Skip to contentSkip to conversation

Warn users about machines with non-working WP bit

TRIVIAL Manfred Spraul 7 participants 15 messages Aug 6, 2002 – Aug 19, 2002

lore
Share & tools
lore

Manfred Spraul

author
#0 lore raw

Review

Quoted 3 lines
(quoted diff) +1 -1
-		printk("No.\n");
+		printk("No (that's security hole).\n");
 #ifdef CONFIG_X86_WP_WORKS_OK

Could you explain the hole?
WP works for user space apps, only ring0 (or ring 0-2?) code ignores the WP bit on i386.

--
Manfred

#1 lore raw

From: Manfred Spraul <[email protected]>
Date: Tue, 06 Aug 2002 11:17:33 +0200

Review

Quoted 3 lines
(quoted diff) +1 -1
-		printk("No.\n");
+		printk("No (that's security hole).\n");
 #ifdef CONFIG_X86_WP_WORKS_OK

Could you explain the hole?
WP works for user space apps, only ring0 (or ring 0-2?) code ignores the WP bit on i386.

So copy_to_user() could write to user areas that are write-proteced.

verify_area() checks aren't enough, consider a threaded application calling mprotect() while the copy is in progress.

author
#2 lore raw
Quoted 11 lines · David S. Miller

From: Manfred Spraul <[email protected]>
Date: Tue, 06 Aug 2002 11:17:33 +0200

Review

Quoted 3 lines
(quoted diff) +1 -1
-		printk("No.\n");
+		printk("No (that's security hole).\n");
 #ifdef CONFIG_X86_WP_WORKS_OK

Could you explain the hole?
WP works for user space apps, only ring0 (or ring 0-2?) code ignores the WP bit on i386.

Quoted 6 lines

So copy_to_user() could write to user areas that are write-proteced.

verify_area() checks aren't enough, consider a threaded application calling mprotect() while the copy is in progress.

Then we should either fix copy_to_user(), or mark 80386 unsupported, or disable multi-threading on 80386. It's a random memory corruption, far worse than a security hole.

--
Manfred

#3 lore raw

Hi!

Quoted 11 lines
Quoted 11 lines

From: Manfred Spraul <[email protected]>
Date: Tue, 06 Aug 2002 11:17:33 +0200

Review

Quoted 3 lines
(quoted diff) +1 -1
-		printk("No.\n");
+		printk("No (that's security hole).\n");
 #ifdef CONFIG_X86_WP_WORKS_OK

Could you explain the hole?
WP works for user space apps, only ring0 (or ring 0-2?) code ignores the WP bit on i386.

Quoted 8 lines
Quoted 4 lines

So copy_to_user() could write to user areas that are write-proteced.

verify_area() checks aren't enough, consider a threaded application calling mprotect() while the copy is in progress.

Then we should either fix copy_to_user(), or mark 80386 unsupported, or disable multi-threading on 80386. It's a random memory corruption, far worse than a security hole.

Fortunately app has to be seriously missbehaving for this to happen. Fixing copy_to_user would be nicest; I do not think dropping 386 because of *this* is good idea... [But it might force 386 users to fix copy_to_user ;-)]

Pavel

Signature · 2 lines
Philips Velo 1: 1"x4"x8", 300gram, 60, 12MB, 40bogomips, linux, mutt,
details at http://atrey.karlin.mff.cuni.cz/~pavel/velo/index.html.
#4 lore raw
In reply to David S. Miller
Quoted 3 lines · David S. Miller

verify_area() checks aren't enough, consider a threaded application calling mprotect() while the copy is in progress.

Couldn't we just freeze all other processes with the same mm while a copy_to_user is in progress?

Of course this should only be done if CONFIG_X86_WP_WORKS_OK is not enabled, so systems with a working wp doesn't have to take a performance hit.

Signature · 3 lines
Kasper Dupont -- der bruger for meget tid på usenet.
For sending spam use mailto:[email protected]
or mailto:[email protected]
#5 lore raw

From: Kasper Dupont <[email protected]>
Date: Tue, 06 Aug 2002 16:03:34 +0200

Quoted 2 lines · David S. Miller

verify_area() checks aren't enough, consider a threaded application calling mprotect() while the copy is in progress.

Couldn't we just freeze all other processes with the same mm while a copy_to_user is in progress?

What if we have to sleep and page in some memory from disk?

Your idea could lead to deadlock in a multi-threaded app.

#6 lore raw
Quoted 8 lines · David S. Miller

From: Kasper Dupont <[email protected]>
Date: Tue, 06 Aug 2002 16:03:34 +0200

Quoted 2 lines · David S. Miller

verify_area() checks aren't enough, consider a threaded application calling mprotect() while the copy is in progress.

Quoted 6 lines

Couldn't we just freeze all other processes with the same mm while a copy_to_user is in progress?

What if we have to sleep and page in some memory from disk?

Your idea could lead to deadlock in a multi-threaded app.

Why? The page should eventually get into memory from the disk, at this point the process doing the copy can continue, and when it finishes the other processes gets waked up. While the copy_to_user is in progress all the processes witht this mm should be in noninterruptible sleep. The sleeping procces doesn't need to do anything to get the page into memory, so I cannot see the problem.

