* Andy Lutomirski <[email protected]> wrote:
> ARCH_GET_FS and ARCH_GET_GS attempted to figure out the fsbase and
> gsbase respectively from saved thread state. This was wrong: fsbase
> and gsbase live in registers while a thread is running, not in
> memory.
So I'm wondering, the current code looks totally broken,what user-space code can
possibly use this? I checked glibc and Wine, and neither of them does. Wine uses
ARCH_SET_GS and glibc uses ARCH_SET_FS, but that's all - neither actually tries to
use the ARCH_GET_* reading APIs.
So for backporting purposes I'd be much happier about simply returning -EINVAL or
-ENOSYS, and we could re-introduce this code in v4.7.
Thanks,
Ingo
2016-04-08 10:13 GMT+03:00 Ingo Molnar <[email protected]>:
>
> * Andy Lutomirski <[email protected]> wrote:
>
>> ARCH_GET_FS and ARCH_GET_GS attempted to figure out the fsbase and
>> gsbase respectively from saved thread state. This was wrong: fsbase
>> and gsbase live in registers while a thread is running, not in
>> memory.
>
> So I'm wondering, the current code looks totally broken,what user-space code can
> possibly use this? I checked glibc and Wine, and neither of them does. Wine uses
> ARCH_SET_GS and glibc uses ARCH_SET_FS, but that's all - neither actually tries to
> use the ARCH_GET_* reading APIs.
Just FYI, CRIU also does not use ARCH_GET_{FS,GS}, only ARCH_SET_{FS,GS}.
It gets them with the help of PTRACE_GETREGSET.
> So for backporting purposes I'd be much happier about simply returning -EINVAL or
> -ENOSYS, and we could re-introduce this code in v4.7.
On Fri, Apr 8, 2016 at 12:13 AM, Ingo Molnar <[email protected]> wrote:
>
> * Andy Lutomirski <[email protected]> wrote:
>
>> ARCH_GET_FS and ARCH_GET_GS attempted to figure out the fsbase and
>> gsbase respectively from saved thread state. This was wrong: fsbase
>> and gsbase live in registers while a thread is running, not in
>> memory.
>
> So I'm wondering, the current code looks totally broken,what user-space code can
> possibly use this? I checked glibc and Wine, and neither of them does. Wine uses
> ARCH_SET_GS and glibc uses ARCH_SET_FS, but that's all - neither actually tries to
> use the ARCH_GET_* reading APIs.
>
> So for backporting purposes I'd be much happier about simply returning -EINVAL or
> -ENOSYS, and we could re-introduce this code in v4.7.
>
Let's just not backport this one. There's no security issue here. If
you like the rest of the series, can you remove the stable tag from
this patch when you apply it?
I think the old code was at least correct enough that if you did
ARCH_GET_FS after ARCH_SET_FS with no funny business in between, it
would work.
--Andy
--
Andy Lutomirski
AMA Capital Management, LLC