AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-28 11:18:45 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
acf4602001
linux_dsm_epyc7002/arch/x86/kernel
History
Dmitry Safonov acf4602001 x86/mm: Drop TS_COMPAT on 64-bit exec() syscall 
The x86 mmap() code selects the mmap base for an allocation depending on
the bitness of the syscall. For 64bit sycalls it select mm->mmap_base and
for 32bit mm->mmap_compat_base.

exec() calls mmap() which in turn uses in_compat_syscall() to check whether
the mapping is for a 32bit or a 64bit task. The decision is made on the
following criteria:

  ia32    child->thread.status & TS_COMPAT
   x32    child->pt_regs.orig_ax & __X32_SYSCALL_BIT
  ia64    !ia32 && !x32

__set_personality_x32() was dropping TS_COMPAT flag, but
set_personality_64bit() has kept compat syscall flag making
in_compat_syscall() return true during the first exec() syscall.

Which in result has user-visible effects, mentioned by Alexey:
1) It breaks ASAN
$ gcc -fsanitize=address wrap.c -o wrap-asan
$ ./wrap32 ./wrap-asan true
==1217==Shadow memory range interleaves with an existing memory mapping. ASan cannot proceed correctly. ABORTING.
==1217==ASan shadow was supposed to be located in the [0x00007fff7000-0x10007fff7fff] range.
==1217==Process memory map follows:
        0x000000400000-0x000000401000   /home/izbyshev/test/gcc/asan-exec-from-32bit/wrap-asan
        0x000000600000-0x000000601000   /home/izbyshev/test/gcc/asan-exec-from-32bit/wrap-asan
        0x000000601000-0x000000602000   /home/izbyshev/test/gcc/asan-exec-from-32bit/wrap-asan
        0x0000f7dbd000-0x0000f7de2000   /lib64/ld-2.27.so
        0x0000f7fe2000-0x0000f7fe3000   /lib64/ld-2.27.so
        0x0000f7fe3000-0x0000f7fe4000   /lib64/ld-2.27.so
        0x0000f7fe4000-0x0000f7fe5000
        0x7fed9abff000-0x7fed9af54000
        0x7fed9af54000-0x7fed9af6b000   /lib64/libgcc_s.so.1
[snip]

2) It doesn't seem to be great for security if an attacker always knows
that ld.so is going to be mapped into the first 4GB in this case
(the same thing happens for PIEs as well).

The testcase:
$ cat wrap.c

int main(int argc, char *argv[]) {
  execvp(argv[1], &argv[1]);
  return 127;
}

$ gcc wrap.c -o wrap
$ LD_SHOW_AUXV=1 ./wrap ./wrap true |& grep AT_BASE
AT_BASE:         0x7f63b8309000
AT_BASE:         0x7faec143c000
AT_BASE:         0x7fbdb25fa000

$ gcc -m32 wrap.c -o wrap32
$ LD_SHOW_AUXV=1 ./wrap32 ./wrap true |& grep AT_BASE
AT_BASE:         0xf7eff000
AT_BASE:         0xf7cee000
AT_BASE:         0x7f8b9774e000

