Received: by 2002:a05:6a10:8c0a:0:0:0:0 with SMTP id go10csp3420012pxb; Sun, 31 Jan 2021 15:40:45 -0800 (PST) X-Google-Smtp-Source: ABdhPJwj0R/nYEJk/IDZfMMq20RGNy7RHzCM1bBtY619IQCjHMEp7WX1QlP+YYJX++2GqGZKcC+s X-Received: by 2002:a17:906:3e96:: with SMTP id a22mr14943173ejj.144.1612136445597; Sun, 31 Jan 2021 15:40:45 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1612136445; cv=none; d=google.com; s=arc-20160816; b=ajUag07eWKXVxoDOWnJbuQhZ9kJmDjSyMZ5SkeoMfXhIZdjftJZJPCvU6k6jfGbjIl OmWYNjCOf47qmtbPsI1TICp9u7TtrVIZ0wHQ68/APqn2Xac/tzGtzjjurBcOq9NqzdrE 1B36wee63gN7hwGGDMp4YQ0bHA8HABuXN0+9xSu87GVhi0BetmWXqtLKi4nQjuFuRKne 5Hn8vDAMdVtOl1DL5Q0l6WeHK7If6DvDJ2HcWYu5/Z4+3rVTI8wNuFIo9bdoQ9T99sMu mr5wDE65q9u9B7NdDCTP1BsV/T4atbPud9H3fh7TGN+NN3DbgDaRvGw2GpxDE6oTOLIb kD3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:dkim-signature; bh=RxtVTOwvFLoCBdKKHCXbA57pJv5BeCvLH+KgQ45jFPE=; b=LWLdCazstQsIioCFsuFlt2mj7Tew8LjVTFLn+3VEt3suL/hNlezl5yr3BZbZZbFsXB hmkUMagjTXnUD2rF5zYnZOWASDBcIN157QMp4hhOwN6oY15frsP8qPNaLuc0pyzRWdfi +I8HmB8NsRtrKkH6A0/duakzlhsAltiZEvkFnCW0MJOhlF3x2DoRMfiQ9BKLOOmwBxf6 zlpgdP2dLuKeAgaalHr5WxlQHtNe9F/2WY/nUz+z8ui2+Q8R49Yk9mh+Z2A63QsVOoCi 4cA56/XKJNZK8BcBX7Xj4Su8ANC3wXAebLzxVvRC1ONbMvz+JBgPf+dQMt6ueFouT81w SCzg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux-foundation.org header.s=google header.b="Uaad/AzN"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id hb21si3592028ejb.278.2021.01.31.15.40.21; Sun, 31 Jan 2021 15:40:45 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linux-foundation.org header.s=google header.b="Uaad/AzN"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230129AbhAaXhe (ORCPT + 99 others); Sun, 31 Jan 2021 18:37:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34890 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230218AbhAaXgW (ORCPT ); Sun, 31 Jan 2021 18:36:22 -0500 Received: from mail-lj1-x235.google.com (mail-lj1-x235.google.com [IPv6:2a00:1450:4864:20::235]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5DF3AC061573 for ; Sun, 31 Jan 2021 15:35:42 -0800 (PST) Received: by mail-lj1-x235.google.com with SMTP id s18so17365409ljg.7 for ; Sun, 31 Jan 2021 15:35:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=RxtVTOwvFLoCBdKKHCXbA57pJv5BeCvLH+KgQ45jFPE=; b=Uaad/AzNhD9i9qs4hVY7pyJkU4y4IRnbJ+lAT94Z5xheon9TYqV6ritYDdo0Z6BovO Eiiunf+4SLqqb/sM3/HxMYRTLlhWVsnXV7jHKbaJfJMghdaW25T5aMjaCIltgRKELYQv WyK8x5KFjphrAV7DodibwS35q7+RL1pYFmqLM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=RxtVTOwvFLoCBdKKHCXbA57pJv5BeCvLH+KgQ45jFPE=; b=C0ApO5jXci6QINtQ61XzrO2jCVvJPinc7queH3Y07pXtWqBzhn5p2ZWc1oLYZ9hVoC C+FkNGZECa77qmMcoYakUgSfApGZemVd8khpIwtIeO3krhvUbirVNCty+YD+7pr9Dzxw uKPkKNAarykPvVgrLoB/oq56M9LhU2J2tpABNdlVSfEN49cN14inBAtEvjrc+lmWkCh+ H2JRNqsC3zJDLg2tTXGgoJKCaosiV0d1IQ0fgVzCg//Fpdg0HN5fd7U1gQO/O5MbdQsy xKYaNosno9e0eWNgcH5vBXwZ1XPxYvFqom4HDQoCfy6j2PSc38wsfFSXRcr5wlU0v1C6 v1Ww== X-Gm-Message-State: AOAM531jtBbTQGC4M7zzD84qL99V2YNLBAH3d3CwqkLif1jmeu/a0K0F VS/UETXrFSz/bp5MmuAa9JsZJ46ivYw0KQ== X-Received: by 2002:a2e:91c2:: with SMTP id u2mr8440987ljg.346.1612136139436; Sun, 31 Jan 2021 15:35:39 -0800 (PST) Received: from mail-lf1-f45.google.com (mail-lf1-f45.google.com. [209.85.167.45]) by smtp.gmail.com with ESMTPSA id c17sm2804361lfs.217.2021.01.31.15.35.38 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 31 Jan 2021 15:35:38 -0800 (PST) Received: by mail-lf1-f45.google.com with SMTP id f1so20337331lfu.3 for ; Sun, 31 Jan 2021 15:35:38 -0800 (PST) X-Received: by 2002:ac2:4436:: with SMTP id w22mr6894967lfl.41.1612136138002; Sun, 31 Jan 2021 15:35:38 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Linus Torvalds Date: Sun, 31 Jan 2021 15:35:22 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [REGRESSION] x86/entry: TIF_SINGLESTEP handling is still broken To: Kyle Huey Cc: Andy Lutomirski , Thomas Gleixner , Andy Lutomirski , Gabriel Krisman Bertazi , open list , "Robert O'Callahan" Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Jan 31, 2021 at 3:18 PM Kyle Huey wrote: > > The key to triggering this bug is to enter a ptrace syscall stop and > then use PTRACE_SINGLESTEP to exit it. On a good kernel this will not > result in any userspace code execution in the tracee because on the > way out of the kernel's syscall handling path the singlestep trap will > be raised immediately. On a bad kernel that stop will not be raised, > and in the example below, the program will crash. Thanks, great explanation, and I can certainly see the behavior you mention. I wonder if the simple solution is to just (a) always set one of the SYSCALL_WORK_EXIT bits on the child in ptrace (exactly to catch the child on system call exit) (b) basically revert 299155244770 ("entry: Drop usage of TIF flags in the generic syscall code") and have the syscall exit code check the TIF_SINGLESTEP flag Hmm? Linus