From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Alexandru Elisei <alexandru.elisei@arm.com>, Marc Zyngier <maz@kernel.org>, Catalin Marinas <catalin.marinas@arm.com>, Sasha Levin <sashal@kernel.org>, will@kernel.org, sagarmp@cs.unc.edu, linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 5.10 36/76] arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall Date: Mon, 30 May 2022 09:43:26 -0400 [thread overview] Message-ID: <20220530134406.1934928-36-sashal@kernel.org> (raw) In-Reply-To: <20220530134406.1934928-1-sashal@kernel.org> From: Alexandru Elisei <alexandru.elisei@arm.com> [ Upstream commit 3fed9e551417b84038b15117732ea4505eee386b ] If a compat process tries to execute an unknown system call above the __ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the offending process. Information about the error is printed to dmesg in compat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() -> arm64_show_signal(). arm64_show_signal() interprets a non-zero value for current->thread.fault_code as an exception syndrome and displays the message associated with the ESR_ELx.EC field (bits 31:26). current->thread.fault_code is set in compat_arm_syscall() -> arm64_notify_die() with the bad syscall number instead of a valid ESR_ELx value. This means that the ESR_ELx.EC field has the value that the user set for the syscall number and the kernel can end up printing bogus exception messages*. For example, for the syscall number 0x68000000, which evaluates to ESR_ELx.EC value of 0x1A (ESR_ELx_EC_FPAC) the kernel prints this error: [ 18.349161] syscall[300]: unhandled exception: ERET/ERETAA/ERETAB, ESR 0x68000000, Oops - bad compat syscall(2) in syscall[10000+50000] [ 18.350639] CPU: 2 PID: 300 Comm: syscall Not tainted 5.18.0-rc1 #79 [ 18.351249] Hardware name: Pine64 RockPro64 v2.0 (DT) [..] which is misleading, as the bad compat syscall has nothing to do with pointer authentication. Stop arm64_show_signal() from printing exception syndrome information by having compat_arm_syscall() set the ESR_ELx value to 0, as it has no meaning for an invalid system call number. The example above now becomes: [ 19.935275] syscall[301]: unhandled exception: Oops - bad compat syscall(2) in syscall[10000+50000] [ 19.936124] CPU: 1 PID: 301 Comm: syscall Not tainted 5.18.0-rc1-00005-g7e08006d4102 #80 [ 19.936894] Hardware name: Pine64 RockPro64 v2.0 (DT) [..] which although shows less information because the syscall number, wrongfully advertised as the ESR value, is missing, it is better than showing plainly wrong information. The syscall number can be easily obtained with strace. *A 32-bit value above or equal to 0x8000_0000 is interpreted as a negative integer in compat_arm_syscal() and the condition scno < __ARM_NR_COMPAT_END evaluates to true; the syscall will exit to userspace in this case with the ENOSYS error code instead of arm64_notify_die() being called. Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20220425114444.368693-3-alexandru.elisei@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- arch/arm64/kernel/sys_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c index 3c18c2454089..51274bab2565 100644 --- a/arch/arm64/kernel/sys_compat.c +++ b/arch/arm64/kernel/sys_compat.c @@ -115,6 +115,6 @@ long compat_arm_syscall(struct pt_regs *regs, int scno) (compat_thumb_mode(regs) ? 2 : 4); arm64_notify_die("Oops - bad compat syscall(2)", regs, - SIGILL, ILL_ILLTRP, addr, scno); + SIGILL, ILL_ILLTRP, addr, 0); return 0; } -- 2.35.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Alexandru Elisei <alexandru.elisei@arm.com>, Marc Zyngier <maz@kernel.org>, Catalin Marinas <catalin.marinas@arm.com>, Sasha Levin <sashal@kernel.org>, will@kernel.org, sagarmp@cs.unc.edu, linux-arm-kernel@lists.infradead.org Subject: [PATCH AUTOSEL 5.10 36/76] arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall Date: Mon, 30 May 2022 09:43:26 -0400 [thread overview] Message-ID: <20220530134406.1934928-36-sashal@kernel.org> (raw) In-Reply-To: <20220530134406.1934928-1-sashal@kernel.org> From: Alexandru Elisei <alexandru.elisei@arm.com> [ Upstream commit 3fed9e551417b84038b15117732ea4505eee386b ] If a compat process tries to execute an unknown system call above the __ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the offending process. Information about the error is printed to dmesg in compat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() -> arm64_show_signal(). arm64_show_signal() interprets a non-zero value for current->thread.fault_code as an exception syndrome and displays the message associated with the ESR_ELx.EC field (bits 31:26). current->thread.fault_code is set in compat_arm_syscall() -> arm64_notify_die() with the bad syscall number instead of a valid ESR_ELx value. This means that the ESR_ELx.EC field has the value that the user set for the syscall number and the kernel can end up printing bogus exception messages*. For example, for the syscall number 0x68000000, which evaluates to ESR_ELx.EC value of 0x1A (ESR_ELx_EC_FPAC) the kernel prints this error: [ 18.349161] syscall[300]: unhandled exception: ERET/ERETAA/ERETAB, ESR 0x68000000, Oops - bad compat syscall(2) in syscall[10000+50000] [ 18.350639] CPU: 2 PID: 300 Comm: syscall Not tainted 5.18.0-rc1 #79 [ 