Fixes: 1b028f784e ("x86/mm: Introduce mmap_compat_base() for 32-bit mmap()")
Fixes: ada26481df ("x86/mm: Make in_compat_syscall() work during exec")
Reported-by: Alexey Izbyshev <izbyshev@ispras.ru>
Bisected-by: Alexander Monakov <amonakov@ispras.ru>
Investigated-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Alexander Monakov <amonakov@ispras.ru>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: stable@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Link: https://lkml.kernel.org/r/20180517233510.24996-1-dima@arista.com
2018-05-19 12:31:05 +02:00
..
acpi x86/acpi: Prevent X2APIC id 0xffffffff from being accounted 2018-04-17 11:56:31 +02:00
apic x86/apic/x2apic: Initialize cluster ID properly 2018-05-17 21:00:12 +02:00
cpu x86/cpu: Restore CPUID_8000_0008_EBX reload 2018-05-02 16:44:38 +02:00
fpu Merge commit 'upstream-x86-entry' into WIP.x86/mm 2017-12-17 12:58:53 +01:00
kprobes kprobes/x86: Prohibit probing on exception masking instructions 2018-05-13 19:52:55 +02:00
.gitignore
alternative.c x86/paravirt: Remove 'noreplace-paravirt' cmdline option 2018-01-31 10:37:45 +01:00
amd_gart_64.c x86/dma/amd_gart: Use dma_direct_{alloc,free}() 2018-03-20 10:01:57 +01:00
amd_nb.c x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping 2018-02-15 01:15:52 +01:00
apb_timer.c Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-12-25 14:30:04 -08:00
aperture_64.c x86/gart: Exclude GART aperture from vmcore 2018-01-11 15:09:24 +01:00
apm_32.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
asm-offsets_32.c x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping 2018-02-15 01:15:52 +01:00
asm-offsets_64.c x86/entry/64: Separate cpu_current_top_of_stack from TSS.sp0 2017-12-17 13:59:56 +01:00
asm-offsets.c x86/mm: Use/Fix PCID to optimize user/kernel switches 2017-12-23 21:13:00 +01:00
audit_64.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bootflag.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
check.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
cpuid.c x86/cpuid: Allow cpuid_read() to schedule 2018-03-27 12:01:48 +02:00
crash_dump_32.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
crash_dump_64.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
crash.c kexec_file, x86: move re-factored code to generic side 2018-04-13 17:10:27 -07:00
devicetree.c Merge branch 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-04-02 16:15:32 -07:00
doublefault.c x86/entry: Fix assumptions that the HW TSS is at the beginning of cpu_tss 2017-12-17 13:59:55 +01:00
dumpstack_32.c x86/dumpstack: Unify show_regs() 2018-03-08 12:04:59 +01:00
dumpstack_64.c x86/dumpstack: Unify show_regs() 2018-03-08 12:04:59 +01:00
dumpstack.c x86/dumpstack: Unify show_regs() 2018-03-08 12:04:59 +01:00
e820.c x86/boot/e820: Implement a range manipulation operator 2018-02-26 08:44:52 +01:00
early_printk.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
early-quirks.c x86/gpu: add CFL to early quirks 2017-12-15 13:18:00 -08:00
ebda.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
eisa.c x86/eisa: Add missing include 2017-08-31 21:34:48 +02:00
espfix_64.c x86/espfix: Document use of _PAGE_GLOBAL 2018-04-09 18:27:33 +02:00
ftrace_32.S x86/retpoline/ftrace: Convert ftrace assembler indirect jumps 2018-01-12 00:14:30 +01:00
ftrace_64.S Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-01-28 12:19:23 -08:00
ftrace.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
head32.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
head64.c x86/boot/64/clang: Use fixup_pointer() to access '__supported_pte_mask' 2018-05-14 11:14:30 +02:00
head_32.S x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping 2018-02-15 01:15:52 +01:00
