Re: [RFC PATCH for 4.18 1/2] rseq: validate rseq_cs fields are < TASK_SIZE

[Linus Torvalds]

On Fri, Jun 29, 2018 at 9:07 AM Mathieu Desnoyers
<mathieu.desnoyers@xxxxxxxxxxxx> wrote:
>
> This code is not invoked from syscalls, but rather on return from
> interrupt/trap after a preemption.

But when we register the rseq, we could easily check that the top bits
of the IP is clear, no?

Sure, user space can change it after the fact, but at that point it's
literally "user space is being intentionally stupid".

The real worry is that 32-bit compat code never initializes those bits
at all, no?

                Linus