mirror of https://github.com/torvalds/linux.git
d14fa1fcf6
childregs represents the registers which are active for the new thread
in user context. For a kernel thread, childregs->gp is never used since
the kernel gp is not touched by switch_to. For a user mode helper, the
gp value can be observed in user space after execve or possibly by other
means.
[From the email thread]
The /* Kernel thread */ comment is somewhat inaccurate in that it is also used
for user_mode_helper threads, which exec a user process, e.g. /sbin/init or
when /proc/sys/kernel/core_pattern is a pipe. Such threads do not have
PF_KTHREAD set and are valid targets for ptrace etc. even before they exec.
childregs is the *user* context during syscall execution and it is observable
from userspace in at least five ways:
1. kernel_execve does not currently clear integer registers, so the starting
register state for PID 1 and other user processes started by the kernel has
sp = user stack, gp = kernel __global_pointer$, all other integer registers
zeroed by the memset in the patch comment.
This is a bug in its own right, but I'm unwilling to bet that it is the only
way to exploit the issue addressed by this patch.
2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread
before it execs, but ptrace requires SIGSTOP to be delivered which can only
happen at user/kernel boundaries.
3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for
user_mode_helpers before the exec completes, but gp is not one of the
registers it returns.
4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel
addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses
are also exposed via PERF_SAMPLE_REGS_USER which is permitted under
LOCKDOWN_PERF. I have not attempted to write exploit code.
5. Much of the tracing infrastructure allows access to user registers. I have
not attempted to determine which forms of tracing allow access to user
registers without already allowing access to kernel registers.
Fixes:
|
||
|---|---|---|
| .. | ||
| compat_vdso | ||
| pi | ||
| probes | ||
| tests | ||
| vdso | ||
| .gitignore | ||
| Makefile | ||
| acpi.c | ||
| alternative.c | ||
| asm-offsets.c | ||
| cacheinfo.c | ||
| cfi.c | ||
| compat_signal.c | ||
| compat_syscall_table.c | ||
| copy-unaligned.S | ||
| copy-unaligned.h | ||
| cpu-hotplug.c | ||
| cpu.c | ||
| cpu_ops.c | ||
| cpu_ops_sbi.c | ||
| cpu_ops_spinwait.c | ||
| cpufeature.c | ||
| crash_dump.c | ||
| crash_save_regs.S | ||
| efi-header.S | ||
| efi.c | ||
| elf_kexec.c | ||
| entry.S | ||
| fpu.S | ||
| ftrace.c | ||
| head.S | ||
| head.h | ||
| hibernate-asm.S | ||
| hibernate.c | ||
| image-vars.h | ||
| irq.c | ||
| jump_label.c | ||
| kernel_mode_vector.c | ||
| kexec_relocate.S | ||
| kgdb.c | ||
| machine_kexec.c | ||
| machine_kexec_file.c | ||
| mcount-dyn.S | ||
| mcount.S | ||
| module-sections.c | ||
| module.c | ||
| paravirt.c | ||
| patch.c | ||
| perf_callchain.c | ||
| perf_regs.c | ||
| process.c | ||
| ptrace.c | ||
| reset.c | ||
| return_address.c | ||
| riscv_ksyms.c | ||
| sbi-ipi.c | ||
| sbi.c | ||
| setup.c | ||
| signal.c | ||
| smp.c | ||
| smpboot.c | ||
| soc.c | ||
| stacktrace.c | ||
| suspend.c | ||
| suspend_entry.S | ||
| sys_hwprobe.c | ||
| sys_riscv.c | ||
| syscall_table.c | ||
| time.c | ||
| traps.c | ||
| traps_misaligned.c | ||
| unaligned_access_speed.c | ||
| vdso.c | ||
| vector.c | ||
| vmcore_info.c | ||
| vmlinux-xip.lds.S | ||
| vmlinux.lds.S | ||