lkml.org 
[lkml]   [2023]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRE: [PATCH 3/3] x86/sigreturn: Reject system segements
    Date


    > -----Original Message-----
    > From: H. Peter Anvin <hpa@zytor.com>
    > Sent: Sunday, December 17, 2023 1:46 PM
    > To: Linus Torvalds <torvalds@linuxfoundation.org>
    > Cc: Brian Gerst <brgerst@gmail.com>; linux-kernel@vger.kernel.org;
    > x86@kernel.org; Ingo Molnar <mingo@kernel.org>; Thomas Gleixner
    > <tglx@linutronix.de>; Borislav Petkov <bp@alien8.de>; Peter Zijlstra
    > <peterz@infradead.org>; Michal Luczaj <mhal@rbox.co>
    > Subject: Re: [PATCH 3/3] x86/sigreturn: Reject system segements
    >
    > On December 17, 2023 1:40:53 PM PST, Linus Torvalds
    > <torvalds@linuxfoundation.org> wrote:
    > >On Sun, 17 Dec 2023 at 13:08, H. Peter Anvin <hpa@zytor.com> wrote:
    > >>
    > >> On December 13, 2023 10:54:00 AM PST, Linus Torvalds
    > <torvalds@linuxfoundation.org> wrote:
    > >]> >Side note: the SS/CS checks could be stricter than the usual selector tests.
    > >> >
    > >> >In particular, normal segments can be Null segments. But CS/SS must not be.
    > >> >
    > >> >Also, since you're now checking the validity, maybe we shouldn't do
    > >> >the "force cpl3" any more, and just make it an error to try to load
    > >> >a
    > >> >non-cpl3 segment at sigreturn..
    > >> >
    > >> >That forcing was literally just because we weren't checking it for sanity...
    > >> >
    > >> > Linus
    > >>
    > >> Not to mention that changing a null descriptor to 3 is wrong.
    > >
    > >I don't think it is. All of 0-3 are "Null selectors". The RPL of the
    > >selector simply doesn't matter when the index is zero, afaik.
    > >
    > >But we obviously only do this for CS/SS, which can't be (any kind of)
    > >Null selector and iret will GP on them regardless of the RPL in the
    > >selector.
    > >
    > > Linus
    >
    > Of course not for CS/SS, but I would agree that if the selector is 0 before the
    > signal it shouldn't mysteriously and asynchronously become 3.

    Unfortunately reload_segments() _always_ sets DPL bits of GS/FS/DS/ES
    to 3, even for 0. And IRET clears DPL bits when loading a NULL selector
    into GS/FS/DS/ES:
    https://lore.kernel.org/lkml/20230706052231.2183-1-xin3.li@intel.com/

    Thanks!
    Xin
    \
     
     \ /
      Last update: 2023-12-18 09:32    [W:3.503 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site