From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757471AbdELIUr (ORCPT ); Fri, 12 May 2017 04:20:47 -0400 Received: from mail-oi0-f67.google.com ([209.85.218.67]:36635 "EHLO mail-oi0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755606AbdELIUo (ORCPT ); Fri, 12 May 2017 04:20:44 -0400 MIME-Version: 1.0 In-Reply-To: <20170512081154.GQ390@ZenIV.linux.org.uk> References: <20170428153213.137279-1-thgarnie@google.com> <20170508073352.caqe3fqf7nuxypgi@gmail.com> <20170508124621.GA20705@kroah.com> <20170509064522.anusoikaalvlux3w@gmail.com> <20170509085659.GA32555@infradead.org> <20170512070012.7dysuhbkcas7ibaj@gmail.com> <20170512071549.GP390@ZenIV.linux.org.uk> <20170512081154.GQ390@ZenIV.linux.org.uk> From: Arnd Bergmann Date: Fri, 12 May 2017 10:20:42 +0200 X-Google-Sender-Auth: BF-s02hLKazpL-m5m6iAL86BV_E Message-ID: Subject: Re: [kernel-hardening] Re: [PATCH v9 1/4] syscalls: Verify address limit before returning to user-mode To: Al Viro Cc: Ingo Molnar , Andy Lutomirski , Christoph Hellwig , Greg KH , Thomas Garnier , Martin Schwidefsky , Heiko Carstens , Dave Hansen , Thomas Gleixner , David Howells , =?UTF-8?Q?Ren=C3=A9_Nyffenegger?= , Andrew Morton , "Paul E . McKenney" , "Eric W . Biederman" , Oleg Nesterov , Pavel Tikhomirov , Ingo Molnar , "H . Peter Anvin" , Paolo Bonzini , Rik van Riel , Kees Cook , Josh Poimboeuf , Borislav Petkov , Brian Gerst , "Kirill A . Shutemov" , Christian Borntraeger , Russell King , Will Deacon , Catalin Marinas , Mark Rutland , James Morse , linux-s390 , LKML , Linux API , "the arch/x86 maintainers" , "linux-arm-kernel@lists.infradead.org" , Kernel Hardening , Linus Torvalds , Peter Zijlstra Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, May 12, 2017 at 10:11 AM, Al Viro wrote: > Anyway, what's special about modules? IDGI... One of the arguments that came up earlier was code in external modules being mostly unaudited, sometimes without any source code available at all but still used in devices. If modules can't do set_fs() any more, this could eliminate bugs with unpaired set_fs in those modules. Limiting factors of course are: - embedded systems that ship come with their own kernels (as opposed to using whatever users have, or relying on binary distros) can just make it available to modules again, by reverting the patch - As Christoph said, they could have an open-coded set_fs in the driver - Whatever other method a clueless driver write might come up with isn't necessarily better than set_fs(). Arnd From mboxrd@z Thu Jan 1 00:00:00 1970 From: Arnd Bergmann Subject: Re: [kernel-hardening] Re: [PATCH v9 1/4] syscalls: Verify address limit before returning to user-mode Date: Fri, 12 May 2017 10:20:42 +0200 Message-ID: References: <20170428153213.137279-1-thgarnie@google.com> <20170508073352.caqe3fqf7nuxypgi@gmail.com> <20170508124621.GA20705@kroah.com> <20170509064522.anusoikaalvlux3w@gmail.com> <20170509085659.GA32555@infradead.org> <20170512070012.7dysuhbkcas7ibaj@gmail.com> <20170512071549.GP390@ZenIV.linux.org.uk> <20170512081154.GQ390@ZenIV.linux.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Return-path: In-Reply-To: <20170512081154.GQ390-3bDd1+5oDREiFSDQTTA3OLVCufUGDwFn@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Al Viro Cc: Ingo Molnar , Andy Lutomirski , Christoph Hellwig , Greg KH , Thomas Garnier , Martin Schwidefsky , Heiko Carstens , Dave Hansen , Thomas Gleixner , David Howells , =?UTF-8?Q?Ren=C3=A9_Nyffenegger?= , Andrew Morton , "Paul E . McKenney" , "Eric W . Biederman" , Oleg Nesterov , Pavel Tikhomirov , Ingo Molnar , "H . Peter Anvin" , Paolo Bonzini , Rik List-Id: linux-api@vger.kernel.org On Fri, May 12, 2017 at 10:11 AM, Al Viro wrote: > Anyway, what's special about modules? IDGI... One of the arguments that came up earlier was code in external modules being mostly unaudited, sometimes without any source code available at all but still used in devices. If modules can't do set_fs() any more, this could eliminate bugs with unpaired set_fs in those modules. Limiting factors of course are: - embedded systems that ship come with their own kernels (as opposed to using whatever users have, or relying on binary distros) can just make it available to modules again, by reverting the patch - As Christoph said, they could have an open-coded set_fs in the driver - Whatever other method a clueless driver write might come up with isn't necessarily better than set_fs(). Arnd From mboxrd@z Thu Jan 1 00:00:00 1970 From: arnd@arndb.de (Arnd Bergmann) Date: Fri, 12 May 2017 10:20:42 +0200 Subject: [kernel-hardening] Re: [PATCH v9 1/4] syscalls: Verify address limit before returning to user-mode In-Reply-To: <20170512081154.GQ390@ZenIV.linux.org.uk> References: <20170428153213.137279-1-thgarnie@google.com> <20170508073352.caqe3fqf7nuxypgi@gmail.com> <20170508124621.GA20705@kroah.com> <20170509064522.anusoikaalvlux3w@gmail.com> <20170509085659.GA32555@infradead.org> <20170512070012.7dysuhbkcas7ibaj@gmail.com> <20170512071549.GP390@ZenIV.linux.org.uk> <20170512081154.GQ390@ZenIV.linux.org.uk> Message-ID: To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Fri, May 12, 2017 at 10:11 AM, Al Viro wrote: > Anyway, what's special about modules? IDGI... One of the arguments that came up earlier was code in external modules being mostly unaudited, sometimes without any source code available at all but still used in devices. If modules can't do set_fs() any more, this could eliminate bugs with unpaired set_fs in those modules. Limiting factors of course are: - embedded systems that ship come with their own kernels (as opposed to using whatever users have, or relying on binary distros) can just make it available to modules again, by reverting the patch - As Christoph said, they could have an open-coded set_fs in the driver - Whatever other method a clueless driver write might come up with isn't necessarily better than set_fs(). Arnd