Messages in this thread | | | Date | Thu, 01 May 2014 14:58:22 -0700 | From | "H. Peter Anvin" <> | Subject | Re: [PATCH 4/7] x86: Add support for rd/wr fs/gs base |
| |
On 05/01/2014 02:15 PM, Andi Kleen wrote: >> If usergs == kernelgs, then ebx will always be 1 and we'll never end >> up in paranoid_userspace. > > You may miss a reschedule in this obscure case. It shouldn't really > happen because loading a kernel pointer is not useful for user space. > > Doesn't seem like a real issue to me. > > We only happen need to handle it to avoid crashing. >
No, it would be a rootable security hole, not just a crash.
>> Alternatively, what if the paranoid entry checked whether we're coming >> from userspace at the very beginning and, if so, just jumped to the >> non-paranoid entry? > > That would work, but I doubt it would be worth it.
If that would solve the problem it is simple enough, but the tricky part is when we end up in a "crack" where we are in kernel mode with the user GS.
I haven't looked through the flows (I'm at LCE so I have limited screen bandwidth) to see how that would be handled in this case, but in the general paranoid case it comes down to the fact that in this particular subcase we don't necessarily know exactly how many SWAPGS are between us and userspace after we IRET.
-hpa
| |