LKML Archive on lore.kernel.org
 help / color / Atom feed
From: tip-bot for Andy Lutomirski <tipbot@zytor.com>
To: linux-tip-commits@vger.kernel.org
Cc: dvlasenk@redhat.com, bp@alien8.de, oleg@redhat.com,
	fweisbec@gmail.com, riel@redhat.com, vda.linux@googlemail.com,
	keescook@chromium.org, luto@amacapital.net, hpa@zytor.com,
	torvalds@linux-foundation.org, linux-kernel@vger.kernel.org,
	peterz@infradead.org, mingo@kernel.org, brgerst@gmail.com,
	luto@kernel.org, tglx@linutronix.de
Subject: [tip:x86/asm] x86/entry/64/compat: Fix bad fast syscall arg failure path
Date: Tue, 7 Jul 2015 03:49:27 -0700
Message-ID: <tip-5e99cb7c35ca0580da8e892f91c655d35ecf8798@git.kernel.org> (raw)
In-Reply-To: <903010762c07a3d67df914fea2da84b52b0f8f1d.1435952415.git.luto@kernel.org>

Commit-ID:  5e99cb7c35ca0580da8e892f91c655d35ecf8798
Gitweb:     http://git.kernel.org/tip/5e99cb7c35ca0580da8e892f91c655d35ecf8798
Author:     Andy Lutomirski <luto@kernel.org>
AuthorDate: Fri, 3 Jul 2015 12:44:19 -0700
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 7 Jul 2015 10:58:30 +0200

x86/entry/64/compat: Fix bad fast syscall arg failure path

If user code does SYSCALL32 or SYSENTER without a valid stack,
then our attempt to determine the syscall args will result in a
failed uaccess fault.  Previously, we would try to recover by
jumping to the syscall exit code, but we'd run the syscall exit
work even though we never made it to the syscall entry work.

Clean it up by treating the failure path as a non-syscall entry
and exit pair.

This fixes strace's output when running the syscall_arg_fault
test. Without this fix, strace would get out of sync and would
fail to associate syscall entries with syscall exits.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Denys Vlasenko <vda.linux@googlemail.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: paulmck@linux.vnet.ibm.com
Link: http://lkml.kernel.org/r/903010762c07a3d67df914fea2da84b52b0f8f1d.1435952415.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/entry/entry_64.S        |  2 +-
 arch/x86/entry/entry_64_compat.S | 35 +++++++++++++++++++++++++++++++++--
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 3bb2c43..141a5d4 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -613,7 +613,7 @@ ret_from_intr:
 	testb	$3, CS(%rsp)
 	jz	retint_kernel
 	/* Interrupt came from user space */
-retint_user:
+GLOBAL(retint_user)
 	GET_THREAD_INFO(%rcx)
 
 	/* %rcx: thread info. Interrupts are off. */
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index b868cfc..e5ebdd9 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -428,8 +428,39 @@ cstar_tracesys:
 END(entry_SYSCALL_compat)
 
 ia32_badarg:
-	ASM_CLAC
-	movq	$-EFAULT, RAX(%rsp)
+	/*
+	 * So far, we've entered kernel mode, set AC, turned on IRQs, and
+	 * saved C regs except r8-r11.  We haven't done any of the other
+	 * standard entry work, though.  We want to bail, but we shouldn't
+	 * treat this as a syscall entry since we don't even know what the
+	 * args are.  Instead, treat this as a non-syscall entry, finish
+	 * the entry work, and immediately exit after setting AX = -EFAULT.
+	 *
+	 * We're really just being polite here.  Killing the task outright
+	 * would be a reasonable action, too.  Given that the only valid
+	 * way to have gotten here is through the vDSO, and we already know
+	 * that the stack pointer is bad, the task isn't going to survive
+	 * for long no matter what we do.
+	 */
+
+	ASM_CLAC			/* undo STAC */
+	movq	$-EFAULT, RAX(%rsp)	/* return -EFAULT if possible */
+
+	/* Fill in the rest of pt_regs */
+	xorl	%eax, %eax
+	movq	%rax, R11(%rsp)
+	movq	%rax, R10(%rsp)
+	movq	%rax, R9(%rsp)
+	movq	%rax, R8(%rsp)
+	SAVE_EXTRA_REGS
+
+	/* Turn IRQs back off. */
+	DISABLE_INTERRUPTS(CLBR_NONE)
+	TRACE_IRQS_OFF
+
+	/* And exit again. */
+	jmp retint_user
+
 ia32_ret_from_sys_call:
 	xorl	%eax, %eax		/* Do not leak kernel information */
 	movq	%rax, R11(%rsp)