18.351249] Hardware name: Pine64 RockPro64 v2.0 (DT) [..] which is misleading, as the bad compat syscall has nothing to do with pointer authentication. Stop arm64_show_signal() from printing exception syndrome information by having compat_arm_syscall() set the ESR_ELx value to 0, as it has no meaning for an invalid system call number. The example above now becomes: [ 19.935275] syscall[301]: unhandled exception: Oops - bad compat syscall(2) in syscall[10000+50000] [ 19.936124] CPU: 1 PID: 301 Comm: syscall Not tainted 5.18.0-rc1-00005-g7e08006d4102 #80 [ 19.936894] Hardware name: Pine64 RockPro64 v2.0 (DT) [..] which although shows less information because the syscall number, wrongfully advertised as the ESR value, is missing, it is better than showing plainly wrong information. The syscall number can be easily obtained with strace. *A 32-bit value above or equal to 0x8000_0000 is interpreted as a negative integer in compat_arm_syscal() and the condition scno < __ARM_NR_COMPAT_END evaluates to true; the syscall will exit to userspace in this case with the ENOSYS error code instead of arm64_notify_die() being called. Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20220425114444.368693-3-alexandru.elisei@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- arch/arm64/kernel/sys_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c index 3c18c2454089..51274bab2565 100644 --- a/arch/arm64/kernel/sys_compat.c +++ b/arch/arm64/kernel/sys_compat.c @@ -115,6 +115,6 @@ long compat_arm_syscall(struct pt_regs *regs, int scno) (compat_thumb_mode(regs) ? 2 : 4); arm64_notify_die("Oops - bad compat syscall(2)", regs, - SIGILL, ILL_ILLTRP, addr, scno); + SIGILL, ILL_ILLTRP, addr, 0); return 0; } -- 2.35.1
next prev parent reply other threads:[~2022-05-30 14:08 UTC|newest] Thread overview: 111+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-05-30 13:42 [PATCH AUTOSEL 5.10 01/76] iommu/vt-d: Add RPLS to quirk list to skip TE disabling Sasha Levin 2022-05-30 13:42 ` Sasha Levin 2022-05-30 13:42 ` [PATCH AUTOSEL 5.10 02/76] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes Sasha Levin 2022-05-30 13:42 ` Sasha Levin 2022-05-30 13:42 ` Sasha Levin 2022-05-30 13:42 ` [PATCH AUTOSEL 5.10 03/76] selftests/bpf: Fix vfs_link kprobe definition Sasha Levin 2022-05-30 13:42 ` [PATCH AUTOSEL 5.10 04/76] mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue Sasha Levin 2022-05-30 13:42 ` [PATCH AUTOSEL 5.10 05/76] b43legacy: Fix assigning negative value to unsigned variable Sasha Levin 2022-05-30 13:42 ` Sasha Levin 2022-05-30 13:42 ` [PATCH AUTOSEL 5.10 06/76] b43: " Sasha Levin 2022-05-30 13:42 ` Sasha Levin 2022-05-30 13:42 ` [PATCH AUTOSEL 5.10 07/76] ipw2x00: Fix potential NULL dereference in libipw_xmit() Sasha Levin 2022-05-30 13:42 ` [PATCH AUTOSEL 5.10 08/76] ipv6: fix locking issues with loops over idev->addr_list Sasha Levin 2022-05-30 13:42 ` [PATCH AUTOSEL 5.10 09/76] fbcon: Consistently protect deferred_takeover with console_lock() Sasha Levin 2022-05-30 13:42 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 10/76] x86/platform/uv: Update TSC sync state for UV5 Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 11/76] ACPICA: Avoid cache flush inside virtual machines Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 12/76] drm/komeda: return early if drm_universal_plane_init() fails Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 13/76] rcu-tasks: Fix race in schedule and flush work Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 14/76] rcu: Make TASKS_RUDE_RCU select IRQ_WORK Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 15/76] sfc: ef10: Fix assigning negative value to unsigned variable Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 16/76] ALSA: jack: Access input_dev under mutex Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 17/76] spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 18/76] tools/power turbostat: fix ICX DRAM power numbers Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 19/76] drm/amd/pm: fix double free in si_parse_power_table() Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 20/76] ath9k: fix QCA9561 PA bias level Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 21/76] media: venus: hfi: avoid null dereference in deinit Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 22/76] media: pci: cx23885: Fix the error handling in cx23885_initdev() Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 23/76] media: cx25821: Fix the warning when removing the module Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 24/76] md/bitmap: don't set sb values if can't pass sanity check Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 25/76] mmc: jz4740: Apply DMA engine limits to maximum segment size Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 26/76] drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 27/76] drm/sun4i: Add support for D1 TCONs Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 28/76] scsi: megaraid: Fix error check return value of register_chrdev() Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 29/76] scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 30/76] scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 31/76] ath11k: disable spectral scan during