Messages in this thread | | | Date | Tue, 12 Dec 2017 19:09:18 +0100 | From | Peter Zijlstra <> | Subject | Re: [patch 11/16] x86/ldt: Force access bit for CS/SS |
| |
On Tue, Dec 12, 2017 at 10:03:02AM -0800, Andy Lutomirski wrote: > On Tue, Dec 12, 2017 at 9:32 AM, Thomas Gleixner <tglx@linutronix.de> wrote:
> > @@ -171,6 +172,9 @@ static void exit_to_usermode_loop(struct > > /* Disable IRQs and retry */ > > local_irq_disable(); > > > > + if (cached_flags & _TIF_LDT) > > + ldt_exit_user(regs); > > Nope. To the extent that this code actually does anything (which it > shouldn't since you already forced the access bit),
Without this; even with the access bit set; IRET will go wobbly and we'll #GP on the user-space side. Try it ;-)
> it's racy against > flush_ldt() from another thread, and that race will be exploitable for > privilege escalation. It needs to be outside the loopy part.
The flush_ldt (__ldt_install after these patches) would re-set the TIF flag. But sure, we can move this outside the loop I suppose.
| |