Skip to content

Commit

Permalink
x86/signal/64: Fix SS handling for signals delivered to 64-bit programs
Browse files Browse the repository at this point in the history
The comment in the signal code says that apps can save/restore
other segments on their own.  It's true that apps can *save* SS
on their own, but there's no way for apps to restore it: SYSCALL
effectively resets SS to __USER_DS, so any value that user code
tries to load into SS gets lost on entry to sigreturn.

This recycles two padding bytes in the segment selector area for SS.

While we're at it, we need a second change to make this useful.

If the signal we're delivering is caused by a bad SS value,
saving that value isn't enough.  We need to remove that bad
value from the regs before we try to deliver the signal.  Oddly,
the i386 code already got this right.

I suspect that 64-bit programs that try to run 16-bit code and
use signals will have a lot of trouble without this.

Signed-off-by: Andy Lutomirski <[email protected]>
Reviewed-by: Oleg Nesterov <[email protected]>
Acked-by: Borislav Petkov <[email protected]>
Cc: Al Viro <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Link: http://lkml.kernel.org/r/405594361340a2ec32f8e2b115c142df0e180d8e.1426193719.git.luto@kernel.org
Signed-off-by: Ingo Molnar <[email protected]>
  • Loading branch information
amluto authored and Ingo Molnar committed Mar 17, 2015
1 parent 263042e commit c6f2062
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 11 deletions.
2 changes: 1 addition & 1 deletion arch/x86/include/asm/sigcontext.h
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ struct sigcontext {
unsigned short cs;
unsigned short gs;
unsigned short fs;
unsigned short __pad0;
unsigned short ss;
unsigned long err;
unsigned long trapno;
unsigned long oldmask;
Expand Down
2 changes: 1 addition & 1 deletion arch/x86/include/uapi/asm/sigcontext.h
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ struct sigcontext {
__u16 cs;
__u16 gs;
__u16 fs;
__u16 __pad0;
__u16 ss;
__u64 err;
__u64 trapno;
__u64 oldmask;
Expand Down
22 changes: 13 additions & 9 deletions arch/x86/kernel/signal.c
Original file line number Diff line number Diff line change
Expand Up @@ -94,15 +94,8 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
COPY(r15);
#endif /* CONFIG_X86_64 */

#ifdef CONFIG_X86_32
COPY_SEG_CPL3(cs);
COPY_SEG_CPL3(ss);
#else /* !CONFIG_X86_32 */
/* Kernel saves and restores only the CS segment register on signals,
* which is the bare minimum needed to allow mixed 32/64-bit code.
* App's signal handler can save/restore other segments if needed. */
COPY_SEG_CPL3(cs);
#endif /* CONFIG_X86_32 */

get_user_ex(tmpflags, &sc->flags);
regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS);
Expand Down Expand Up @@ -164,6 +157,7 @@ int setup_sigcontext(struct sigcontext __user *sc, void __user *fpstate,
put_user_ex(regs->cs, &sc->cs);
put_user_ex(0, &sc->gs);
put_user_ex(0, &sc->fs);
put_user_ex(regs->ss, &sc->ss);
#endif /* CONFIG_X86_32 */

put_user_ex(fpstate, &sc->fpstate);
Expand Down Expand Up @@ -457,9 +451,19 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,

regs->sp = (unsigned long)frame;

/* Set up the CS register to run signal handlers in 64-bit mode,
even if the handler happens to be interrupting 32-bit code. */
/*
* Set up the CS and SS registers to run signal handlers in
* 64-bit mode, even if the handler happens to be interrupting
* 32-bit or 16-bit code.
*
* SS is subtle. In 64-bit mode, we don't need any particular
* SS descriptor, but we do need SS to be valid. It's possible
* that the old SS is entirely bogus -- this can happen if the
* signal we're trying to deliver is #GP or #SS caused by a bad
* SS value.
*/
regs->cs = __USER_CS;
regs->ss = __USER_DS;

return 0;
}
Expand Down

0 comments on commit c6f2062

Please sign in to comment.