  reply index

Thread overview: 70+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-07-03 19:44 [PATCH v5 00/17] x86: Rewrite exit-to-userspace code Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 01/17] selftests/x86: Add a test for 32-bit fast syscall arg faults Andy Lutomirski
2015-07-07 10:49   ` [tip:x86/asm] x86/entry, " tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 02/17] x86/entry/64/compat: Fix bad fast syscall arg failure path Andy Lutomirski
2015-07-07 10:49   ` tip-bot for Andy Lutomirski [this message]
2015-07-03 19:44 ` [PATCH v5 03/17] uml: Fix do_signal() prototype Andy Lutomirski
2015-07-07 10:49   ` [tip:x86/asm] um: " tip-bot for Ingo Molnar
2015-07-03 19:44 ` [PATCH v5 04/17] context_tracking: Add ct_state and CT_WARN_ON Andy Lutomirski
2015-07-07 10:50   ` [tip:x86/asm] context_tracking: Add ct_state() and CT_WARN_ON() tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 05/17] notifiers: Assert that RCU is watching in notify_die Andy Lutomirski
2015-07-07 10:50   ` [tip:x86/asm] notifiers, RCU: Assert that RCU is watching in notify_die() tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 06/17] x86: Move C entry and exit code to arch/x86/entry/common.c Andy Lutomirski
2015-07-07 10:50   ` [tip:x86/asm] x86/entry: Move C entry and exit code to arch/x86/ entry/common.c tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 07/17] x86/traps: Assert that we're in CONTEXT_KERNEL in exception entries Andy Lutomirski
2015-07-07 10:51   ` [tip:x86/asm] x86/traps, context_tracking: Assert that we' re " tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 08/17] x86/entry: Add enter_from_user_mode and use it in syscalls Andy Lutomirski
2015-07-07 10:51   ` [tip:x86/asm] x86/entry: Add enter_from_user_mode() " tip-bot for Andy Lutomirski
2015-07-14 23:00     ` Frederic Weisbecker
2015-07-14 23:04       ` Andy Lutomirski
2015-07-14 23:28         ` Frederic Weisbecker
2015-12-21 20:50   ` [PATCH v5 08/17] x86/entry: Add enter_from_user_mode " Sasha Levin
2015-12-21 22:44     ` Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 09/17] x86/entry: Add new, comprehensible entry and exit hooks Andy Lutomirski
2015-07-07 10:51   ` [tip:x86/asm] x86/entry: Add new, comprehensible entry and exit handlers written in C tip-bot for Andy Lutomirski
2015-07-14 23:07     ` Frederic Weisbecker
2015-07-15 19:56       ` Linus Torvalds
2015-07-15 20:46         ` Andy Lutomirski
2015-07-15 21:25           ` [PATCH] x86/entry: Fix _TIF_USER_RETURN_NOTIFY check in prepare_exit_to_usermode Andy Lutomirski
2015-07-18  3:25             ` [tip:x86/asm] " tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 10/17] x86/entry/64: Really create an error-entry-from-usermode code path Andy Lutomirski
2015-07-07 10:52   ` [tip:x86/asm] " tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 11/17] x86/entry/64: Migrate 64-bit and compat syscalls to new exit hooks Andy Lutomirski
2015-07-07 10:52   ` [tip:x86/asm] x86/entry/64: Migrate 64-bit and compat syscalls to the new exit handlers and remove old assembly code tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 12/17] x86/asm/entry/64: Save all regs on interrupt entry Andy Lutomirski
