From: Linus Torvalds <torvalds@linux-foundation.org>
To: Kyle Huey <me@kylehuey.com>
Cc: Andy Lutomirski <luto@amacapital.net>,
Thomas Gleixner <tglx@linutronix.de>,
Andy Lutomirski <luto@kernel.org>,
Gabriel Krisman Bertazi <krisman@collabora.com>,
open list <linux-kernel@vger.kernel.org>,
"Robert O'Callahan" <rocallahan@gmail.com>
Subject: Re: [REGRESSION] x86/entry: TIF_SINGLESTEP handling is still broken
Date: Sun, 31 Jan 2021 15:35:22 -0800 [thread overview]
Message-ID: <CAHk-=wgqRgk0hjvpjHNixK7xSOS_F3fpt3bL9ZUJVhCL3oGgyw@mail.gmail.com> (raw)
In-Reply-To: <CAP045ApWnr=UQrBrv3fHj-C6EweukMWEyrCgsiY6Bt_i1Vdj6A@mail.gmail.com>
On Sun, Jan 31, 2021 at 3:18 PM Kyle Huey <me@kylehuey.com> wrote:
>
> The key to triggering this bug is to enter a ptrace syscall stop and
> then use PTRACE_SINGLESTEP to exit it. On a good kernel this will not
> result in any userspace code execution in the tracee because on the
> way out of the kernel's syscall handling path the singlestep trap will
> be raised immediately. On a bad kernel that stop will not be raised,
> and in the example below, the program will crash.
Thanks, great explanation, and I can certainly see the behavior you mention.
I wonder if the simple solution is to just
(a) always set one of the SYSCALL_WORK_EXIT bits on the child in
ptrace (exactly to catch the child on system call exit)
(b) basically revert 299155244770 ("entry: Drop usage of TIF flags in
the generic syscall code") and have the syscall exit code check the
TIF_SINGLESTEP flag
Hmm?
Linus
next prev parent reply other threads:[~2021-01-31 23:38 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-31 1:32 [REGRESSION] x86/entry: TIF_SINGLESTEP handling is still broken Kyle Huey
2021-01-31 1:55 ` Linus Torvalds
2021-01-31 2:50 ` Kyle Huey
2021-01-31 18:54 ` Yuxuan Shui
2021-01-31 20:10 ` Linus Torvalds
2021-01-31 20:20 ` Gabriel Krisman Bertazi
2021-01-31 21:21 ` Linus Torvalds
2021-01-31 21:30 ` Linus Torvalds
2021-01-31 22:04 ` Andy Lutomirski
2021-01-31 22:08 ` Kyle Huey
2021-01-31 22:20 ` Andy Lutomirski
2021-01-31 22:27 ` Kyle Huey
2021-01-31 23:17 ` Kyle Huey
2021-01-31 23:35 ` Linus Torvalds [this message]
2021-01-31 23:55 ` Linus Torvalds
2021-02-03 18:00 ` [PATCH] entry: Fix missed trap after single-step on system call return Gabriel Krisman Bertazi
2021-02-03 18:10 ` Linus Torvalds
2021-02-03 18:18 ` Andy Lutomirski
2021-02-03 18:22 ` Linus Torvalds
2021-02-03 18:11 ` Kyle Huey
2021-02-03 23:55 ` Kyle Huey
2021-02-04 17:46 ` Linus Torvalds
2021-02-05 23:24 ` [tip: core/urgent] entry: Ensure " tip-bot2 for Gabriel Krisman Bertazi
2021-01-31 22:57 ` [REGRESSION] x86/entry: TIF_SINGLESTEP handling is still broken Linus Torvalds
2021-01-31 23:36 ` Andy Lutomirski
2021-01-31 23:39 ` Kyle Huey
2021-01-31 23:40 ` Andy Lutomirski
2021-02-01 2:25 ` Robert O'Callahan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHk-=wgqRgk0hjvpjHNixK7xSOS_F3fpt3bL9ZUJVhCL3oGgyw@mail.gmail.com' \
--to=torvalds@linux-foundation.org \
--cc=krisman@collabora.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=luto@kernel.org \
--cc=me@kylehuey.com \
--cc=rocallahan@gmail.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.