From: Mathias Krause <minipli@googlemail.com>
To: x86@kernel.org
Cc: Mathias Krause <minipli@googlemail.com>,
linux-kernel@vger.kernel.org,
Andy Lutomirski <luto@amacapital.net>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
Roland McGrath <roland@redhat.com>
Subject: [PATCH] x86/vdso: ensure vdso32_enabled gets set to valid values only
Date: Wed, 5 Apr 2017 22:36:01 +0200 [thread overview]
Message-ID: <1491424561-7187-1-git-send-email-minipli@googlemail.com> (raw)
If either via kernel command line 'vdso32=' or via 'sysctl abi.vsyscall32'
vdso32_enabled gets set to a value below 0 or above 1, load_vdso32() won't
map the vDSO but ARCH_DLINFO_IA32 would still pass an AT_SYSINFO_EHDR
auxiliary vector, however with a NULL pointer. That'll make any program
trying to make use of it fail with a segmentation fault. At least musl
makes use of it if the kernel provides it.
Ensure vdso32_enabled gets set to valid values only to fix this corner
case.
Fixes: b0b49f2673f0 ("x86, vdso: Remove compat vdso support")
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
---
arch/x86/entry/vdso/vdso32-setup.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c
index 7853b53959cd..ca312c174d6f 100644
--- a/arch/x86/entry/vdso/vdso32-setup.c
+++ b/arch/x86/entry/vdso/vdso32-setup.c
@@ -30,8 +30,10 @@ static int __init vdso32_setup(char *s)
{
vdso32_enabled = simple_strtoul(s, NULL, 0);
- if (vdso32_enabled > 1)
+ if (vdso32_enabled > 1) {
pr_warn("vdso32 values other than 0 and 1 are no longer allowed; vdso disabled\n");
+ vdso32_enabled = 0;
+ }
return 1;
}
@@ -62,13 +64,18 @@ int __init sysenter_setup(void)
/* Register vsyscall32 into the ABI table */
#include <linux/sysctl.h>
+static const int zero;
+static const int one = 1;
+
static struct ctl_table abi_table2[] = {
{
.procname = "vsyscall32",
.data = &vdso32_enabled,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = (int *)&zero,
+ .extra2 = (int *)&one,
},
{}
};
--
1.7.10.4
next reply other threads:[~2017-04-05 20:36 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-05 20:36 Mathias Krause [this message]
2017-04-06 15:59 ` [PATCH] x86/vdso: ensure vdso32_enabled gets set to valid values only Andy Lutomirski
2017-04-10 13:13 ` Thomas Gleixner
2017-04-10 13:41 ` Thomas Gleixner
2017-04-10 15:14 [patch 0/3] x86/vdso: Fix enable inconsistencies and cleanup Thomas Gleixner
2017-04-10 15:14 ` [patch 1/3] x86/vdso: Ensure vdso32_enabled gets set to valid values only Thomas Gleixner
2017-04-10 16:34 ` [tip:x86/urgent] " tip-bot for Mathias Krause
2017-04-10 15:14 ` [patch 2/3] x86/vdso: Plug race between mapping and ELF header setup Thomas Gleixner
2017-04-10 15:56 ` Andy Lutomirski
2017-04-10 16:34 ` [tip:x86/urgent] " tip-bot for Thomas Gleixner
2017-04-10 15:14 ` [patch 3/3] x86/vdso: Sanitize vdso*_enabled handling Thomas Gleixner
2017-04-10 15:55 ` Andy Lutomirski
2017-04-10 16:25 ` Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1491424561-7187-1-git-send-email-minipli@googlemail.com \
--to=minipli@googlemail.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mingo@redhat.com \
--cc=roland@redhat.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).