head_64.S x86/mm: Comment _PAGE_GLOBAL mystery 2018-04-12 09:05:58 +02:00
hpet.c x86/hpet: Cure interface abuse in the resume path 2017-08-01 13:02:37 +02:00
hw_breakpoint.c x86/kernel: Audit and remove any unnecessary uses of module.h 2016-07-14 15:06:41 +02:00
i8237.c
i8253.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
i8259.c Merge branch 'linus' into x86/apic, to resolve conflicts 2017-11-07 10:51:10 +01:00
idt.c Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-03-31 07:50:30 -10:00
io_delay.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ioport.c x86/ioport: add ksys_ioperm() helper; remove in-kernel calls to sys_ioperm() 2018-04-02 20:16:12 +02:00
irq_32.c x86/retpoline/irq32: Convert assembler indirect jumps 2018-01-12 00:14:32 +01:00
irq_64.c x86/irq/64: Print the offending IP in the stack overflow warning 2017-12-17 13:59:53 +01:00
irq_work.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
irq.c Drivers: hv: vmbus: Implement Direct Mode for stimer0 2018-03-06 09:57:17 -08:00
irqinit.c x86/apic: Simplify init_bsp_APIC() usage 2018-02-13 17:30:38 +01:00
itmt.c x86/headers: Remove duplicate #includes 2017-12-12 11:32:24 +01:00
jailhouse.c x86/jailhouse: Fix incorrect SPDX identifier 2018-04-23 10:17:28 +02:00
jump_label.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
kdebugfs.c x86, mpparse, x86/acpi, x86/PCI, x86/dmi, SFI: Use memremap() for RAM mappings 2017-07-18 11:37:58 +02:00
kexec-bzimage64.c kexec_file: do not add extra alignment to efi memmap 2018-04-20 17:18:36 -07:00
kgdb.c sched/x86: Add 'struct inactive_task_frame' to better document the sleeping task stack frame 2016-08-24 12:27:41 +02:00
ksysfs.c x86/sysfs: Fix off-by-one error in loop termination 2017-09-25 09:36:16 +02:00
kvm.c ARM: 2018-04-09 11:42:31 -07:00
kvmclock.c xen: features and fixes for v4.15-rc1 2017-11-16 13:06:27 -08:00
ldt.c x86/ldt: Fix support_pte_mask filtering in map_ldt_struct() 2018-04-16 11:20:34 -07:00
livepatch.c livepatch/x86: apply alternatives and paravirt patches after relocations 2016-08-18 23:41:55 +02:00
machine_kexec_32.c x86/kexec: Avoid double free_page() upon do_kexec_load() failure 2018-05-13 19:50:06 +02:00
machine_kexec_64.c x86/kexec: Avoid double free_page() upon do_kexec_load() failure 2018-05-13 19:50:06 +02:00
Makefile Merge branch 'x86-dma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-04-02 17:18:45 -07:00
mmconf-fam10h_64.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
module.c x86: Treat R_X86_64_PLT32 as R_X86_64_PC32 2018-02-22 09:01:10 -08:00
mpparse.c Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-02-14 17:02:15 -08:00
msr.c x86/msr: Remove bogus cleanup from the error path 2016-12-25 10:47:41 +01:00
nmi_selftest.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nmi.c locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE() 2017-10-25 11:01:08 +02:00
paravirt_patch_32.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
paravirt_patch_64.c x86/paravirt: Dont patch flush_tlb_single 2017-12-17 14:27:52 +01:00
paravirt-spinlocks.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
paravirt.c x86/mm: Rename flush_tlb_single() and flush_tlb_one() to __flush_tlb_one_[user|kernel]() 2018-02-15 01:15:52 +01:00
pci-calgary_64.c x86/dma: Remove dma_alloc_coherent_gfp_flags() 2018-03-20 10:01:58 +01:00
pci-dma.c headers: untangle kmemleak.h from mm.h 2018-04-05 21:36:27 -07:00
pci-iommu_table.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pci-swiotlb.c x86/dma: Use generic swiotlb_ops 2018-03-20 10:01:57 +01:00
pcspeaker.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
perf_regs.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
platform-quirks.c x86/platform: Control warm reset setup via legacy feature flag 2018-01-14 21:11:53 +01:00
