Re: [PATCH 10/20] signal/vm86_32: Properly send SIGSEGV when the vm86 state cannot be saved.
From: Kees Cook <hidden>
Date: 2021-10-21 16:16:07
Also in:
lkml
On Wed, Oct 20, 2021 at 12:43:56PM -0500, Eric W. Biederman wrote:
Instead of pretending to send SIGSEGV by calling do_exit(SIGSEGV) call force_sigsegv(SIGSEGV) to force the process to take a SIGSEGV and terminate. Update handle_signal to return immediately when save_v86_state fails and kills the process. Returning immediately without doing anything except killing the process with SIGSEGV is also what signal_setup_done does when setup_rt_frame fails. Plus it is always ok to return immediately without delivering a signal to a userspace handler when a fatal signal has killed the current process.
Do the tools/testing/selftests/x86 tests all pass after these changes? I know Andy has a bunch of weird corner cases in there. Reviewed-by: Kees Cook <redacted>
quoted hunk ↗ jump to hunk
Cc: Thomas Gleixner <redacted> Cc: Ingo Molnar <mingo@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: x86@kernel.org Cc: H Peter Anvin <hpa@zytor.com> Signed-off-by: "Eric W. Biederman" <redacted> --- arch/x86/kernel/signal.c | 6 +++++- arch/x86/kernel/vm86_32.c | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-)diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index f4d21e470083..25a230f705c1 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c@@ -785,8 +785,12 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs) bool stepping, failed; struct fpu *fpu = ¤t->thread.fpu; - if (v8086_mode(regs)) + if (v8086_mode(regs)) { save_v86_state((struct kernel_vm86_regs *) regs, VM86_SIGNAL); + /* Has save_v86_state failed and killed the process? */ + if (fatal_signal_pending(current)) + return; + } /* Are we from a system call? */ if (syscall_get_nr(current, regs) != -1) {diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c index 63486da77272..040fd01be8b3 100644 --- a/arch/x86/kernel/vm86_32.c +++ b/arch/x86/kernel/vm86_32.c@@ -159,7 +159,7 @@ void save_v86_state(struct kernel_vm86_regs *regs, int retval) user_access_end(); Efault: pr_alert("could not access userspace vm86 info\n"); - do_exit(SIGSEGV); + force_sigsegv(SIGSEGV); } static int do_vm86_irq_handling(int subfunction, int irqnumber);-- 2.20.1
-- Kees Cook