marinas <catalin.marinas@arm.com>Will Deacon <w>
Subject: Re: [RFC PATCH for 4.18 1/2] rseq: validate rseq_cs fields are < TASK_SIZE
Date: Mon, 2 Jul 2018 15:00:15 -0400 (EDT)	[thread overview]
Message-ID: <84003252.10754.1530558015813.JavaMail.zimbra@efficios.com> (raw)
In-Reply-To: <CALCETrVeu_V-3K8OfKv9QixrWBJs+q866yb=e96sC76SS4hxYg@mail.gmail.com>

----- On Jul 2, 2018, at 1:11 PM, Andy Lutomirski luto@amacapital.net wrote:
> 
> But I think that the limited solution of changing
> instruction_pointer_set() really is a sufficient
> architecture-dependent change to fully solve your problem.

So let me recap with the changes I gather for 4.18 and 4.19:

4.18:

* Change struct rseq_cs field types from LINUX_FIELD_u32_u64() to __u64 in
  uapi/linux/rseq.h,
* Compare rseq->rseq_cs->abort_ip with TASK_SIZE before using it. Kill offending
  process if its value is over TASK_SIZE,
* Explicitly check that padding of rseq->rseq_cs is zero on 32-bit kernels
  (#ifndef __LP64__).

4.19:

* Introduce instruction_pointer_set() with input validation, use it when setting
  IP to abort_ip in rseq. This replaces the comparison of abort_ip with TASK_SIZE.

Is that consistent with what you have in mind ?

Thanks,

Mathieu

-- 
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com

WARNING: multiple messages have this Message-ID (diff)
From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
	Andy Lutomirski <luto@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	linux-kernel <linux-kernel@vger.kernel.org>,
	linux-api <linux-api@vger.kernel.org>,
	Peter Zijlstra <peterz@infradead.org>,
	"Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
	Boqun Feng <boqun.feng@gmail.com>,
	Dave Watson <davejwatson@fb.com>, Paul Turner <pjt@google.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Russell King <linux@arm.linux.org.uk>,
	Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
	Andi Kleen <andi@firstfloor.org>, Chris Lameter <cl@linux.com>,
	Ben Maurer <bmaurer@fb.com>, rostedt <rostedt@goodmis.org>,
	Josh Triplett <josh@joshtriplett.org>,
	Catalin Marinas <catalin.marinas@arm.com>,
	Will Deacon <will.deacon@arm.com>,
	Michael Kerrisk <mtk.manpages@gmail.com>,
	Joel Fernandes <joelaf@google.com>
Subject: Re: [RFC PATCH for 4.18 1/2] rseq: validate rseq_cs fields are < TASK_SIZE
Date: Mon, 2 Jul 2018 15:00:15 -0400 (EDT)	[thread overview]
Message-ID: <84003252.10754.1530558015813.JavaMail.zimbra@efficios.com> (raw)
In-Reply-To: <CALCETrVeu_V-3K8OfKv9QixrWBJs+q866yb=e96sC76SS4hxYg@mail.gmail.com>

----- On Jul 2, 2018, at 1:11 PM, Andy Lutomirski luto@amacapital.net wrote:
> 
> But I think that the limited solution of changing
> instruction_pointer_set() really is a sufficient
> architecture-dependent change to fully solve your problem.

So let me recap with the changes I gather for 4.18 and 4.19:

4.18:

* Change struct rseq_cs field types from LINUX_FIELD_u32_u64() to __u64 in
  uapi/linux/rseq.h,
* Compare rseq->rseq_cs->abort_ip with TASK_SIZE before using it. Kill offending
  process if its value is over TASK_SIZE,
* Explicitly check that padding of rseq->rseq_cs is zero on 32-bit kernels
  (#ifndef __LP64__).

4.19:

* Introduce instruction_pointer_set() with input validation, use it when setting
  IP to abort_ip in rseq. This replaces the comparison of abort_ip with TASK_SIZE.

Is that consistent with what you have in mind ?

