Re: [PATCH v10 3/3] arm64/syscalls: Check address limit on user-mode return

2017-06-21 Thread Thomas Garnier
On Wed, Jun 21, 2017 at 1:16 AM, Catalin Marinas wrote: > On Wed, Jun 14, 2017 at 06:12:03PM -0700, Thomas Garnier wrote: >> Ensure the address limit is a user-mode segment before returning to >> user-mode. Otherwise a process can corrupt kernel-mode memory and >> elevate privileges [1]. >> >> The

Re: [PATCH v10 3/3] arm64/syscalls: Check address limit on user-mode return

2017-06-21 Thread Catalin Marinas
On Wed, Jun 14, 2017 at 06:12:03PM -0700, Thomas Garnier wrote: > Ensure the address limit is a user-mode segment before returning to > user-mode. Otherwise a process can corrupt kernel-mode memory and > elevate privileges [1]. > > The set_fs function sets the TIF_SETFS flag to force a slow path o

[PATCH v10 3/3] arm64/syscalls: Check address limit on user-mode return

2017-06-14 Thread Thomas Garnier
Ensure the address limit is a user-mode segment before returning to user-mode. Otherwise a process can corrupt kernel-mode memory and elevate privileges [1]. The set_fs function sets the TIF_SETFS flag to force a slow path on return. In the slow path, the address limit is checked to be USER_DS if