* [PATCH] ARC: entry: fix off-by-one error in syscall number validation
@ 2021-04-23 19:52 Vineet Gupta
2021-04-29 11:39 ` Shahab Vahedi
0 siblings, 1 reply; 3+ messages in thread
From: Vineet Gupta @ 2021-04-23 19:52 UTC (permalink / raw)
To: linux-snps-arc; +Cc: linux-kernel, Vineet Gupta, Shahab Vahedi
We have NR_syscall syscalls from [0 .. NR_syscall-1].
However the check for invalid syscall number is "> NR_syscall".
This off-by-one error erronesously allows "NR_syscall" itself as valid
and when passed causes out-of-bounds syscall-call table access leading
to crash.
This problem showed up when testing glibc 2.33 (v5.10 kernel capable,
includng faccessat2 syscall (439) against a v5.6 kernel with
NR_syscalls=439 (0 to 438). Due to the bug, 439 was not returned with
-ENOSYS but processed leading to a crash.
Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/48
Reported-by: Shahab Vahedi <shahab@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
---
arch/arc/kernel/entry.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
index 1743506081da..aea9b558993d 100644
--- a/arch/arc/kernel/entry.S
+++ b/arch/arc/kernel/entry.S
@@ -255,7 +255,7 @@ ENTRY(EV_Trap)
;============ Normal syscall case
; syscall num shd not exceed the total system calls avail
- cmp r8, NR_syscalls
+ cmp r8, NR_syscalls - 1
mov.hi r0, -ENOSYS
bhi .Lret_from_system_call
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] ARC: entry: fix off-by-one error in syscall number validation
2021-04-23 19:52 [PATCH] ARC: entry: fix off-by-one error in syscall number validation Vineet Gupta
@ 2021-04-29 11:39 ` Shahab Vahedi
2021-04-29 18:17 ` Vineet Gupta
0 siblings, 1 reply; 3+ messages in thread
From: Shahab Vahedi @ 2021-04-29 11:39 UTC (permalink / raw)
To: Vineet Gupta, linux-snps-arc; +Cc: linux-kernel
On 4/23/21 9:52 PM, Vineet Gupta wrote:
> diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
> index 1743506081da..aea9b558993d 100644
> --- a/arch/arc/kernel/entry.S
> +++ b/arch/arc/kernel/entry.S
> @@ -255,7 +255,7 @@ ENTRY(EV_Trap)
> ;============ Normal syscall case
>
> ; syscall num shd not exceed the total system calls avail
> - cmp r8, NR_syscalls
> + cmp r8, NR_syscalls - 1
> mov.hi r0, -ENOSYS
> bhi .Lret_from_system_call
Same problem exists in "syscall Tracing" section:
; Do the Sys Call as we normally would.
; Validate the Sys Call number
cmp r8, NR_syscalls
mov.hi r0, -ENOSYS
bhi tracesys_exit
--
Shahab
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] ARC: entry: fix off-by-one error in syscall number validation
2021-04-29 11:39 ` Shahab Vahedi
@ 2021-04-29 18:17 ` Vineet Gupta
0 siblings, 0 replies; 3+ messages in thread
From: Vineet Gupta @ 2021-04-29 18:17 UTC (permalink / raw)
To: Shahab Vahedi, linux-snps-arc; +Cc: linux-kernel
On 4/29/21 4:39 AM, Shahab Vahedi wrote:
> On 4/23/21 9:52 PM, Vineet Gupta wrote:
>> diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
>> index 1743506081da..aea9b558993d 100644
>> --- a/arch/arc/kernel/entry.S
>> +++ b/arch/arc/kernel/entry.S
>> @@ -255,7 +255,7 @@ ENTRY(EV_Trap)
>> ;============ Normal syscall case
>>
>> ; syscall num shd not exceed the total system calls avail
>> - cmp r8, NR_syscalls
>> + cmp r8, NR_syscalls - 1
>> mov.hi r0, -ENOSYS
>> bhi .Lret_from_system_call
> Same problem exists in "syscall Tracing" section:
>
> ; Do the Sys Call as we normally would.
> ; Validate the Sys Call number
> cmp r8, NR_syscalls
> mov.hi r0, -ENOSYS
> bhi tracesys_exit
Thanks for spotting this. I'll fix this up and repush (after the ongoing
merge window).
-Vineet
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-04-29 18:17 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-23 19:52 [PATCH] ARC: entry: fix off-by-one error in syscall number validation Vineet Gupta
2021-04-29 11:39 ` Shahab Vahedi
2021-04-29 18:17 ` Vineet Gupta
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).