Re: [kernel-hardening] Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-19 Thread Thomas Garnier
On Wed, Jul 19, 2017 at 11:35 AM, Russell King - ARM Linux wrote: > On Wed, Jul 19, 2017 at 10:20:35AM -0700, Thomas Garnier wrote: >> On Wed, Jul 19, 2017 at 10:06 AM, Russell King - ARM Linux >> wrote: >> > On Wed, Jul 19, 2017 at 05:58:20PM +0300, Leonard Crestez wrote: >> > Probably best to r

Re: [kernel-hardening] Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-19 Thread Russell King - ARM Linux
On Wed, Jul 19, 2017 at 10:20:35AM -0700, Thomas Garnier wrote: > On Wed, Jul 19, 2017 at 10:06 AM, Russell King - ARM Linux > wrote: > > On Wed, Jul 19, 2017 at 05:58:20PM +0300, Leonard Crestez wrote: > > Probably best to revert. I stopped looking at these patches during > > the discussion, as

Re: [kernel-hardening] Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-19 Thread Thomas Garnier
On Wed, Jul 19, 2017 at 10:06 AM, Russell King - ARM Linux wrote: > On Wed, Jul 19, 2017 at 05:58:20PM +0300, Leonard Crestez wrote: >> On Tue, 2017-07-18 at 12:04 -0700, Thomas Garnier wrote: >> > On Tue, Jul 18, 2017 at 10:18 AM, Leonard Crestez >> > wrote: >> > > On Tue, 2017-07-18 at 09:04 -

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-19 Thread Russell King - ARM Linux
On Wed, Jul 19, 2017 at 05:58:20PM +0300, Leonard Crestez wrote: > On Tue, 2017-07-18 at 12:04 -0700, Thomas Garnier wrote: > > On Tue, Jul 18, 2017 at 10:18 AM, Leonard Crestez > > wrote: > > > On Tue, 2017-07-18 at 09:04 -0700, Thomas Garnier wrote: > > > > On Tue, Jul 18, 2017 at 7:36 AM, Leon

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-19 Thread Thomas Garnier
On Wed, Jul 19, 2017 at 7:58 AM, Leonard Crestez wrote: > On Tue, 2017-07-18 at 12:04 -0700, Thomas Garnier wrote: >> On Tue, Jul 18, 2017 at 10:18 AM, Leonard Crestez >> wrote: >> > On Tue, 2017-07-18 at 09:04 -0700, Thomas Garnier wrote: >> > > On Tue, Jul 18, 2017 at 7:36 AM, Leonard Crestez

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-19 Thread Leonard Crestez
On Tue, 2017-07-18 at 12:04 -0700, Thomas Garnier wrote: > On Tue, Jul 18, 2017 at 10:18 AM, Leonard Crestez > wrote: > > On Tue, 2017-07-18 at 09:04 -0700, Thomas Garnier wrote: > > > On Tue, Jul 18, 2017 at 7:36 AM, Leonard Crestez > > > wrote: > > > > On Wed, 2017-06-14 at 18:12 -0700, Thoma

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-18 Thread Thomas Garnier
On Tue, Jul 18, 2017 at 10:18 AM, Leonard Crestez wrote: > > On Tue, 2017-07-18 at 09:04 -0700, Thomas Garnier wrote: > > On Tue, Jul 18, 2017 at 7:36 AM, Leonard Crestez > > wrote: > > > > > > On Wed, 2017-06-14 at 18:12 -0700, Thomas Garnier wrote: > > > > > > > > Ensure the address limit is a

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-18 Thread Leonard Crestez
On Tue, 2017-07-18 at 09:04 -0700, Thomas Garnier wrote: > On Tue, Jul 18, 2017 at 7:36 AM, Leonard Crestez > wrote: > > > > On Wed, 2017-06-14 at 18:12 -0700, Thomas Garnier wrote: > > > > > > Ensure the address limit is a user-mode segment before returning to > > > user-mode. Otherwise a proc

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-18 Thread Thomas Garnier
On Tue, Jul 18, 2017 at 7:36 AM, Leonard Crestez wrote: > On Wed, 2017-06-14 at 18:12 -0700, Thomas Garnier wrote: >> Ensure the address limit is a user-mode segment before returning to >> user-mode. Otherwise a process can corrupt kernel-mode memory and >> elevate privileges [1]. >> >> The set_fs

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-07-18 Thread Leonard Crestez
On Wed, 2017-06-14 at 18:12 -0700, Thomas Garnier wrote: > Ensure the address limit is a user-mode segment before returning to > user-mode. Otherwise a process can corrupt kernel-mode memory and > elevate privileges [1]. > > The set_fs function sets the TIF_SETFS flag to force a slow path on > ret

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-06-21 Thread Will Deacon
On Tue, Jun 20, 2017 at 01:31:14PM -0700, Thomas Garnier wrote: > On Tue, Jun 20, 2017 at 1:18 PM, Kees Cook wrote: > > On Wed, Jun 14, 2017 at 6:12 PM, Thomas Garnier wrote: > >> diff --git a/arch/arm/kernel/entry-common.S > >> b/arch/arm/kernel/entry-common.S > >> index eb5cd77bf1d8..e33c32d56

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-06-20 Thread Thomas Garnier
On Tue, Jun 20, 2017 at 1:18 PM, Kees Cook wrote: > On Wed, Jun 14, 2017 at 6:12 PM, Thomas Garnier wrote: >> Ensure the address limit is a user-mode segment before returning to >> user-mode. Otherwise a process can corrupt kernel-mode memory and >> elevate privileges [1]. >> >> The set_fs functi

Re: [PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-06-20 Thread Kees Cook
On Wed, Jun 14, 2017 at 6:12 PM, Thomas Garnier wrote: > Ensure the address limit is a user-mode segment before returning to > user-mode. Otherwise a process can corrupt kernel-mode memory and > elevate privileges [1]. > > The set_fs function sets the TIF_SETFS flag to force a slow path on > retur

[PATCH v10 2/3] arm/syscalls: Check address limit on user-mode return

2017-06-14 Thread Thomas Garnier
Ensure the address limit is a user-mode segment before returning to user-mode. Otherwise a process can corrupt kernel-mode memory and elevate privileges [1]. The set_fs function sets the TIF_SETFS flag to force a slow path on return. In the slow path, the address limit is checked to be USER_DS if