* [PATCH] x86/ptrace: Clean up PTRACE_GETREGS/PTRACE_PUTREGS regset selection
@ 2021-01-29 1:41 Andy Lutomirski
2021-02-02 11:32 ` Borislav Petkov
0 siblings, 1 reply; 2+ messages in thread
From: Andy Lutomirski @ 2021-01-29 1:41 UTC (permalink / raw)
To: x86; +Cc: LKML, Andy Lutomirski
task_user_regset_view() is fundamentally broken, but it's ABI for
PTRACE_GETREGSET and PTRACE_SETREGSET.
We shouldn't be using it for PTRACE_GETREGS or PTRACE_SETREGS,
though. A native 64-bit ptrace() call and an x32 ptrace() call
should use the 64-bit regset views, and a 32-bit ptrace() call
(native or compat) should use the 32-bit regset.
task_user_regset_view() almost does this except that it will
malfunction if a ptracer is itself ptraced and the outer ptracer
modifies CS on entry to a ptrace() syscall. Hopefully that has
never happened. (The compat ptrace() code already hardcoded the
32-bit regset, so this patch has no effect on that path.)
Fix it and deobfuscate the code by hardcoding the 64-bit view in the
x32 ptrace() and selecting the view based on the kernel config in
the native ptrace().
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---
Every time I look at ptrace, it grosses me out. This makes it slightly
more comprehensible.
arch/x86/kernel/ptrace.c | 37 +++++++++++++++++++++++++++++--------
1 file changed, 29 insertions(+), 8 deletions(-)
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index bedca011459c..ed8f153cd302 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -704,6 +704,9 @@ void ptrace_disable(struct task_struct *child)
#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
static const struct user_regset_view user_x86_32_view; /* Initialized below. */
#endif
+#ifdef CONFIG_X86_64
+static const struct user_regset_view user_x86_64_view; /* Initialized below. */
+#endif
long arch_ptrace(struct task_struct *child, long request,
unsigned long addr, unsigned long data)
@@ -711,6 +714,14 @@ long arch_ptrace(struct task_struct *child, long request,
int ret;
unsigned long __user *datap = (unsigned long __user *)data;
+#ifdef CONFIG_X86_64
+ /* This is native 64-bit ptrace() */
+ const struct user_regset_view *regset_view = &user_x86_64_view;
+#else
+ /* This is native 32-bit ptrace() */
+ const struct user_regset_view *regset_view = &user_x86_32_view;
+#endif
+
switch (request) {
/* read the word at location addr in the USER area. */
case PTRACE_PEEKUSR: {
@@ -749,28 +760,28 @@ long arch_ptrace(struct task_struct *child, long request,
case PTRACE_GETREGS: /* Get all gp regs from the child. */
return copy_regset_to_user(child,
- task_user_regset_view(current),
+ regset_view,
REGSET_GENERAL,
0, sizeof(struct user_regs_struct),
datap);
case PTRACE_SETREGS: /* Set all gp regs in the child. */
return copy_regset_from_user(child,
- task_user_regset_view(current),
+ regset_view,
REGSET_GENERAL,
0, sizeof(struct user_regs_struct),
datap);
case PTRACE_GETFPREGS: /* Get the child FPU state. */
return copy_regset_to_user(child,
- task_user_regset_view(current),
+ regset_view,
REGSET_FP,
0, sizeof(struct user_i387_struct),
datap);
case PTRACE_SETFPREGS: /* Set the child FPU state. */
return copy_regset_from_user(child,
- task_user_regset_view(current),
+ regset_view,
REGSET_FP,
0, sizeof(struct user_i387_struct),
datap);
@@ -1152,28 +1163,28 @@ static long x32_arch_ptrace(struct task_struct *child,
case PTRACE_GETREGS: /* Get all gp regs from the child. */
return copy_regset_to_user(child,
- task_user_regset_view(current),
+ &user_x86_64_view,
REGSET_GENERAL,
0, sizeof(struct user_regs_struct),
datap);
case PTRACE_SETREGS: /* Set all gp regs in the child. */
return copy_regset_from_user(child,
- task_user_regset_view(current),
+ &user_x86_64_view,
REGSET_GENERAL,
0, sizeof(struct user_regs_struct),
datap);
case PTRACE_GETFPREGS: /* Get the child FPU state. */
return copy_regset_to_user(child,
- task_user_regset_view(current),
+ &user_x86_64_view,
REGSET_FP,
0, sizeof(struct user_i387_struct),
datap);
case PTRACE_SETFPREGS: /* Set the child FPU state. */
return copy_regset_from_user(child,
- task_user_regset_view(current),
+ &user_x86_64_view,
REGSET_FP,
0, sizeof(struct user_i387_struct),
datap);
@@ -1309,6 +1320,16 @@ void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask)
xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask;
}
+/*
+ * This is used by PTRACE_GETREGSET and PTRACE_SETREGSET to decide which
+ * regset format to use based on the register state of the tracee.
