From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1754567AbbI3IIz (ORCPT <rfc822;w@1wt.eu>);
	Wed, 30 Sep 2015 04:08:55 -0400
Received: from www.linutronix.de ([62.245.132.108]:58342 "EHLO
	Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1754479AbbI3IIt (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Wed, 30 Sep 2015 04:08:49 -0400
Date: Wed, 30 Sep 2015 10:07:58 +0200 (CEST)
From: Thomas Gleixner <tglx@linutronix.de>
To: Andy Lutomirski <luto@amacapital.net>
cc: Dmitry Vyukov <dvyukov@google.com>,
        Andrey Ryabinin <ryabinin.a.a@gmail.com>,
        Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
        Andy Lutomirski <luto@kernel.org>, Borislav Petkov <bp@alien8.de>,
        Denys Vlasenko <dvlasenk@redhat.com>,
        "x86@kernel.org" <x86@kernel.org>, LKML <linux-kernel@vger.kernel.org>,
        Kostya Serebryany <kcc@google.com>,
        Alexander Potapenko <glider@google.com>,
        Andrey Konovalov <andreyknvl@google.com>,
        Sasha Levin <sasha.levin@oracle.com>, Andi Kleen <ak@linux.intel.com>,
        kasan-dev <kasan-dev@googlegroups.com>
Subject: Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan()
In-Reply-To: <CALCETrWWsFB+aWKhadoaftNNjU=gRa15+7PXOR=3yrVzXuar6w@mail.gmail.com>
Message-ID: <alpine.DEB.2.11.1509300958480.4500@nanos>
References: <1443430839-13225-1-git-send-email-dvyukov@google.com> <CAPAsAGwyUQc6UffyQ=vJSNwOYQWE9XMzK5dT__C4r5_+qEYfHA@mail.gmail.com> <CACT4Y+ZWgVz_4NEJbsZWYBHn91M7UNxMNUk_+SebtOfBAoN_LA@mail.gmail.com> <alpine.DEB.2.11.1509281830160.4500@nanos>
 <CALCETrWWsFB+aWKhadoaftNNjU=gRa15+7PXOR=3yrVzXuar6w@mail.gmail.com>
User-Agent: Alpine 2.11 (DEB 23 2013-08-11)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Linutronix-Spam-Score: -1.0
X-Linutronix-Spam-Level: -
X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required,  ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, 29 Sep 2015, Andy Lutomirski wrote:
> I'm be vaguely amazed if this isn't an exploitable info leak even
> without the out of bounds thing.

The info leak happens in fs/proc, where we happily print arbitrary
"IP" values, if we cant resolve a symbol.

> Can we really not find a way to do this without walking the stack?

We would have to add a 'store wait channel' mechanism to all functions
which are the primary entry points to scheduling. Not impossible, but
not pretty either.

If we want to prevent the stack changing under us, we'd need to take
p->pi_lock and do the task != RUNNING check and the walk under it. I
don't think we want to do that, unless there is a compelling reason to
do so.

Thanks,

	tglx