Thanks,

Mathieu

-- 
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com

  reply	other threads:[~2018-07-02 19:00 UTC|newest]

Thread overview: 62+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-06-28 16:23 [RFC PATCH for 4.18 1/2] rseq: validate rseq_cs fields are < TASK_SIZE Mathieu Desnoyers
2018-06-28 16:23 ` Mathieu Desnoyers
2018-06-28 16:23 ` [RFC PATCH for 4.18 2/2] rseq: check that rseq->rseq_cs padding is zero Mathieu Desnoyers
2018-06-28 16:23   ` Mathieu Desnoyers
2018-06-28 16:53   ` Will Deacon
2018-06-28 16:53     ` Will Deacon
2018-06-28 20:55     ` Mathieu Desnoyers
2018-06-28 20:55       ` Mathieu Desnoyers
2018-06-28 20:22 ` [RFC PATCH for 4.18 1/2] rseq: validate rseq_cs fields are < TASK_SIZE Andy Lutomirski
2018-06-28 20:22   ` Andy Lutomirski
2018-06-28 20:56   ` Mathieu Desnoyers
2018-06-28 20:56     ` Mathieu Desnoyers
2018-06-28 21:22   ` Linus Torvalds
2018-06-28 21:22     ` Linus Torvalds
2018-06-28 22:29     ` Mathieu Desnoyers
2018-06-28 22:29       ` Mathieu Desnoyers
2018-06-28 23:29     ` Andy Lutomirski
2018-06-28 23:29       ` Andy Lutomirski
2018-06-29  0:18       ` Linus Torvalds
2018-06-29  0:18         ` Linus Torvalds
2018-06-29  0:54         ` Mathieu Desnoyers
2018-06-29  0:54           ` Mathieu Desnoyers
2018-06-29  1:08         ` Andy Lutomirski
2018-06-29  1:08           ` Andy Lutomirski
2018-06-29 14:02           ` Linus Torvalds
2018-06-29 14:02             ` Linus Torvalds
2018-06-29 14:05             ` Mathieu Desnoyers
2018-06-29 14:05               ` Mathieu Desnoyers
2018-06-29 14:17               ` Linus Torvalds
2018-06-29 14:17                 ` Linus Torvalds
2018-06-29 15:03                 ` Mathieu Desnoyers
2018-06-29 15:03                   ` Mathieu Desnoyers
     [not found]                   ` <CA+55aFw==YnFJn7iGnKMW=RbPT74YHNa0QDF96mEdMPA2oX9SA@mail.gmail.com>
2018-06-29 15:54                     ` Linus Torvalds
2018-06-29 15:54                       ` Linus Torvalds
2018-06-29 16:07                       ` Mathieu Desnoyers
2018-06-29 16:07                         ` Mathieu Desnoyers
2018-06-29 17:03                         ` Linus Torvalds
2018-06-29 17:03                           ` Linus Torvalds
2018-06-29 19:48                           ` Mathieu Desnoyers
2018-06-29 19:48                             ` Mathieu Desnoyers
2018-06-29 20:39                             ` Andy Lutomirski
2018-06-29 20:39                               ` Andy Lutomirski
2018-07-02 14:32                               ` Mathieu Desnoyers
2018-07-02 14:32                                 ` Mathieu Desnoyers
2018-07-02 16:04                                 ` Mathieu Desnoyers
2018-07-02 16:04                                   ` Mathieu Desnoyers
2018-07-02 17:11                                 ` Andy Lutomirski
2018-07-02 17:11                                   ` Andy Lutomirski
2018-07-02 19:00                                   ` Mathieu Desnoyers [this message]
2018-07-02 19:00                                     ` Mathieu Desnoyers
2018-07-02 19:02                                     ` Andy Lutomirski
2018-07-02 19:02                                       ` Andy Lutomirski
2018-07-02 19:31                                       ` Linus Torvalds
2018-07-02 19:31                                         ` Linus Torvalds
2018-07-02 20:12                                         ` Andy Lutomirski
2018-07-02 20:12                                           ` Andy Lutomirski
2018-07-02 20:22                                           ` Linus Torvalds
2018-07-02 20:22                                             ` Linus Torvalds
2018-06-29 16:07                     ` Andy Lutomirski
2018-06-29 16:07                       ` Andy Lutomirski
2018-06-29 13:55       ` Mathieu Desnoyers
2018-06-29 13:55         ` Mathieu Desnoyers

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=84003252.10754.1530558015813.JavaMail.zimbra@efficios.com \
    --to=mathieu.desnoyers@efficios.com \
    --cc=akpm@linux-foundation.org \
    --cc=andi@firstfloor.org \
    --cc=bmaurer@fb.com \
    --cc=boqun.feng@gmail.com \
    --cc=catalin.marinas@arm.com \
    --cc=cl@linux.com \
    --cc=davejwatson@fb.com \
    --cc=hpa@zytor.com \
    --cc=josh@joshtriplett.org \
    --cc=linux-api@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@arm.linux.org.uk \
    --cc=luto@amacapital.net \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=paulmck@linux.vnet.ibm.com \
    --cc=peterz@infradead.org \
    --cc=pjt@google.com \
    --cc=rostedt@goodmis.org \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.