+ * This makes no sense whatsoever, but there appears to be existing user
+ * code that relies on it.
+ *
+ * The best way to fix it in the long run would probably be to add
+ * new improved ptrace() APIs to read and write registers reliably.
+ * Good luck.
+ */
const struct user_regset_view *task_user_regset_view(struct task_struct *task)
{
#ifdef CONFIG_IA32_EMULATION
--
2.29.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] x86/ptrace: Clean up PTRACE_GETREGS/PTRACE_PUTREGS regset selection
2021-01-29 1:41 [PATCH] x86/ptrace: Clean up PTRACE_GETREGS/PTRACE_PUTREGS regset selection Andy Lutomirski
@ 2021-02-02 11:32 ` Borislav Petkov
0 siblings, 0 replies; 2+ messages in thread
From: Borislav Petkov @ 2021-02-02 11:32 UTC (permalink / raw)
To: Andy Lutomirski; +Cc: x86, LKML
On Thu, Jan 28, 2021 at 05:41:21PM -0800, Andy Lutomirski wrote:
> task_user_regset_view() is fundamentally broken, but it's ABI for
> PTRACE_GETREGSET and PTRACE_SETREGSET.
>
> We shouldn't be using it for PTRACE_GETREGS or PTRACE_SETREGS,
No "We" etc pls.
> though. A native 64-bit ptrace() call and an x32 ptrace() call
> should use the 64-bit regset views, and a 32-bit ptrace() call
> (native or compat) should use the 32-bit regset.
> task_user_regset_view() almost does this except that it will
> malfunction if a ptracer is itself ptraced and the outer ptracer
> modifies CS on entry to a ptrace() syscall.
Is that the reason why task_user_regset_view() is fundamentally broken?
It is somewhat unclear what exactly is broken.
> Hopefully that has
> never happened. (The compat ptrace() code already hardcoded the
> 32-bit regset, so this patch has no effect on that path.)
>
> Fix it and deobfuscate the code by hardcoding the 64-bit view in the
> x32 ptrace() and selecting the view based on the kernel config in
> the native ptrace().
>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> ---
>
> Every time I look at ptrace, it grosses me out. This makes it slightly
> more comprehensible.
>
> arch/x86/kernel/ptrace.c | 37 +++++++++++++++++++++++++++++--------
> 1 file changed, 29 insertions(+), 8 deletions(-)
Well, did you run the gdb testsuite on this and a bunch of other tests
we have?
I don't want us to break gdb or something else using ptrace() in some
sublte manner and then waste a bunch of time and energy chasing it, like
the DR6 thing earlier this week.
> +/*
> + * This is used by PTRACE_GETREGSET and PTRACE_SETREGSET to decide which
> + * regset format to use based on the register state of the tracee.
> + * This makes no sense whatsoever, but there appears to be existing user
> + * code that relies on it.
... because? It should use the native regset with which the kernel is
built? Please explain yourself Lutomirski!
:-)))
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-02-02 11:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-29 1:41 [PATCH] x86/ptrace: Clean up PTRACE_GETREGS/PTRACE_PUTREGS regset selection Andy Lutomirski
2021-02-02 11:32 ` Borislav Petkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).