Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1426889

the usage of __SYSCALL_MASK in entry_SYSCALL_64/do_syscall_64 is not consistent

Path csiph.com!1.us.feeder.erje.net!feeder.erje.net!2.eu.feeder.erje.net!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod
From Oleg Nesterov <oleg@redhat.com>
Newsgroups linux.kernel
Subject the usage of __SYSCALL_MASK in entry_SYSCALL_64/do_syscall_64 is not consistent
Date Mon, 20 Jun 2016 20:10:02 +0200
Message-ID <rMbO2-3aM-15@gated-at.bofh.it> (permalink)
References <rLlFL-2MV-1@gated-at.bofh.it> <rLTo6-8jU-7@gated-at.bofh.it> <rM0IW-4CS-3@gated-at.bofh.it>
X-Original-To Andy Lutomirski <luto@amacapital.net>
MIME-Version 1.0
Content-Type text/plain; charset=us-ascii
Content-Disposition inline
User-Agent Mutt/1.5.24 (2015-08-30)
X-Scanned-By MIMEDefang 2.68 on 10.5.11.24
X-Greylist Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Mon, 20 Jun 2016 17:53:14 +0000 (UTC)
Sender robomod@news.nic.it
List-ID <linux-kernel.vger.kernel.org>
X-Mailing-List linux-kernel@vger.kernel.org
Approved robomod@news.nic.it
Lines 45
Organization linux.* mail to news gateway
X-Original-Cc Andy Lutomirski <luto@kernel.org>, X86 ML <x86@kernel.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Kees Cook <keescook@chromium.org>, Borislav Petkov <bp@alien8.de>
X-Original-Date Mon, 20 Jun 2016 19:53:11 +0200
X-Original-Message-ID <20160620175311.GA24505@redhat.com>
X-Original-References <94bda8cd5f326ae5591c80fb5d7c1c22624accec.1466244711.git.luto@kernel.org> <20160619211906.GA14712@redhat.com> <CALCETrXsg+5OencMrMrr6qZ8YmYj7UWqeAJMESHa5NqNMfcokg@mail.gmail.com>
X-Original-Sender linux-kernel-owner@vger.kernel.org
Xref csiph.com linux.kernel:1426889

Show key headers only | View raw


On 06/19, Andy Lutomirski wrote:
>
> Something's clearly buggy there,

The usage of __X32_SYSCALL_BIT doesn't look right too. Nothing serious
but still.

Damn, initially I thought I have found the serious bug in entry_64.S
and it took me some time to understand why my exploit doesn't work ;)
So I learned that

	andl    $__SYSCALL_MASK, %eax

in entry_SYSCALL_64_fastpath() zero-extends %rax and thus

	cmpl    $__NR_syscall_max, %eax
	...
	call    *sys_call_table(, %rax, 8)

is correct (rax <= __NR_syscall_max).

OK, so entry_64.S simply "ignores" the upper bits if CONFIG_X86_X32_ABI.
Fine, but this doesn't match the

	if (likely((nr & __SYSCALL_MASK) < NR_syscalls))

check in do_syscall_64(). So this test-case

	#include <stdio.h>

	int main(void)
	{
		// __NR_exit == 0x3c
		asm volatile ("movq $0xFFFFFFFF0000003c, %rax; syscall");

		printf("I didn't exit because I am traced\n");

		return 0;
	}

silently exits if not traced, otherwise it calls printf().

Should we do something or we do not care?

Oleg.

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Andy Lutomirski <luto@kernel.org> - 2016-06-18 12:30 +0200
  Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Pedro Alves <pedro@palves.net> - 2016-06-18 16:00 +0200
    Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Pedro Alves <palves@redhat.com> - 2016-06-18 16:50 +0200
    Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Andy Lutomirski <luto@amacapital.net> - 2016-06-18 19:10 +0200
      Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Andy Lutomirski <luto@amacapital.net> - 2016-06-20 00:20 +0200
        Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Pedro Alves <pedro@palves.net> - 2016-06-20 12:30 +0200
        Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in  ptrace Oleg Nesterov <oleg@redhat.com> - 2016-06-20 18:40 +0200
          Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Andy Lutomirski <luto@amacapital.net> - 2016-06-20 18:50 +0200
            Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in  ptrace Oleg Nesterov <oleg@redhat.com> - 2016-06-20 19:20 +0200
              Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Andy Lutomirski <luto@amacapital.net> - 2016-06-20 19:30 +0200
      Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Pedro Alves <pedro@palves.net> - 2016-06-20 12:10 +0200
        Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Jan Kratochvil <jan.kratochvil@redhat.com> - 2016-06-20 13:20 +0200
  Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Kees Cook <keescook@chromium.org> - 2016-06-18 19:50 +0200
  Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Andy Lutomirski <luto@amacapital.net> - 2016-06-20 00:30 +0200
  Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in  ptrace Oleg Nesterov <oleg@redhat.com> - 2016-06-20 00:30 +0200
    Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in ptrace Andy Lutomirski <luto@amacapital.net> - 2016-06-20 08:20 +0200
      Re: [PATCH] x86/ptrace: Remove questionable TS_COMPAT usage in  ptrace Oleg Nesterov <oleg@redhat.com> - 2016-06-20 18:40 +0200
      the usage of __SYSCALL_MASK in entry_SYSCALL_64/do_syscall_64 is not  consistent Oleg Nesterov <oleg@redhat.com> - 2016-06-20 20:10 +0200
        Re: the usage of __SYSCALL_MASK in entry_SYSCALL_64/do_syscall_64 is  not consistent Kees Cook <keescook@chromium.org> - 2016-06-21 21:10 +0200

csiph-web