All of lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas Gleixner <tglx@linutronix.de>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Dmitry Vyukov <dvyukov@google.com>,
	Andrey Ryabinin <ryabinin.a.a@gmail.com>,
	Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
	Andy Lutomirski <luto@kernel.org>, Borislav Petkov <bp@alien8.de>,
	Denys Vlasenko <dvlasenk@redhat.com>,
	"x86@kernel.org" <x86@kernel.org>,
	LKML <linux-kernel@vger.kernel.org>,
	Kostya Serebryany <kcc@google.com>,
	Alexander Potapenko <glider@google.com>,
	Andrey Konovalov <andreyknvl@google.com>,
	Sasha Levin <sasha.levin@oracle.com>,
	Andi Kleen <ak@linux.intel.com>,
	kasan-dev <kasan-dev@googlegroups.com>
Subject: Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan()
Date: Wed, 30 Sep 2015 10:07:58 +0200 (CEST)	[thread overview]
Message-ID: <alpine.DEB.2.11.1509300958480.4500@nanos> (raw)
In-Reply-To: <CALCETrWWsFB+aWKhadoaftNNjU=gRa15+7PXOR=3yrVzXuar6w@mail.gmail.com>

On Tue, 29 Sep 2015, Andy Lutomirski wrote:
> I'm be vaguely amazed if this isn't an exploitable info leak even
> without the out of bounds thing.

The info leak happens in fs/proc, where we happily print arbitrary
"IP" values, if we cant resolve a symbol.

> Can we really not find a way to do this without walking the stack?

We would have to add a 'store wait channel' mechanism to all functions
which are the primary entry points to scheduling. Not impossible, but
not pretty either.

If we want to prevent the stack changing under us, we'd need to take
p->pi_lock and do the task != RUNNING check and the walk under it. I
don't think we want to do that, unless there is a compelling reason to
do so.

Thanks,

	tglx




      parent reply	other threads:[~2015-09-30  8:08 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-09-28  9:00 [PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov
2015-09-28  9:37 ` Borislav Petkov
2015-09-28  9:49   ` Dmitry Vyukov
2015-09-28 10:23     ` Borislav Petkov
2015-09-28 10:33       ` Dmitry Vyukov
2015-09-28 10:51         ` Borislav Petkov
2015-09-28  9:54   ` Dmitry Vyukov
2015-09-28 10:32     ` Borislav Petkov
2015-09-28 15:40 ` Andrey Ryabinin
2015-09-28 16:08   ` Dmitry Vyukov
2015-09-28 16:32     ` Thomas Gleixner
2015-09-29 18:15       ` Andy Lutomirski
2015-09-29 18:30         ` Andy Lutomirski
2015-09-29 18:41           ` Borislav Petkov
2015-09-30  7:15         ` [PATCH] fs/proc: Don't expose absolute kernel addresses via wchan Ingo Molnar
2015-09-30  7:35           ` Thomas Gleixner
2015-09-30 13:59             ` [PATCH v2] " Ingo Molnar
2015-09-30 20:36               ` Thomas Gleixner
2015-09-30 21:21               ` Kees Cook
2015-09-30 21:38                 ` Thomas Gleixner
2015-10-01  7:57                 ` [PATCH v3] fs/proc, core/debug: " Ingo Molnar
2015-10-01  8:57                   ` Andrey Ryabinin
2015-10-01  9:29                     ` Ingo Molnar
2015-10-01 10:16                       ` Andrey Ryabinin
2015-10-01 10:39                         ` Ingo Molnar
2015-10-01 10:47                           ` Andrey Ryabinin
2015-10-01 10:57                             ` [PATCH v5] " Ingo Molnar
2015-10-01  9:37                   ` [PATCH v4] " Ingo Molnar
2015-10-01 12:49               ` [tip:core/debug] fs/proc, core/debug: Don' t " tip-bot for Ingo Molnar
2015-09-30  8:07         ` Thomas Gleixner [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.DEB.2.11.1509300958480.4500@nanos \
    --to=tglx@linutronix.de \
    --cc=ak@linux.intel.com \
    --cc=andreyknvl@google.com \
    --cc=bp@alien8.de \
    --cc=dvlasenk@redhat.com \
    --cc=dvyukov@google.com \
    --cc=glider@google.com \
    --cc=hpa@zytor.com \
    --cc=kasan-dev@googlegroups.com \
    --cc=kcc@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=ryabinin.a.a@gmail.com \
    --cc=sasha.levin@oracle.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.