Skip to content

Commit

Permalink
selftests/x86/sigreturn/32: Invalidate DS and ES when abusing the kernel
Browse files Browse the repository at this point in the history
If the kernel accidentally uses DS or ES while the user values are
loaded, it will work fine for sane userspace.  In the interest of
simulating maximally insane userspace, make sigreturn_32 zero out DS
and ES for the nasty parts so that inadvertent use of these segments
will crash.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@kernel.org
  • Loading branch information
Andy Lutomirski authored and Peter Zijlstra committed Nov 21, 2019
1 parent 8caa016 commit 4d2fa82
Showing 1 changed file with 13 additions and 0 deletions.
13 changes: 13 additions & 0 deletions tools/testing/selftests/x86/sigreturn.c
Original file line number Diff line number Diff line change
Expand Up @@ -451,6 +451,19 @@ static void sigusr1(int sig, siginfo_t *info, void *ctx_void)
ctx->uc_mcontext.gregs[REG_SP] = (unsigned long)0x8badf00d5aadc0deULL;
ctx->uc_mcontext.gregs[REG_CX] = 0;

#ifdef __i386__
/*
* Make sure the kernel doesn't inadvertently use DS or ES-relative
* accesses in a region where user DS or ES is loaded.
*
* Skip this for 64-bit builds because long mode doesn't care about
* DS and ES and skipping it increases test coverage a little bit,
* since 64-bit kernels can still run the 32-bit build.
*/
ctx->uc_mcontext.gregs[REG_DS] = 0;
ctx->uc_mcontext.gregs[REG_ES] = 0;
#endif

memcpy(&requested_regs, &ctx->uc_mcontext.gregs, sizeof(gregset_t));
requested_regs[REG_CX] = *ssptr(ctx); /* The asm code does this. */

Expand Down

0 comments on commit 4d2fa82

Please sign in to comment.