[PATCH 0/2] x86 vdso 32-bit vdso-disabling fixes

[PATCH 0/2] x86 vdso 32-bit vdso-disabling fixes

[Roland McGrath]

These two patches together address two potential bugs when trying to
disable the 32-bit vDSO via sysctl or boot parameters (vdso32=0).

Currently, every 32-bit exec gets the vDSO mapped even if it's disabled
(the process just doesn't get told about it).  Because it's in fact
always there, the bug that patch 1/2 fixes cannot happen now.  With
patch 2/2, it won't be mapped at all when it's disabled, which is one
of the things that people might really want when they disable it (so
nothing they didn't ask for goes into their address space).

The 32-bit signal handler setup when SA_RESTORER is not used refers to
current->mm->context.vdso without regard to whether the vDSO has been
disabled when the process was exec'd.  Patch 1/2 fixes this not to use
it when it's null, which becomes possible after patch 2/2.  (This never
happens in normal use, because glibc's sigaction call uses SA_RESTORER
unless glibc detected the vDSO.)


Thanks,
Roland

[PATCH 1/2] x86 vDSO: don't use disabled vDSO for signal trampoline

[Roland McGrath]

If the vDSO was not mapped, don't use it as the "restorer" for a signal
handler.  Whether we have a pointer in mm->context.vdso depends on what
happened at exec time, so we shouldn't check any global flags now.

Signed-off-by: Roland McGrath <roland@redhat.com>
---
 arch/x86/ia32/ia32_signal.c |    2 +-
 arch/x86/kernel/signal_32.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
index 5e7771a..05e155d 100644
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -468,7 +468,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
 		restorer = ka->sa.sa_restorer;
 	} else {
 		/* Return stub is in 32bit vsyscall page */
-		if (current->binfmt->hasvdso)
+		if (current->mm->context.vdso)
 			restorer = VDSO32_SYMBOL(current->mm->context.vdso,
 						 sigreturn);
 		else
diff --git a/arch/x86/kernel/signal_32.c b/arch/x86/kernel/signal_32.c
index 0157a6f..011c62f 100644
--- a/arch/x86/kernel/signal_32.c
+++ b/arch/x86/kernel/signal_32.c
@@ -365,7 +365,7 @@ static int setup_frame(int sig, struct k_sigaction *ka,
 			goto give_sigsegv;
 	}
 
-	if (current->binfmt->hasvdso)
+	if (current->mm->context.vdso)
 		restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
 	else
 		restorer = &frame->retcode;

[PATCH 2/2] x86 vdso: don't map 32-bit vdso when disabled

[Roland McGrath]

We map a VMA for the 32-bit vDSO even when it's disabled, which is stupid.
For the 32-bit kernel it's the vdso_enabled boot parameter/sysctl
and for the 64-bit kernel it's the vdso32 boot parameter/syscall32 sysctl.

When it's disabled, we don't pass AT_SYSINFO_EHDR so processes don't use
the vDSO for anything, but we still map it.  For the non-compat vDSO,
this means we're always putting an extra VMA somewhere, maybe lousing
up the control of the address space the user was hoping for.

Honor the setting by doing nothing in arch_setup_additional_pages.

Signed-off-by: Roland McGrath <roland@redhat.com>
---
 arch/x86/vdso/vdso32-setup.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
index 348f134..f7e78d8 100644
--- a/arch/x86/vdso/vdso32-setup.c
+++ b/arch/x86/vdso/vdso32-setup.c
@@ -325,6 +325,9 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int exstack)
 	int ret = 0;
 	bool compat;
 
+	if (vdso_enabled == VDSO_DISABLED)
+		return 0;
+
 	down_write(&mm->mmap_sem);
 
 	/* Test compat mode once here, in case someone

Re: [PATCH 0/2] x86 vdso 32-bit vdso-disabling fixes

[Ingo Molnar]

* Roland McGrath <roland@redhat.com> wrote:

> These two patches together address two potential bugs when trying to 
> disable the 32-bit vDSO via sysctl or boot parameters (vdso32=0).
> 
> Currently, every 32-bit exec gets the vDSO mapped even if it's 
> disabled (the process just doesn't get told about it).  Because it's 
> in fact always there, the bug that patch 1/2 fixes cannot happen now.  
> With patch 2/2, it won't be mapped at all when it's disabled, which is 
> one of the things that people might really want when they disable it 
> (so nothing they didn't ask for goes into their address space).
> 
> The 32-bit signal handler setup when SA_RESTORER is not used refers to 
> current->mm->context.vdso without regard to whether the vDSO has been 
> disabled when the process was exec'd.  Patch 1/2 fixes this not to use 
> it when it's null, which becomes possible after patch 2/2.  (This 
> never happens in normal use, because glibc's sigaction call uses 
> SA_RESTORER unless glibc detected the vDSO.)

thanks Roland, applied.

	Ingo