forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
linux-pinenote/arch/score/kernel/signal.c
Andy Lutomirski f56141e3e2 all arches, signal: move restart_block to struct task_struct 
If an attacker can cause a controlled kernel stack overflow, overwriting
the restart block is a very juicy exploit target.  This is because the
restart_block is held in the same memory allocation as the kernel stack.

Moving the restart block to struct task_struct prevents this exploit by
making the restart_block harder to locate.

Note that there are other fields in thread_info that are also easy
targets, at least on some architectures.

It's also a decent simplification, since the restart code is more or less
identical on all architectures.

[james.hogan@imgtec.com: metag: align thread_info::supervisor_stack]
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: David Miller <davem@davemloft.net>
Acked-by: Richard Weinberger <richard@nod.at>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Vineet Gupta <vgupta@synopsys.com>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Haavard Skinnemoen <hskinnemoen@gmail.com>
Cc: Hans-Christian Egtvedt <egtvedt@samfundet.no>
Cc: Steven Miao <realmz6@gmail.com>
Cc: Mark Salter <msalter@redhat.com>
Cc: Aurelien Jacquiot <a-jacquiot@ti.com>
Cc: Mikael Starvik <starvik@axis.com>
Cc: Jesper Nilsson <jesper.nilsson@axis.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Richard Kuo <rkuo@codeaurora.org>
Cc: "Luck, Tony" <tony.luck@intel.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Jonas Bonn <jonas@southpole.se>
Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
Cc: Helge Deller <deller@gmx.de>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
Tested-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Chen Liqin <liqin.linux@gmail.com>
Cc: Lennox Wu <lennox.wu@gmail.com>
Cc: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
Cc: Chris Zankel <chris@zankel.net>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-02-12 18:54:12 -08:00

