Re: what's papered over by set_fs(USER_DS) in amd64 signal delivery?

Ingo Molnar
2010-09-26T09:13:34Z

* Al Viro <viro@ZenIV.linux.org.uk> wrote:

> [...] IOW, that set_fs() seems to have been useless from the day 1,
> unless I'm missing something really subtle, like e.g. some processes
> deliberately running (in 2.0) with %fs set to something with lower
> limit, with signal handlers allowed to switch back to normal for
> duration. And even that would've been broken, since there wouldn't be
> a matching set_fs() in sigreturn()...

I dont recall us ever having done anything particularly 'clever' with
in-kernel set_fs()/restore_fs(). Beyond fork/clone it was always
supposed to be set/restored in a balanced manner. We sometimes leaked it
unintentionally, and those were security holes.

( Cleverness with security primitives was in fact always actively
discouraged, even in the early days, as cleverness has the uncanny
tendency to bit-rot and then has the tendency to slow-convert to a
security hole by stealth. We always wanted obvious, boringly dumb,
fail-safe primitives, which can take a few years of bitrot robustly. )

Thanks,

Ingo