| Message ID | 1504798247-48833-5-git-send-email-keescook@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Hi Kees, On Thu, Sep 07, 2017 at 08:30:47AM -0700, Kees Cook wrote: > From: Thomas Garnier <thgarnie@google.com> > > A bug was reported on ARM where set_fs might be called after it was > checked on the work pending function. ARM64 is not affected by this bug > but has a similar construct. In order to avoid any similar problems in > the future, the addr_limit_user_check function is moved at the beginning > of the loop. > > Fixes: cf7de27ab351 ("arm64/syscalls: Check address limit on user-mode return") > Reported-by: Leonard Crestez <leonard.crestez@nxp.com> > Signed-off-by: Thomas Garnier <thgarnie@google.com> > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > arch/arm64/kernel/signal.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) What's the plan for this series? It looks like somehow an old v2 of the original series made it into mainline, so I'd like to see these fixes get in ASAP. I'm still slightly nervous about pathological setting of the FSCHECK flag due to e.g. a PMU IRQ causing a livelock in do_notify_resume, but that's at least less likely with this fix :/ Will
On Tue, Sep 12, 2017 at 11:27 AM, Will Deacon <will.deacon@arm.com> wrote: > Hi Kees, > > On Thu, Sep 07, 2017 at 08:30:47AM -0700, Kees Cook wrote: >> From: Thomas Garnier <thgarnie@google.com> >> >> A bug was reported on ARM where set_fs might be called after it was >> checked on the work pending function. ARM64 is not affected by this bug >> but has a similar construct. In order to avoid any similar problems in >> the future, the addr_limit_user_check function is moved at the beginning >> of the loop. >> >> Fixes: cf7de27ab351 ("arm64/syscalls: Check address limit on user-mode return") >> Reported-by: Leonard Crestez <leonard.crestez@nxp.com> >> Signed-off-by: Thomas Garnier <thgarnie@google.com> >> Signed-off-by: Kees Cook <keescook@chromium.org> >> --- >> arch/arm64/kernel/signal.c | 6 +++--- >> 1 file changed, 3 insertions(+), 3 deletions(-) > > What's the plan for this series? It looks like somehow an old v2 of the > original series made it into mainline, so I'd like to see these fixes get > in ASAP. I'm still slightly nervous about pathological setting of the > FSCHECK flag due to e.g. a PMU IRQ causing a livelock in do_notify_resume, > but that's at least less likely with this fix :/ Hi! I resent this to Ingo to pick up for -tip. I think he's waiting for -rc1, IIUC. Ingo, can you comment on timing for this getting sent to Linus? -Kees
* Kees Cook <keescook@chromium.org> wrote: > On Tue, Sep 12, 2017 at 11:27 AM, Will Deacon <will.deacon@arm.com> wrote: > > Hi Kees, > > > > On Thu, Sep 07, 2017 at 08:30:47AM -0700, Kees Cook wrote: > >> From: Thomas Garnier <thgarnie@google.com> > >> > >> A bug was reported on ARM where set_fs might be called after it was > >> checked on the work pending function. ARM64 is not affected by this bug > >> but has a similar construct. In order to avoid any similar problems in > >> the future, the addr_limit_user_check function is moved at the beginning > >> of the loop. > >> > >> Fixes: cf7de27ab351 ("arm64/syscalls: Check address limit on user-mode return") > >> Reported-by: Leonard Crestez <leonard.crestez@nxp.com> > >> Signed-off-by: Thomas Garnier <thgarnie@google.com> > >> Signed-off-by: Kees Cook <keescook@chromium.org> > >> --- > >> arch/arm64/kernel/signal.c | 6 +++--- > >> 1 file changed, 3 insertions(+), 3 deletions(-) > > > > What's the plan for this series? It looks like somehow an old v2 of the > > original series made it into mainline, so I'd like to see these fixes get > > in ASAP. I'm still slightly nervous about pathological setting of the > > FSCHECK flag due to e.g. a PMU IRQ causing a livelock in do_notify_resume, > > but that's at least less likely with this fix :/ > > Hi! I resent this to Ingo to pick up for -tip. I think he's waiting > for -rc1, IIUC. Ingo, can you comment on timing for this getting sent > to Linus? Will accelerate them - didn't realize the urgency. Thanks, Ingo
diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index c45214f8fb54..0bdc96c61bc0 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -751,10 +751,10 @@ asmlinkage void do_notify_resume(struct pt_regs *regs, */ trace_hardirqs_off(); - /* Check valid user FS if needed */ - addr_limit_user_check(); - do { + /* Check valid user FS if needed */ + addr_limit_user_check(); + if (thread_flags & _TIF_NEED_RESCHED) { schedule(); } else {