All of lore.kernel.org
 help / color / mirror / Atom feed
From: Michael Ellerman <mpe@ellerman.id.au>
To: <linuxppc-dev@ozlabs.org>
Cc: <linux-kernel@vger.kernel.org>,
	keescook@chromium.org, luto@amacapital.net, wad@chromium.org,
	strosake@linux.vnet.ibm.com, bogdan.purcareata@freescale.com
Subject: [RFC PATCH 08/12] powerpc: Change syscall_get_nr() to return int
Date: Wed, 15 Jul 2015 17:37:10 +1000	[thread overview]
Message-ID: <1436945834-26660-8-git-send-email-mpe@ellerman.id.au> (raw)
In-Reply-To: <1436945834-26660-1-git-send-email-mpe@ellerman.id.au>

The documentation for syscall_get_nr() in asm-generic says:

 Note this returns int even on 64-bit machines. Only 32 bits of
 system call number can be meaningful. If the actual arch value
 is 64 bits, this truncates to 32 bits so 0xffffffff means -1.

However our implementation was never updated to reflect this.

Generally it's not important, but there is once case where it matters.

For seccomp filter with SECCOMP_RET_TRACE, the tracer will set
regs->gpr[0] to -1 to reject the syscall. When the task is a compat
task, this means we end up with 0xffffffff in r0 because ptrace will
zero extend the 32-bit value.

If syscall_get_nr() returns an unsigned long, then a 64-bit kernel will
see a positive value in r0 and will incorrectly allow the syscall
through seccomp.

Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
 arch/powerpc/include/asm/syscall.h | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
index 8d79a87c0511..ab9f3f0a8637 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -22,10 +22,15 @@
 extern const unsigned long sys_call_table[];
 #endif /* CONFIG_FTRACE_SYSCALLS */
 
-static inline long syscall_get_nr(struct task_struct *task,
-				  struct pt_regs *regs)
+static inline int syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
 {
-	return TRAP(regs) == 0xc00 ? regs->gpr[0] : -1L;
+	/*
+	 * Note that we are returning an int here. That means 0xffffffff, ie.
+	 * 32-bit negative 1, will be interpreted as -1 on a 64-bit kernel.
+	 * This is important for seccomp so that compat tasks can set r0 = -1
+	 * to reject the syscall.
+	 */
+	return TRAP(regs) == 0xc00 ? regs->gpr[0] : -1;
 }
 
 static inline void syscall_rollback(struct task_struct *task,
-- 
2.1.0


  parent reply	other threads:[~2015-07-15  7:38 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-07-15  7:37 [RFC PATCH 01/12] powerpc/kernel: Get pt_regs from r9 before calling do_syscall_trace_enter() Michael Ellerman
2015-07-15  7:37 ` [RFC PATCH 02/12] powerpc/kernel: Switch to using MAX_ERRNO Michael Ellerman
2015-07-16 22:42   ` Benjamin Herrenschmidt
2015-07-15  7:37 ` [RFC PATCH 03/12] powerpc/kernel: Change the do_syscall_trace_enter() API Michael Ellerman
2015-07-15  7:37 ` [RFC PATCH 04/12] powerpc: Drop unused syscall_get_error() Michael Ellerman
2015-07-15  7:37 ` [RFC PATCH 05/12] powerpc: Don't negate error in syscall_set_return_value() Michael Ellerman
2015-07-15  7:37 ` [RFC PATCH 06/12] powerpc: Rework syscall_get_arguments() so there is only one loop Michael Ellerman
2015-07-15  7:37 ` [RFC PATCH 07/12] powerpc: Use orig_gpr3 in syscall_get_arguments() Michael Ellerman
2015-07-15  7:37 ` Michael Ellerman [this message]
2015-07-15  7:37 ` [RFC PATCH 09/12] powerpc/kernel: Add SIG_SYS support for compat tasks Michael Ellerman
2015-07-15 15:12   ` Kees Cook
2015-07-16  3:38     ` Michael Ellerman
2015-07-15  7:37 ` [RFC PATCH 10/12] powerpc/kernel: Enable seccomp filter Michael Ellerman
2015-07-15  7:37 ` [RFC PATCH 11/12] selftests/seccomp: Make seccomp tests work on big endian Michael Ellerman
2015-07-15 15:16   ` Kees Cook
2015-07-16  3:41     ` Michael Ellerman
2015-07-15  7:37 ` [RFC PATCH 12/12] selftests/seccomp: Add powerpc support Michael Ellerman
2015-07-15 15:16   ` Kees Cook
2015-07-16 22:40 ` [RFC PATCH 01/12] powerpc/kernel: Get pt_regs from r9 before calling do_syscall_trace_enter() Benjamin Herrenschmidt
2015-07-17  4:41   ` Michael Ellerman
2015-07-17  4:41     ` Michael Ellerman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1436945834-26660-8-git-send-email-mpe@ellerman.id.au \
    --to=mpe@ellerman.id.au \
    --cc=bogdan.purcareata@freescale.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linuxppc-dev@ozlabs.org \
    --cc=luto@amacapital.net \
    --cc=strosake@linux.vnet.ibm.com \
    --cc=wad@chromium.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.