Re: Kernel stack read with PTRACE_EVENT_EXIT and io_uring threads

From: Michael Schmitz
Date: Tue Jun 22 2021 - 17:57:35 EST


Hi Al,

On 23/06/21 8:18 am, Al Viro wrote:
On Wed, Jun 23, 2021 at 08:04:11AM +1200, Michael Schmitz wrote:

All syscalls that _do_ save the switch stack are currently called through
wrappers which pull the syscall arguments out of the saved pt_regs on the
stack (pushing the switch stack after the SAVE_ALL saved stuff buries the
syscall arguments on the stack, see comment about m68k_clone(). We'd have to
push the switch stack _first_ when entering system_call to leave the syscall
arguments in place, but that will require further changes to the syscall
exit path (currently shared with the interrupt exit path). Not to mention
the register offset calculations in arch/m68k/kernel/ptrace.c, and perhaps a
few other dependencies that don't come to mind immediately.

We have both pt_regs and switch_stack in uapi/asm/ptrace.h, but the ordering
of the two is only mentioned in a comment. Can we reorder them on the stack,
as long as we don't change the struct definitions proper?

This will take a little more time to work out and test - certainly not
before the weekend. I'll send a corrected version of my debug patch before
that.
This is insane, *especially* on m68k where you have the mess with different
frame layouts and associated ->stkadj crap (see mangle_kernel_stack() for
the (very) full barfbag).

Indeed - that's one of the uses of pt_regs and switch_stack that I hadn't yet seen.

So it's either leave the stack layout in system calls unchanged (aside from the ones that need the extra registers) and protect against accidental misuse of registers that weren't saved, with the overhead of playing with thread_info->status bits, or tackle the mess of redoing the stack layout to save all registers, always (did I already mention that I'd need a _lot_ of help from someone more conversant with m68k assembly coding for that option?).

Which one of these two barf bags is the fuller one?

Cheers,

    Michael