Re: Kernel stack read with PTRACE_EVENT_EXIT and io_uring threads

[Michael Schmitz]

Hi Linus,

On 14/06/21 10:18 am, Linus Torvalds wrote:
> On Sun, Jun 13, 2021 at 2:55 PM Eric W. Biederman <ebiederm@xxxxxxxxxxxx> wrote:
> > The alpha_switch_to will remove the extra registers from the stack and
> > then call ret which if I understand alpha assembly correctly is
> > equivalent to jumping to where $26 points.  Which is
> > ret_from_kernel_thread (as setup by copy_thread).
> >
> > Which leaves ret_from_kernel_thread and everything it calls without
> > the extra context saved on the stack.
> Uhhuh. Right you are, I think. It's been ages since I worked on that
> code and my alpha handbook is somewhere else, but yes, when
> alpha_switch_to() has context-switched to the new PCB state, it will
> then pop those registers in the new context and return.
>
> So we do set up the right stack frame for the worker thread, but as
> you point out, it then gets used up immediately when running. So by
> the time the IO worker thread calls get_signal(), it's no longer
> useful.
>
> How very annoying.
>
> The (obviously UNTESTED) patch might be something like the attached.
>
> I wouldn't be surprised if m68k has the exact same thing for the exact
> same reason, but I didn't check..

m68k is indeed similar, it has:

       if (unlikely(p->flags & (PF_KTHREAD | PF_IO_WORKER))) {
                /* kernel thread */
                memset(frame, 0, sizeof(struct fork_frame));
                frame->regs.sr = PS_S;
                frame->sw.a3 = usp; /* function */
                frame->sw.d7 = arg;
                frame->sw.retpc = (unsigned long)ret_from_kernel_thread;
                p->thread.usp = 0;
                return 0;
        }

so a similar patch should be possible.

Cheers,

    Michael



>                    Linus