Re: [PATCH 4/4] arm64/syscalls: Move address limit check in loop

Path	csiph.com!news.redatomik.org!aioe.org!bofh.it!news.nic.it!robomod
From	Will Deacon <will.deacon@arm.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH 4/4] arm64/syscalls: Move address limit check in loop
Date	Tue, 12 Sep 2017 20:30:02 +0200
Message-ID	<uoY6B-4Pg-5@gated-at.bofh.it> (permalink)
References	<un74l-1Wq-7@gated-at.bofh.it> <un74m-1Wq-21@gated-at.bofh.it>
X-Original-To	Kees Cook <keescook@chromium.org>
MIME-Version	1.0
Content-Type	text/plain; charset=us-ascii
Content-Disposition	inline
User-Agent	Mutt/1.5.23 (2014-03-12)
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	26
Organization	linux.* mail to news gateway
X-Original-Cc	Ingo Molnar <mingo@kernel.org>, Thomas Garnier <thgarnie@google.com>, Thomas Gleixner <tglx@linutronix.de>, Russell King <linux@armlinux.org.uk>, Catalin Marinas <catalin.marinas@arm.com>, Andy Lutomirski <luto@amacapital.net>, Will Drewry <wad@chromium.org>, Al Viro <viro@zeniv.linux.org.uk>, Dave Martin <Dave.Martin@arm.com>, Pratyush Anand <panand@redhat.com>, Dave Hansen <dave.hansen@intel.com>, Arnd Bergmann <arnd@arndb.de>, David Howells <dhowells@redhat.com>, Yonghong Song <yhs@fb.com>, linux-arm-kernel@lists.infradead.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org
X-Original-Date	Tue, 12 Sep 2017 19:27:28 +0100
X-Original-Message-ID	<20170912182727.GB27652@arm.com>
X-Original-References	<1504798247-48833-1-git-send-email-keescook@chromium.org> <1504798247-48833-5-git-send-email-keescook@chromium.org>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1731147

Show key headers only | View raw

Hi Kees,

On Thu, Sep 07, 2017 at 08:30:47AM -0700, Kees Cook wrote:
> From: Thomas Garnier <thgarnie@google.com>
> 
> A bug was reported on ARM where set_fs might be called after it was
> checked on the work pending function. ARM64 is not affected by this bug
> but has a similar construct. In order to avoid any similar problems in
> the future, the addr_limit_user_check function is moved at the beginning
> of the loop.
> 
> Fixes: cf7de27ab351 ("arm64/syscalls: Check address limit on user-mode return")
> Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
> Signed-off-by: Thomas Garnier <thgarnie@google.com>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
>  arch/arm64/kernel/signal.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)

What's the plan for this series? It looks like somehow an old v2 of the
original series made it into mainline, so I'd like to see these fixes get
in ASAP. I'm still slightly nervous about pathological setting of the
FSCHECK flag due to e.g. a PMU IRQ causing a livelock in do_notify_resume,
but that's at least less likely with this fix :/

Will

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

Re: [PATCH 4/4] arm64/syscalls: Move address limit check in loop Will Deacon <will.deacon@arm.com> - 2017-09-12 20:30 +0200

csiph-web