Return-path: Received: from mta.outflux.net ([2001:19d0:2:6:c0de:0:736d:7471] helo=smtp.outflux.net) by Galois.linutronix.de with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1fDFxZ-0005bO-Mw for speck@linutronix.de; Mon, 30 Apr 2018 23:03:47 +0200 Received: from www.outflux.net (serenity.outflux.net [10.2.0.2]) by vinyl.outflux.net (8.15.2/8.15.2/Debian-3) with ESMTP id w3UL3bhx030988 for ; Mon, 30 Apr 2018 14:03:37 -0700 Date: Mon, 30 Apr 2018 14:03:37 -0700 From: Kees Cook Subject: [MODERATED] Re: [patch V8 13/15] SSB 13 Message-ID: <20180430210337.GF8398@outflux.net> References: <20180430150423.180110059@linutronix.de> <20180430151232.853543083@linutronix.de> <20180430201236.GB18631@char.us.oracle.com> MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit To: speck@linutronix.de List-ID: On Mon, Apr 30, 2018 at 10:26:52PM +0200, speck for Thomas Gleixner wrote: > On Mon, 30 Apr 2018, speck for Konrad Rzeszutek Wilk wrote: > > ..snip.. > > > The common return values are: > > > > > ..snip.. > > > EUCLEAN The unused prctl() arguments are not 0 > > > > This EUCLEAN and this > > > @@ -2450,6 +2462,18 @@ SYSCALL_DEFINE5(prctl, int, option, unsi > > > case PR_SVE_GET_VL: > > > error = SVE_GET_VL(); > > > break; > > > + case PR_SET_SPECULATION_CTRL: > > > + if (arg4 || arg5) > > > + error = -EUCLEAN; > > > + else > > > + error = arch_prctl_set_spec_ctrl(arg2, arg3); > > > + break; > > > + case PR_GET_SPECULATION_CTRL: > > > + if (arg3 || arg4 || arg5) > > > + error = -EUCLEAN; > > > > Is interesting. The man page for prctl at length have: > > > > EINVAL option is PR_SET_NO_NEW_PRIVS and arg2 is not equal to 1 or arg3, arg4, or arg5 is nonzero. > > > > EINVAL option is PR_GET_NO_NEW_PRIVS and arg2, arg3, arg4, or arg5 is nonzero. > > > > EINVAL option is PR_SET_THP_DISABLE and arg3, arg4, or arg5 is nonzero. > > > > EINVAL option is PR_GET_THP_DISABLE and arg2, arg3, arg4, or arg5 is nonzero. > > > > and so on. > > > > Perhaps it would make sense to align the return code to be EINVAL for the check > > against the other arguments? > > I didn't do that, because -EINVAL is also returned for non implemented prctls, > so it cannot be differentiated. But yes, we can make it consistent with the > others. Fine with me either way. I think EINVAL is more expected in this case (and is what Michael Kerrisk has asked for in the past). In this specific case, users are able to test PR_GET_SPECULATION_CTRL to check for the prctl. Having arg3/4/5 forced to zero for that right now will ensure they're checking correctly from the start. :) -Kees -- Kees Cook @outflux.net