From patchwork Wed Jul 19 17:59:00 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Garnier X-Patchwork-Id: 9852921 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4A449602C8 for ; Wed, 19 Jul 2017 17:59:46 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 51B2A286CB for ; Wed, 19 Jul 2017 17:59:46 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 46AD6286CF; Wed, 19 Jul 2017 17:59:46 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 6B379286CB for ; Wed, 19 Jul 2017 17:59:45 +0000 (UTC) Received: (qmail 19920 invoked by uid 550); 19 Jul 2017 17:59:32 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 19760 invoked from network); 19 Jul 2017 17:59:31 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=dFI8/sIJIrksVz/ZnS2pCHBgFXbz5CUM6qpa6hh5liw=; b=l/qrjDpvg+RGm7CkDFrl/qjVvkwlO7sRpFRJ94WR+orhqWGRpZ743Wppx3rkqiEmuu vDyhW3wxIMXRBWvy7irc53v+P6P4kc8vv3koXA4uuSpDu1bPlRzJAe0RiRoKTLl+//9C N++h3VSp1VAFOt0BpwI+BrNywrzhCU/OnDIzjiwUjBrUl1l+KyOTElJUcHd33j+qABJA KTZ9lMhxqoCTRKGhP/r8/YhjvCJnER7ihN/MjCNITdxgU6ZclpY7cn53iOojiowTSZk7 bAIvLxI0PFE+GL7gYNJGdKssJOYllYyN+fQuZF6D5ntwOyj1tx3qDLyM9FdZ7Tu7HVxU 307A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=dFI8/sIJIrksVz/ZnS2pCHBgFXbz5CUM6qpa6hh5liw=; b=YuAD4avNjbgT43kWqos7gZTvZIT/xjvrdU5FskKGtD9zsh3TNbhBckdfi0dfTdZE22 YXYfLAmgsC/yFQRALbOSibZSRgBdcjcErRuFFYTXyH76vzGMWQWY5320t5FHhkSzOLvw m/EUpE0onGUdytX5K+57v3KsUSIqpkntDPKD9YJuPzq8prmi7tbwKRgziGKjj8GtLLL2 Iat8uRxkRpdzvcakgCC4YUSu4/LT1ULG54IJVfbdpsYQMrOWtgZEwBM+CQt2ESuwuOAR MaKcc3G53iaMLhTGE3fadwRMucVbcF0RRaamYQqyXAlZBoSe2WobTAbD/0SKNKdskQZq Ahwg== X-Gm-Message-State: AIVw1110y11JulNYdAw1+DUa8qhRmQ4hXH/ew7QVRpt/oYS+1m0iF5eL 7TnHgYtV3vQYhupH X-Received: by 10.84.164.225 with SMTP id l30mr945637plg.376.1500487159734; Wed, 19 Jul 2017 10:59:19 -0700 (PDT) From: Thomas Garnier To: Russell King , Thomas Garnier , Thomas Gleixner , Catalin Marinas , Will Deacon , Dave Martin , Chris Metcalf , Pratyush Anand , leonard.crestez@nxp.com Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Date: Wed, 19 Jul 2017 10:59:00 -0700 Message-Id: <20170719175900.124074-3-thgarnie@google.com> X-Mailer: git-send-email 2.14.0.rc0.284.gd933b75aa4-goog In-Reply-To: <20170719175900.124074-1-thgarnie@google.com> References: <20170719175900.124074-1-thgarnie@google.com> Subject: [kernel-hardening] [PATCH 3/3] arm64/syscalls: Move address limit check in loop X-Virus-Scanned: ClamAV using ClamSMTP The original bug was reported on arm but I am fixing arm64 too because it has a similar code pattern. The work pending loop can call set_fs after addr_limit_user_check removed the _TIF_FSCHECK flag. To prevent the infinite loop, move the addr_limit_user_check call at the beginning of the loop. Fixes: cf7de27ab351 ("arm64/syscalls: Check address limit on user-mode return") Reported-by: Leonard Crestez Signed-off-by: Thomas Garnier --- arch/arm64/kernel/signal.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index e3e3293d1123..8e2705983e1d 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -751,10 +751,10 @@ asmlinkage void do_notify_resume(struct pt_regs *regs, */ trace_hardirqs_off(); - /* Check valid user FS if needed */ - addr_limit_user_check(); - do { + /* Check valid user FS if needed */ + addr_limit_user_check(); + if (thread_flags & _TIF_NEED_RESCHED) { schedule(); } else {