Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1408349

Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer, courtesy of the glibc testsuite

Show all headers | View raw

From: Nick Alcock <nix@esperi.org.uk>
Date: Fri, 27 May 2016 22:44:56 +0100

> Good move. Segfaulting the process is fine! :) Any process that does
> this sort of thing is clearly either terminally buggy, written by an
> idiot who doesn't know what he's doing (i.e. my original patch) or
> malicious. These all deserve SEGVs.
> 
> (I still don't understand why this leads to spurious TLB faults, though.
> Filling the userland CPU registers with garbage is bad, but should still
> be reasonably harmless to the kernel, surely?)

I'm trying to figure out the same thing myself.

Even the unaligned stack pointer should be gracefully handled by the
kernel, so I think it has to be some other element of the register
state restore sequence.

The one area that deserves auditing is %tstate.  This is a privileged
register which we treat partially as non-privileged.  Specifically we
allow the user to modify the condition codes and the %asi register
which is encoded into here.

But I just went over that a few times.  We are really careful to mask
and only change those specific fields.

I'll keep plugging away at this and also play with your patches to
reproduce the bug.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer, courtesy of the glibc testsuite Nick Alcock <nix@esperi.org.uk> - 2016-05-27 13:30 +0200
  [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer, courtesy of the glibc testsuite Nick Alcock <nix@esperi.org.uk> - 2016-05-27 15:20 +0200
    Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged  panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer,  courtesy of the glibc testsuite John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> - 2016-05-27 15:40 +0200
      Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer, courtesy of the glibc testsuite Nick Alcock <nix@esperi.org.uk> - 2016-05-27 15:50 +0200
    Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged  panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer,  courtesy of the glibc testsuite David Miller <davem@davemloft.net> - 2016-05-27 21:40 +0200
      Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer, courtesy of the glibc testsuite Nick Alcock <nix@esperi.org.uk> - 2016-05-27 23:50 +0200
        Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged  panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer,  courtesy of the glibc testsuite David Miller <davem@davemloft.net> - 2016-05-28 01:00 +0200
          Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged  panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer,  courtesy of the glibc testsuite David Miller <davem@davemloft.net> - 2016-05-29 06:30 +0200
            Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged  panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer,  courtesy of the glibc testsuite Sam Ravnborg <sam@ravnborg.org> - 2016-05-29 19:40 +0200
              Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged  panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer,  courtesy of the glibc testsuite David Miller <davem@davemloft.net> - 2016-05-30 04:20 +0200
    Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged  panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer,  courtesy of the glibc testsuite David Miller <davem@davemloft.net> - 2016-05-29 08:10 +0200
      Re: [4.1.x -- 4.6.x and probably HEAD] Reproducible unprivileged panic/TLB BUG on sparc via a stack-protected rt_sigaction() ka_restorer, courtesy of the glibc testsuite Nix <nix@esperi.org.uk> - 2016-05-30 14:50 +0200

csiph-web