Received-SPF: pass (google.com: domain of linux-kernel+bounces-2813-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Date: Sun, 17 Dec 2023 13:07:06 -0800
From: "H. Peter Anvin" <hpa@zytor.com>
To: Linus Torvalds <torvalds@linuxfoundation.org>,
        Brian Gerst <brgerst@gmail.com>
CC: linux-kernel@vger.kernel.org, x86@kernel.org,
        Ingo Molnar <mingo@kernel.org>, Thomas Gleixner <tglx@linutronix.de>,
        Borislav Petkov <bp@alien8.de>, Peter Zijlstra <peterz@infradead.org>,
        Michal Luczaj <mhal@rbox.co>
Subject: Re: [PATCH 3/3] x86/sigreturn: Reject system segements
User-Agent: K-9 Mail for Android
In-Reply-To: <CAHk-=whXt7QZV+HDA8=PN1pTBSNTL0ZJrcqtc4af=FtJpjPQeQ@mail.gmail.com>
References: <20231213163443.70490-1-brgerst@gmail.com> <20231213163443.70490-4-brgerst@gmail.com> <CAHk-=whXt7QZV+HDA8=PN1pTBSNTL0ZJrcqtc4af=FtJpjPQeQ@mail.gmail.com>
Message-ID: <C7EB5080-639B-41EE-B494-869D5D6F60A7@zytor.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable

On December 13, 2023 10:54:00 AM PST, Linus Torvalds <torvalds@linuxfoundat=
ion=2Eorg> wrote:
>On Wed, 13 Dec 2023 at 08:34, Brian Gerst <brgerst@gmail=2Ecom> wrote:
>>
>> @@ -98,7 +98,11 @@ static bool ia32_restore_sigcontext(struct pt_regs *=
regs,
>>
>>         /* Get CS/SS and force CPL3 */
>>         regs->cs =3D sc=2Ecs | 0x03;
>> +       if (!valid_user_selector(regs->cs))
>> +               return false;
>>         regs->ss =3D sc=2Ess | 0x03;
>> +       if (!valid_user_selector(regs->ss))
>> +               return false;
>
>Side note: the SS/CS checks could be stricter than the usual selector tes=
ts=2E
>
>In particular, normal segments can be Null segments=2E But CS/SS must not=
 be=2E
>
>Also, since you're now checking the validity, maybe we shouldn't do
>the "force cpl3" any more, and just make it an error to try to load a
>non-cpl3 segment at sigreturn=2E=2E
>
>That forcing was literally just because we weren't checking it for sanity=
=2E=2E=2E
>
>           Linus

Not to mention that changing a null descriptor to 3 is wrong=2E