From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mathieu Desnoyers Subject: Re: [RFC PATCH for 4.18 1/2] rseq: validate rseq_cs fields are < TASK_SIZE Date: Fri, 29 Jun 2018 11:03:42 -0400 (EDT) Message-ID: <729451355.9702.1530284622326.JavaMail.zimbra@efficios.com> References: <20180628162359.9054-1-mathieu.desnoyers@efficios.com> <9200ED2A-AE4B-4094-81C9-E92240B4840F@amacapital.net> <1706339668.9644.1530281144560.JavaMail.zimbra@efficios.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Linus Torvalds Cc: Andy Lutomirski , Andy Lutomirski , Thomas Gleixner , linux-kernel , linux-api , Peter Zijlstra , "Paul E. McKenney" , Boqun Feng , Dave Watson , Paul Turner , Andrew Morton , Russell King , Ingo Molnar , "H. Peter Anvin" , Andi Kleen , Chris Lameter , Ben Maurer , rostedt , Josh Triplett , Catalin Marinas , Will Deacon List-Id: linux-api@vger.kernel.org ----- On Jun 29, 2018, at 10:17 AM, Linus Torvalds torvalds@linux-foundation.org wrote: > On Fri, Jun 29, 2018 at 7:05 AM Mathieu Desnoyers > wrote: >> >> What I'm worried about is setting regs->ip of a compat 32-bit task to >> addresses in the range 0x100000000-0xFFFFFFFFFFFFFFFF. > > Well, they won't have anything mapped in that range, so it really > shouldn't matter. It appears that arm64 simply clears the top bits of regs->ip when returning to 32-bit compat userspace. So this would be inconsistent between 32-bit kernel and 64-bit kernel with a 32-bit compat task: a 32-bit kernel would kill the process, but a 64-bit kernel would silently clear the top bits. Considering those inconsistencies between architectures (either the task gets killed, or the top bits are silently cleared), I'm very much tempted to be restrictive in the inputs accepted by rseq, and not rely on architectures as providing consistent validation of the return IP. Thoughts ? Thanks, Mathieu -- Mathieu Desnoyers EfficiOS Inc. http://www.efficios.com