From: Alan Stern <stern@rowland.harvard.edu>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: linux-usb@vger.kernel.org,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Oliver Neukum <oneukum@suse.com>, <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] signal/usb: Replace kill_pid_info_as_cred with kill_pid_usb_asyncio
Date: Thu, 23 May 2019 14:12:57 -0400 (EDT) [thread overview]
Message-ID: <Pine.LNX.4.44L0.1905231352200.1553-100000@iolanthe.rowland.org> (raw)
In-Reply-To: <87o93ujh0s.fsf@xmission.com>
On Wed, 22 May 2019, Eric W. Biederman wrote:
> Perhaps this will work as a diagram. I don't know if there is a better
> way to say it in my patch description. In struct siginfo there are 3
> fields in fixed positions:
>
> int si_signo;
> int si_errno;
> int si_code;
>
> After that there is a union. The si_signo and si_code fields are
> examined to see which union member is valid (see siginfo_layout).
> In every other case a si_code of SI_ASYNCIO corresponds to
> the the _rt union member which has the fields:
>
> int si_pid;
> int si_uid;
> sigval_t si_sigval;
Yuu mean it's actually a union of structures containing these fields,
not a union of these fields, right?
> However when usb started using SI_ASYNCIO the _sigfault union member
> that (except for special exceptions) only has the field:
>
> void __user *si_addr;
>
> Or in short the relevant piece of the union looks like:
>
> 0 1 2 3 4 5 6 7
> +---+---+---+---+---+---+---+---+
> | si_pid | si_uid |
> +---+---+---+---+---+---+---+---+
> | si_addr | (64bit)
> +---+---+---+---+---+---+---+---+
> | si_addr | (32bit)
> +---+---+---+---+
>
> Which means if siginfo is copied field by field on 32bit everything
> works because si_pid and si_addr are in the same location.
When you say "copied field by field", you mean that the si_pid,
si_uid, and si_sigval values are copied individually?
> Similarly if siginfo is copied field by field on 64bit everything
> works because there is no padding between si_pid and si_uid. So
> copying both of those fields results in the entire si_addr being
> copied.
>
> It is the compat case that gets tricky. Half of the bits are
> zero. If those zero bits show up in bytes 4-7 and the data
> shows up in bytes 0-3 (aka little endian) everything works.
> If those zero bits show in in bytes 0-3 (aka big endian) userspace sees
> a NULL pointer instead of the value it passed.
The problem is that the compat translation layer copies si_pid and
si_uid from the 64-bit kernel structure to the 32-bit user structure.
And since the system is big-endian, the 64-bit si_addr value
has zeros in bytes 0-3. But those zeros are what userspace ends up
seeing in its 32-bit version of si_addr.
So the solution is to store the address in the si_sigval part instead.
Wouldn't it have been easier to have a compat routine somewhere just
do something like:
sinfo->si_pid = (u32) sinfo->si_addr; /* Compensate for USB */
That would work regardless of the endianness, wouldn't it?
> Fixing this while maintaining some modicum of sanity is the tricky bit.
> The interface is made to kill_pid_usb_asyncio is made a sigval_t so the
> standard signal compat tricks can be used. sigval_t is a union of:
>
> int sival_int;
> void __user *sival_ptr;
>
> 0 1 2 3 4 5 6 7
> +---+---+---+---+---+---+---+---+
> | sival_ptr | (64bit)
> +---+---+---+---+---+---+---+---+
> | sival_ptr | (32bit)
> +---+---+---+---+
> | sival_int |
> +---+---+---+---+
>
> The signal code solves the compat issues for sigval_t by storing the
> 32bit pointers in sival_int. So they meaningful bits are guaranteed to
> be in the low 32bits, just like the 32bit sival_ptr.
>
> After a bunch of build BUG_ONs to verify my reasonable assumptions
> of but the siginfo layout are actually true, the code that generates
> the siginfo just copies a sigval_t to si_pid. And assumes the code
> in the usb stack placed the pointer in the proper part of the sigval_t
> when it read the information from userspace.
>
> I don't know if that helps make it easy to understand but I figured I
> would give it a shot.
I think I understand now. Thanks.
Alan
next prev parent reply other threads:[~2019-05-23 18:12 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-08 2:34 [CFT][PATCH] signal/usb: Replace kill_pid_info_as_cred with kill_pid_usb_asyncio Eric W. Biederman
2019-02-08 21:57 ` Alan Stern
2019-05-18 1:38 ` Eric W. Biederman
2019-05-18 15:20 ` Alan Stern
2019-05-18 15:25 ` Eric W. Biederman
2019-05-21 12:40 ` [PATCH] " Eric W. Biederman
2019-05-21 14:02 ` Alan Stern
2019-05-21 14:47 ` Eric W. Biederman
2019-05-21 15:30 ` Alan Stern
2019-05-22 19:02 ` Alan Stern
2019-05-22 21:50 ` Eric W. Biederman
2019-05-23 18:12 ` Alan Stern [this message]
2019-05-23 20:54 ` Eric W. Biederman
2019-06-06 14:27 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.44L0.1905231352200.1553-100000@iolanthe.rowland.org \
--to=stern@rowland.harvard.edu \
--cc=ebiederm@xmission.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=oneukum@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).