Signature · 3 lines
Kasper Dupont -- der bruger for meget tid på usenet.
For sending spam use mailto:[email protected]
or mailto:[email protected]
#7 lore raw

From: Kasper Dupont <[email protected]>
Date: Tue, 06 Aug 2002 16:16:03 +0200

Quoted 3 lines · David S. Miller

What if we have to sleep and page in some memory from disk?

Your idea could lead to deadlock in a multi-threaded app.

Why? The page should eventually get into memory from the disk, at this point the process doing the copy can continue, and when it finishes the other processes gets waked up. While the copy_to_user is in progress all the processes witht this mm should be in noninterruptible sleep. The sleeping procces doesn't need to do anything to get the page into memory, so I cannot see the problem.

What if the other thread we freeze is holding a lock we need in order to get the page from disk?

#8 lore raw
Quoted 17 lines · David S. Miller

From: Kasper Dupont <[email protected]>
Date: Tue, 06 Aug 2002 16:16:03 +0200

Quoted 3 lines · David S. Miller

What if we have to sleep and page in some memory from disk?

Your idea could lead to deadlock in a multi-threaded app.

Why? The page should eventually get into memory from the disk, at this point the process doing the copy can continue, and when it finishes the other processes gets waked up. While the copy_to_user is in progress all the processes witht this mm should be in noninterruptible sleep. The sleeping procces doesn't need to do anything to get the page into memory, so I cannot see the problem.

Quoted 2 lines

What if the other thread we freeze is holding a lock we need in order to get the page from disk?

If the other thread is in user mode, that should not be possible. If the other thread is in kernel mode, things starts getting complicated. Maybe we could delay the freezing until the other thread leaves kernel. I don't right away see if the current thread has to wait for the other process to leave kernel and get frozen.

I just get another idea, that might be easier to get right. If the only problem is one process changing the mm while another process is doing a copy_to_user, we should be able to fix it by placing a readlock on the mm while the copy_to_user is in progress.

I don't remember if the mm is protected by a spinlock or semaphore, if it is a spinlock maybe it could be replaced by a semaphore? Otherwise we could prevent the copy_to_user from completing if it has to sleep, and just release the lock if it does go to sleep. In that case when the process gets waked up, it has to get a special return value, that forces it to repeat the verification of the area. (Isn't there a way to ensure the pages are in memory before starting the actual copy, that would make things simpler?)

Signature · 3 lines
Kasper Dupont -- der bruger for meget tid på usenet.
For sending spam use mailto:[email protected]
or mailto:[email protected]
author
#9 lore raw
Quoted 6 lines · Kasper Dupont

I just get another idea, that might be easier to get right. If the only problem is one process changing the mm while another process is doing a copy_to_user, we should be able to fix it by placing a readlock on the mm while the copy_to_user is in progress.

Yes, that would work. copy_to_user is never called with the mmap semaphore locked, i.e.

#define copy_to_user(...) \
       down(&current->mm->mmap_sem); \
       check_wp_bit(); \
       real_copy_to_user(); \
       up(&current->mm->mmap_sem)

verify_area would just check that the pointer is below TASK_SIZE, and the wp bit is checked within copy_to_user().

But how many 80386 Linux systems that run the 2.4 kernel exist?

--
Manfred

#10 lore raw
Quoted 2 lines · Manfred Spraul

But how many 80386 Linux systems that run the 2.4 kernel exist?

I don't know. I don't have any myself.

Signature · 3 lines
Kasper Dupont -- der bruger for meget tid på usenet.
For sending spam use mailto:[email protected]
or mailto:[email protected]
#12 lore raw
In reply to Manfred Spraul
Quoted 1 line · Manfred Spraul

But how many 80386 Linux systems that run the 2.4 kernel exist?

at least my ADSL router/firewall here :-)
It has the advantage of running really cool without *ANY* mechanical parts. And for this exact reason, there may many others around the world.

Regards,
Willy

#13 lore raw
In reply to Manfred Spraul

Hi!

Quoted 9 lines
Quoted 6 lines

I just get another idea, that might be easier to get right. If the only problem is one process changing the mm while another process is doing a copy_to_user, we should be able to fix it by placing a readlock on the mm while the copy_to_user is in progress.

Yes, that would work. copy_to_user is never called with the mmap semaphore locked, i.e.

Quoted 6 lines

#define copy_to_user(...) > down(&current->mm->mmap_sem); > check_wp_bit(); > real_copy_to_user(); > up(&current->mm->mmap_sem)

verify_area would just check that the pointer is below TASK_SIZE, and the wp bit is checked within copy_to_user().

But how many 80386 Linux systems that run the 2.4 kernel exist?

Many embedded boxes, I beieve, have modern 386 CPUs.
Pavel

Signature · 2 lines
Philips Velo 1: 1"x4"x8", 300gram, 60, 12MB, 40bogomips, linux, mutt,
details at http://atrey.karlin.mff.cuni.cz/~pavel/velo/index.html.
#14 lore raw
Quoted 3 lines · Pavel Machek
Quoted 1 line

But how many 80386 Linux systems that run the 2.4 kernel exist?

Many embedded boxes, I beieve, have modern 386 CPUs.

The 6117 is one example of that. Its a 386SX PC on a chip