2015-07-07 10:52   ` [tip:x86/asm] " tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 13/17] x86/asm/entry/64: Simplify irq stack pt_regs handling Andy Lutomirski
2015-07-07 10:53   ` [tip:x86/asm] x86/asm/entry/64: Simplify IRQ " tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 14/17] x86/asm/entry/64: Migrate error and interrupt exit work to C Andy Lutomirski
2015-07-07 10:53   ` [tip:x86/asm] x86/asm/entry/64: Migrate error and IRQ exit work to C and remove old assembly code tip-bot for Andy Lutomirski
2015-08-11 22:18     ` Frederic Weisbecker
2015-08-11 22:25       ` Andy Lutomirski
2015-08-11 22:49         ` Frederic Weisbecker
2015-08-11 22:59           ` Andy Lutomirski
2015-08-12  1:02             ` Paul E. McKenney
2015-08-12 13:13             ` Frederic Weisbecker
2015-08-11 22:38     ` Frederic Weisbecker
2015-08-11 22:51       ` Andy Lutomirski
2015-08-11 23:22         ` Frederic Weisbecker
2015-08-11 23:33           ` Andy Lutomirski
2015-08-12 13:32             ` Frederic Weisbecker
2015-08-12 14:59               ` Andy Lutomirski
2015-08-18 22:34                 ` Frederic Weisbecker
2015-08-18 22:40                   ` Andy Lutomirski
2015-08-19 17:18                     ` Frederic Weisbecker
2015-08-19 18:02                       ` Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 15/17] x86/entry: Remove exception_enter from most trap handlers Andy Lutomirski
2015-07-07 10:53   ` [tip:x86/asm] x86/entry: Remove exception_enter() " tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 16/17] x86/entry: Remove SCHEDULE_USER and asm/context-tracking.h Andy Lutomirski
2015-07-07 10:54   ` [tip:x86/asm] x86/entry: Remove SCHEDULE_USER and asm/ context-tracking.h tip-bot for Andy Lutomirski
2015-07-03 19:44 ` [PATCH v5 17/17] x86/irq: Document how IRQ context tracking works and add an assertion Andy Lutomirski
2015-07-07 10:54   ` [tip:x86/asm] x86/irq, context_tracking: Document how IRQ context tracking works and add an RCU assertion tip-bot for Andy Lutomirski
2015-07-14 23:26     ` Frederic Weisbecker
2015-07-14 23:33       ` Andy Lutomirski
2015-07-18 13:23         ` Frederic Weisbecker
2015-07-18 14:10           ` Paul E. McKenney
2015-07-07 11:12 ` [PATCH v5 00/17] x86: Rewrite exit-to-userspace code Ingo Molnar
2015-07-07 16:03   ` Andy Lutomirski
2015-07-07 17:55     ` [PATCH] x86/entry/64: Fix warning on compat syscalls with CONFIG_AUDITSYSCALL=n Andy Lutomirski
2015-07-08  9:57       ` [tip:x86/asm] x86/entry/64: Fix IRQ state confusion and related warning on compat syscalls with CONFIG_AUDITSYSCALL =n tip-bot for Andy Lutomirski
2015-07-08 19:12       ` tip-bot for Andy Lutomirski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=tip-5e99cb7c35ca0580da8e892f91c655d35ecf8798@git.kernel.org \
    --to=tipbot@zytor.com \
    --cc=bp@alien8.de \
    --cc=brgerst@gmail.com \
    --cc=dvlasenk@redhat.com \
    --cc=fweisbec@gmail.com \
    --cc=hpa@zytor.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-tip-commits@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=luto@kernel.org \
    --cc=mingo@kernel.org \
    --cc=oleg@redhat.com \
    --cc=peterz@infradead.org \
    --cc=riel@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --cc=vda.linux@googlemail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git