pmem.c resource: Provide resource struct in resource walk callback 2017-11-07 15:35:57 +01:00
probe_roms.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
process_32.c x86/entry/64: Make cpu_entry_area.tss read-only 2017-12-17 14:27:52 +01:00
process_64.c x86/mm: Drop TS_COMPAT on 64-bit exec() syscall 2018-05-19 12:31:05 +02:00
process.c Merge branch 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-01-30 13:01:09 -08:00
ptrace.c x86/asm: Move 'status' from thread_struct to thread_info 2018-01-30 15:30:36 +01:00
pvclock.c x86/pvclock: add setter for pvclock_pvti_cpu0_va 2017-11-08 16:33:14 -05:00
quirks.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
reboot_fixups_32.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
reboot.c x86/apic: Fix restoring boot IRQ mode in reboot and kexec/kdump 2018-02-17 11:47:45 +01:00
relocate_kernel_32.S
relocate_kernel_64.S x86/kexec: Make kexec (mostly) work in 5-level paging mode 2018-01-31 08:39:40 +01:00
resource.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rtc.c x86/rtc: Stop using deprecated functions 2018-03-15 09:47:24 +01:00
setup_percpu.c x86/cpu_entry_area: Sync cpu_entry_area to initial_page_table 2018-03-01 09:48:27 +01:00
setup.c x86/setup: Do not reserve a crash kernel region if booted on Xen PV 2018-04-27 17:06:28 +02:00
signal_compat.c parisc/signal: Add FPE_CONDTRAP for conditional trap handling 2018-04-11 11:40:35 +02:00
signal.c x86/sigreturn: use SYSCALL_DEFINE0 2018-04-02 20:16:14 +02:00
smp.c x86/tracing: Disentangle pagefault and resched IPI tracing key 2017-08-29 11:42:29 +02:00
smpboot.c x86/smpboot: Don't use mwait_play_dead() on AMD systems 2018-04-26 16:06:19 +02:00
stacktrace.c Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-01-03 16:41:07 -08:00
step.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sys_x86_64.c mm: add ksys_mmap_pgoff() helper; remove in-kernel calls to sys_mmap_pgoff() 2018-04-02 20:16:11 +02:00
sysfb_efi.c
sysfb_simplefb.c x86/sysfb: Fix lfb_size calculation 2016-11-16 09:38:23 +01:00
sysfb.c
tboot.c x86/pti: Make unpoison of pgd for trusted boot work for real 2018-01-11 23:36:59 +01:00
tce_64.c
time.c x86/time: Unconditionally register legacy timer interrupt 2018-01-14 20:18:23 +01:00
tls.c x86/ldt: Make the LDT mapping RO 2017-12-23 21:13:01 +01:00
tls.h
topology.c
trace_clock.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tracepoint.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
traps.c x86/entry/64: Don't use IST entry for #BP stack 2018-03-23 21:10:36 +01:00
tsc_msr.c x86/tsc: Set TSC_KNOWN_FREQ and TSC_RELIABLE flags on Intel Atom SoCs 2016-11-18 10:58:31 +01:00
tsc_sync.c Merge branch 'x86-timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-11-13 19:07:38 -08:00
tsc.c x86/tsc: Fix mark_tsc_unstable() 2018-05-02 16:10:40 +02:00
umip.c x86/umip: Fix insn_get_code_seg_params()'s return value 2017-11-23 20:17:59 +01:00
unwind_frame.c x86/unwind: Disable unwinder warnings on 32-bit 2017-10-10 12:49:49 +02:00
unwind_guess.c x86/unwind: Add the ORC unwinder 2017-07-26 13:18:20 +02:00
unwind_orc.c extable: Make init_kernel_text() global 2018-02-21 16:54:06 +01:00
uprobes.c uprobes/x86: Prohibit probing on MOV SS instruction 2018-05-13 19:52:56 +02:00
verify_cpu.S x86/boot: Annotate verify_cpu() as a callable function 2017-09-28 09:39:03 +02:00
vm86_32.c x86/vm86/32: Fix POPF emulation 2018-03-14 09:21:01 +01:00
vmlinux.lds.S Merge branch 'linus' into x86/build to pick up dependencies 2018-03-20 10:56:18 +01:00
vsmp_64.c x86/apic: Remove unused callbacks 2017-09-25 20:51:58 +02:00
x86_init.c xen, mm: allow deferred page initialization for xen pv domains 2018-04-11 10:28:38 -07:00