From patchwork Wed Jul 26 17:00:51 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Garnier X-Patchwork-Id: 9865417 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id D1EA0603F9 for ; Wed, 26 Jul 2017 17:01:54 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C58982879C for ; Wed, 26 Jul 2017 17:01:54 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B9CE0287A2; Wed, 26 Jul 2017 17:01:54 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id CA1382879C for ; Wed, 26 Jul 2017 17:01:53 +0000 (UTC) Received: (qmail 30691 invoked by uid 550); 26 Jul 2017 17:01:40 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 30568 invoked from network); 26 Jul 2017 17:01:38 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=DtWPYw73LKJB7rLDHlgzB0R3cLtrTH1Vet0Nx1Tfang=; b=IhMAIA9CzVFPWapYu4sRiYpYsu0zAWOpoNVQWnQ1rpOLXV3GQ3JNR64Ofla9N8M0tW So3dY6d/3JtOIoavDiG/VrwipHQuoA55d3+cPhH/jCejYhS6RjH3Ws7ZIhbbyNu0gEAP VY8GCXT46CltjVVZjQovHFBZdxPKVbqdguU5lH3XOMfboL8RIdG3t9mu0G+qmuMKlnba NWcyJodjAhc4pvPepviSEgCRopwvpfjrsEEqbGyiKVwDBig7YakioT8oqqQvEs9Sx7A/ umHCLhF9LSZggNrzlugYZEIIduGiTbT2Mlla1fy8w6XyhsD1UdyQuKMz0KuYX2Uw5qZU 16hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=DtWPYw73LKJB7rLDHlgzB0R3cLtrTH1Vet0Nx1Tfang=; b=SbBZ4Vnc3UokRe/fpfM4N+618SVgSTt+BbXc3IQh/d1gKpa3sEPRd4pLUmTlHy9C4O I9XS4PfG5I+EEjQeS0N08nE534/R4ZopiSIyVuS0KYuFNcwi/X0os258gAsMBAg1tCks NlNxB7kvxHoGfVNeaQXo9gKlcTZdMjqB7Nk1Z/4QMcItqqoLb+hbqTMPnq326V0q0C5k 36OhREne7E+s+v1H6zEwJCIES6KhH78cLrUe/fx7mTkXetKC7/H6jyeXuO+oB3JFWJfc Q8+CyFCKWg4A3GyzJ3D7HS1Rlu2u56KMpUmQq1fgl21WP0ikh9YD/cjcuGbmZExJRanb h2Dg== X-Gm-Message-State: AIVw111bx5Dno5VkuRTlYnGL1xZ7/lsA+k3v35eUDxIqVsptBXSB5Dag sTselLY5qMm41Tv2 X-Received: by 10.99.107.70 with SMTP id g67mr1463252pgc.426.1501088486106; Wed, 26 Jul 2017 10:01:26 -0700 (PDT) From: Thomas Garnier To: Russell King , Kees Cook , Andy Lutomirski , Will Drewry , Thomas Garnier , Thomas Gleixner , Al Viro , Dave Martin , Catalin Marinas , Will Deacon , Pratyush Anand , Chris Metcalf , leonard.crestez@nxp.com Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Date: Wed, 26 Jul 2017 10:00:51 -0700 Message-Id: <20170726170051.28328-3-thgarnie@google.com> X-Mailer: git-send-email 2.14.0.rc0.400.g1c36432dff-goog In-Reply-To: <20170726170051.28328-1-thgarnie@google.com> References: <20170726170051.28328-1-thgarnie@google.com> Subject: [kernel-hardening] [PATCH v2 3/3] arm64/syscalls: Move address limit check in loop X-Virus-Scanned: ClamAV using ClamSMTP A bug was reported on ARM where set_fs might be called after it was checked on the work pending function. ARM64 is not affected by this bug but has a similar construct. In order to avoid any similar problems in the future, the addr_limit_user_check function is moved at the beginning of the loop. Fixes: cf7de27ab351 ("arm64/syscalls: Check address limit on user-mode return") Reported-by: Leonard Crestez Signed-off-by: Thomas Garnier --- arch/arm64/kernel/signal.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index e3e3293d1123..8e2705983e1d 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -751,10 +751,10 @@ asmlinkage void do_notify_resume(struct pt_regs *regs, */ trace_hardirqs_off(); - /* Check valid user FS if needed */ - addr_limit_user_check(); - do { + /* Check valid user FS if needed */ + addr_limit_user_check(); + if (thread_flags & _TIF_NEED_RESCHED) { schedule(); } else {