Re: [PATCH] [57/99] exec: delay address limit change until point of no return

Re: [PATCH] [57/99] exec: delay address limit change until point of no return

[halfdog]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This should be continuation of http://lkml.org/lkml/2011/7/27/488

Andi Kleen wrote:
> On Thu, Jul 28, 2011 at 07:52:57AM +0000, halfdog wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> 
>> Hello Mr. Kleen,
>> 
>> I saw your posting on lkml. Currently, I have no deep enough 
>> understanding of kernel memory management, so do you think, that 
>> delaying could make a otherwise irrelevant timerace in exec arg
>> handling somehow problematic?
> 
> I guess it would be better to fix it. Can you post your analysis to
> linux-kernel@vger.kernel.org ?  Feel free to cc me.

Please see
https://bugzilla.kernel.org/show_bug.cgi?id=39222
for analysis (Timerace in sys_execve when copying argv/env data from
userspace)

Seems to be historic, but not critical timerace (POC available, but no
crash, mem-leaks, ..).

- From my opinion, it should be possible to make the argv ptr go over the
0xc0000000 kernel/user split on x86 architectures, but I do not know if
the patch in discussion would worsen the situation. Until now, I failed
to trouble the kernel using this.

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFOMbgIxFmThv7tq+4RAqckAJoCeYCAdrxzWk4UXWtklubfvGR1RwCeMG+J
Yj6zC0mawHkthGGA3kEPEa4=
=SLlm
-----END PGP SIGNATURE-----

[PATCH] [0/99] 2.6.35.14 longterm review

[Andi Kleen]

This is the start of the longterm review cycle for the 2.6.35.14 release.
There are a large number of patches in this series, which will be posted as a 
response to this one.  If anyone has any issues with these being applied, 
please let me know.  If anyone is a maintainer of the proper subsystem, and
wants to add a Signed-off-by: line to the patch, please respond with it.

I'm posting the patches in 100 patch chunks to not overload the mailing
list. The next chunk will come tomorrow.

The full quilt queue can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/longterm/longterm-queue-2.6.35

Responses should be made within 48 hours.

-Andi

[PATCH] [57/99] exec: delay address limit change until point of no return

[Andi Kleen]

2.6.35-longterm review patch.  If anyone has any objections, please let me know.

------------------
From: Mathias Krause <minipli@googlemail.com>

commit dac853ae89043f1b7752875300faf614de43c74b upstream.

Unconditionally changing the address limit to USER_DS and not restoring
it to its old value in the error path is wrong because it prevents us
using kernel memory on repeated calls to this function.  This, in fact,
breaks the fallback of hard coded paths to the init program from being
ever successful if the first candidate fails to load.

With this patch applied switching to USER_DS is delayed until the point
of no return is reached which makes it possible to have a multi-arch
rootfs with one arch specific init binary for each of the (hard coded)
probed paths.

Since the address limit is already set to USER_DS when start_thread()
will be invoked, this redundancy can be safely removed.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Andi Kleen <ak@linux.intel.com>


---
 arch/x86/kernel/process_32.c |    1 -
 arch/x86/kernel/process_64.c |    1 -
 fs/exec.c                    |    5 +----
 3 files changed, 1 insertion(+), 6 deletions(-)

Index: linux-2.6.35.y/arch/x86/kernel/process_32.c
===================================================================
--- linux-2.6.35.y.orig/arch/x86/kernel/process_32.c
+++ linux-2.6.35.y/arch/x86/kernel/process_32.c
@@ -245,7 +245,6 @@ start_thread(struct pt_regs *regs, unsig
 {
 	set_user_gs(regs, 0);
 	regs->fs		= 0;
-	set_fs(USER_DS);
 	regs->ds		= __USER_DS;
 	regs->es		= __USER_DS;
 	regs->ss		= __USER_DS;
Index: linux-2.6.35.y/arch/x86/kernel/process_64.c
===================================================================
--- linux-2.6.35.y.orig/arch/x86/kernel/process_64.c
+++ linux-2.6.35.y/arch/x86/kernel/process_64.c
@@ -337,7 +337,6 @@ start_thread_common(struct pt_regs *regs
 	regs->cs		= _cs;
 	regs->ss		= _ss;
 	regs->flags		= X86_EFLAGS_IF;
-	set_fs(USER_DS);
 	/*
 	 * Free the old FP and other extended state
 	 */
Index: linux-2.6.35.y/fs/exec.c
===================================================================
--- linux-2.6.35.y.orig/fs/exec.c
+++ linux-2.6.35.y/fs/exec.c
@@ -1024,6 +1024,7 @@ int flush_old_exec(struct linux_binprm *
 
 	bprm->mm = NULL;		/* We're using it now */
 
+	set_fs(USER_DS);
 	current->flags &= ~PF_RANDOMIZE;
 	flush_thread();
 	current->personality &= ~bprm->per_clear;
@@ -1288,10 +1289,6 @@ int search_binary_handler(struct linux_b
 	if (retval)
 		return retval;
 
-	/* kernel module loader fixup */
-	/* so we don't try to load run modprobe in kernel space. */
-	set_fs(USER_DS);
-
 	retval = audit_bprm(bprm);
 	if (retval)
 		return retval;