spectral deinit Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 32/76] ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 33/76] drm/plane: Move range check for format_count earlier Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 34/76] drm/amd/pm: fix the compile warning Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 35/76] ath10k: skip ath10k_halt during suspend for driver state RESTARTING Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` Sasha Levin [this message] 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 36/76] arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 37/76] drm: msm: fix error check return value of irq_of_parse_and_map() Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 38/76] ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 39/76] net/mlx5: fs, delete the FTE when there are no rules attached to it Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 40/76] ASoC: dapm: Don't fold register value changes into notifications Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 41/76] mlxsw: spectrum_dcb: Do not warn about priority changes Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 42/76] mlxsw: Treat LLDP packets as control Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 43/76] drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 44/76] HID: bigben: fix slab-out-of-bounds Write in bigben_probe Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 45/76] ASoC: tscs454: Add endianness flag in snd_soc_component_driver Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 46/76] net: remove two BUG() from skb_checksum_help() Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 47/76] s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 48/76] perf/amd/ibs: Cascade pmu init functions' return value Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 49/76] spi: stm32-qspi: Fix wait_cmd timeout in APM mode Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 50/76] dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 51/76] ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 52/76] ipmi:ssif: Check for NULL msg when handling events and messages Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 53/76] ipmi: Fix pr_fmt to avoid compilation issues Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 54/76] rtlwifi: Use pr_warn instead of WARN_ONCE Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 55/76] media: rga: fix possible memory leak in rga_probe Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 56/76] media: coda: limit frame interval enumeration to supported encoder frame sizes Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 57/76] media: imon: reorganize serialization Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 58/76] media: cec-adap.c: fix is_configuring state Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 59/76] openrisc: start CPU timer early in boot Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 60/76] nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 61/76] ASoC: rt5645: Fix errorenous cleanup order Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 62/76] nbd: Fix hung on disconnect request if socket is closed before Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 63/76] net: phy: micrel: Allow probing without .driver_data Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 64/76] media: exynos4-is: Fix compile warning Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 65/76] ASoC: max98357a: remove dependency on GPIOLIB Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 66/76] ASoC: rt1015p: " Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 67/76] can: mcp251xfd: silence clang's -Wunaligned-access warning Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 68/76] x86/microcode: Add explicit CPU vendor dependency Sasha Levin 2022-05-30 13:43 ` [PATCH AUTOSEL 5.10 69/76] ARM: 9201/1: spectre-bhb: rely on linker to emit cross-section literal loads Sasha Levin 2022-05-30 13:43 ` Sasha Levin 2022-05-30 13:52 ` Ard Biesheuvel 2022-05-30 13:52 ` Ard Biesheuvel 2022-05-30 13:44 ` [PATCH AUTOSEL 5.10 70/76] m68k: atari: Make Atari ROM port I/O write macros return void Sasha Levin 2022-05-30 13:44 ` [PATCH AUTOSEL 5.10 71/76] hwmon: Make chip parameter for with_info API mandatory Sasha Levin 2022-05-30 14:29 ` Guenter Roeck 2022-05-30 13:44 ` [PATCH AUTOSEL 5.10 72/76] rxrpc: Return an error to sendmsg if call failed Sasha Levin 2022-05-30 13:44 ` [PATCH AUTOSEL 5.10 73/76] rxrpc, afs: Fix selection of abort codes Sasha Levin 2022-05-30 13:44 ` [PATCH AUTOSEL 5.10 74/76] eth: tg3: silence the GCC 12 array-bounds warning Sasha Levin 2022-05-30 13:44 ` [PATCH AUTOSEL 5.10 75/76] selftests/bpf: fix btf_dump/btf_dump due to recent clang change Sasha Levin 2022-05-30 13:44 ` [PATCH AUTOSEL 5.10 76/76] gfs2: use i_lock spin_lock for inode qadata Sasha Levin 2022-05-30 13:44 ` [Cluster-devel] " Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220530134406.1934928-36-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=alexandru.elisei@arm.com \ --cc=catalin.marinas@arm.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=maz@kernel.org \ --cc=sagarmp@cs.unc.edu \ --cc=stable@vger.kernel.org \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.