308 lines
8.2 KiB
C
Raw Blame History

/*
* arch/score/kernel/signal.c
*
* Score Processor version.
*
* Copyright (C) 2009 Sunplus Core Technology Co., Ltd.
* Chen Liqin <liqin.chen@sunplusct.com>
* Lennox Wu <lennox.wu@sunplusct.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see the file COPYING, or write
* to the Free Software Foundation, Inc.,
* 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include <linux/errno.h>
#include <linux/signal.h>
#include <linux/ptrace.h>
#include <linux/unistd.h>
#include <linux/uaccess.h>
#include <linux/tracehook.h>
#include <asm/cacheflush.h>
#include <asm/syscalls.h>
#include <asm/ucontext.h>
struct rt_sigframe {
u32 rs_ass[4]; /* argument save space */
u32 rs_code[2]; /* signal trampoline */
struct siginfo rs_info;
struct ucontext rs_uc;
};
static int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
{
int err = 0;
unsigned long reg;
reg = regs->cp0_epc; err |= __put_user(reg, &sc->sc_pc);
err |= __put_user(regs->cp0_psr, &sc->sc_psr);
err |= __put_user(regs->cp0_condition, &sc->sc_condition);
#define save_gp_reg(i) { \
reg = regs->regs[i]; \
err |= __put_user(reg, &sc->sc_regs[i]); \
} while (0)
save_gp_reg(0); save_gp_reg(1); save_gp_reg(2);
save_gp_reg(3); save_gp_reg(4); save_gp_reg(5);
save_gp_reg(6); save_gp_reg(7); save_gp_reg(8);
save_gp_reg(9); save_gp_reg(10); save_gp_reg(11);
save_gp_reg(12); save_gp_reg(13); save_gp_reg(14);
save_gp_reg(15); save_gp_reg(16); save_gp_reg(17);
save_gp_reg(18); save_gp_reg(19); save_gp_reg(20);
save_gp_reg(21); save_gp_reg(22); save_gp_reg(23);
save_gp_reg(24); save_gp_reg(25); save_gp_reg(26);
save_gp_reg(27); save_gp_reg(28); save_gp_reg(29);
#undef save_gp_reg
reg = regs->ceh; err |= __put_user(reg, &sc->sc_mdceh);
reg = regs->cel; err |= __put_user(reg, &sc->sc_mdcel);
err |= __put_user(regs->cp0_ecr, &sc->sc_ecr);
err |= __put_user(regs->cp0_ema, &sc->sc_ema);
return err;
}
static int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
{
int err = 0;
u32 reg;
err |= __get_user(regs->cp0_epc, &sc->sc_pc);
err |= __get_user(regs->cp0_condition, &sc->sc_condition);
err |= __get_user(reg, &sc->sc_mdceh);
regs->ceh = (int) reg;
err |= __get_user(reg, &sc->sc_mdcel);
regs->cel = (int) reg;
err |= __get_user(reg, &sc->sc_psr);
regs->cp0_psr = (int) reg;
err |= __get_user(reg, &sc->sc_ecr);
regs->cp0_ecr = (int) reg;
err |= __get_user(reg, &sc->sc_ema);
regs->cp0_ema = (int) reg;
#define restore_gp_reg(i) do { \
err |= __get_user(reg, &sc->sc_regs[i]); \
regs->regs[i] = reg; \
} while (0)
restore_gp_reg(0); restore_gp_reg(1); restore_gp_reg(2);
restore_gp_reg(3); restore_gp_reg(4); restore_gp_reg(5);
restore_gp_reg(6); restore_gp_reg(7); restore_gp_reg(8);
restore_gp_reg(9); restore_gp_reg(10); restore_gp_reg(11);
restore_gp_reg(12); restore_gp_reg(13); restore_gp_reg(14);
restore_gp_reg(15); restore_gp_reg(16); restore_gp_reg(17);
restore_gp_reg(18); restore_gp_reg(19); restore_gp_reg(20);
restore_gp_reg(21); restore_gp_reg(22); restore_gp_reg(23);
restore_gp_reg(24); restore_gp_reg(25); restore_gp_reg(26);
restore_gp_reg(27); restore_gp_reg(28); restore_gp_reg(29);
#undef restore_gp_reg
return err;
}
/*
* Determine which stack to use..
*/
static void __user *get_sigframe(struct k_sigaction *ka,
struct pt_regs *regs, size_t frame_size)
{
unsigned long sp;
/* Default to using normal stack */
sp = regs->regs[0];
sp -= 32;
/* This is the X/Open sanctioned signal stack switching. */
if ((ka->sa.sa_flags & SA_ONSTACK) && (!on_sig_stack(sp)))
sp = current->sas_ss_sp + current->sas_ss_size;
return (void __user*)((sp - frame_size) & ~7);
}
asmlinkage long
score_rt_sigreturn(struct pt_regs *regs)
{
struct rt_sigframe __user *frame;
sigset_t set;
int sig;
/* Always make any pending restarted system calls return -EINTR */
current->restart_block.fn = do_no_restart_syscall;
frame = (struct rt_sigframe __user *) regs->regs[0];
if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
goto badframe;
if (__copy_from_user(&set, &frame->rs_uc.uc_sigmask, sizeof(set)))
goto badframe;
set_current_blocked(&set);
sig = restore_sigcontext(regs, &frame->rs_uc.uc_mcontext);
if (sig < 0)
goto badframe;
else if (sig)
force_sig(sig, current);
if (restore_altstack(&frame->rs_uc.uc_stack))
goto badframe;
regs->is_syscall = 0;
__asm__ __volatile__(
"mv\tr0, %0\n\t"
"la\tr8, syscall_exit\n\t"
"br\tr8\n\t"
: : "r" (regs) : "r8");
badframe:
force_sig(SIGSEGV, current);
return 0;
}
static int setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs,
sigset_t *set)
{
struct rt_sigframe __user *frame;
int err = 0;
frame = get_sigframe(&ksig->ka, regs, sizeof(*frame));
if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
return -EFAULT;
/*
* Set up the return code ...
*
* li v0, __NR_rt_sigreturn
* syscall
*/
err |= __put_user(0x87788000 + __NR_rt_sigreturn*2,
frame->rs_code + 0);
err |= __put_user(0x80008002, frame->rs_code + 1);
flush_cache_sigtramp((unsigned long) frame->rs_code);
err |= copy_siginfo_to_user(&frame->rs_info, &ksig->info);
err |= __put_user(0, &frame->rs_uc.uc_flags);
err |= __put_user(NULL, &frame->rs_uc.uc_link);
err |= __save_altstack(&frame->rs_uc.uc_stack, regs->regs[0]);
err |= setup_sigcontext(regs, &frame->rs_uc.uc_mcontext);
err |= __copy_to_user(&frame->rs_uc.uc_sigmask, set, sizeof(*set));
if (err)
return -EFAULT;
regs->regs[0] = (unsigned long) frame;
regs->regs[3] = (unsigned long) frame->rs_code;
regs->regs[4] = ksig->sig;
regs->regs[5] = (unsigned long) &frame->rs_info;
regs->regs[6] = (unsigned long) &frame->rs_uc;
regs->regs[29] = (unsigned long) ksig->ka.sa.sa_handler;
regs->cp0_epc = (unsigned long) ksig->ka.sa.sa_handler;
return 0;
}
static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
{
int ret;
if (regs->is_syscall) {
switch (regs->regs[4]) {
case ERESTART_RESTARTBLOCK:
case ERESTARTNOHAND:
regs->regs[4] = EINTR;
break;
case ERESTARTSYS:
if (!(ksig->ka.sa.sa_flags & SA_RESTART)) {
regs->regs[4] = EINTR;
break;
}
case ERESTARTNOINTR:
regs->regs[4] = regs->orig_r4;
regs->regs[7] = regs->orig_r7;
regs->cp0_epc -= 8;
}
regs->is_syscall = 0;
}
/*
* Set up the stack frame
*/
ret = setup_rt_frame(ksig, regs, sigmask_to_save());
signal_setup_done(ret, ksig, 0);
}
static void do_signal(struct pt_regs *regs)
{
struct ksignal ksig;
/*
* We want the common case to go fast, which is why we may in certain
* cases get here from kernel mode. Just return without doing anything
* if so.
*/
if (!user_mode(regs))
return;
if (get_signal(&ksig)) {
/* Actually deliver the signal. */
handle_signal(&ksig, regs);
return;
}
if (regs->is_syscall) {
if (regs->regs[4] == ERESTARTNOHAND ||
regs->regs[4] == ERESTARTSYS ||
regs->regs[4] == ERESTARTNOINTR) {
regs->regs[4] = regs->orig_r4;
regs->regs[7] = regs->orig_r7;
regs->cp0_epc -= 8;
}
if (regs->regs[4] == ERESTART_RESTARTBLOCK) {
regs->regs[27] = __NR_restart_syscall;
regs->regs[4] = regs->orig_r4;
regs->regs[7] = regs->orig_r7;
regs->cp0_epc -= 8;
}
regs->is_syscall = 0; /* Don't deal with this again. */
}
/*
* If there's no signal to deliver, we just put the saved sigmask
* back
*/
restore_saved_sigmask();
}
/*
* notification of userspace execution resumption
* - triggered by the TIF_WORK_MASK flags
*/
asmlinkage void do_notify_resume(struct pt_regs *regs, void *unused,
__u32 thread_info_flags)
{
/* deal with pending signal delivery */
if (thread_info_flags & _TIF_SIGPENDING)
do_signal(regs);
if (thread_info_flags & _TIF_NOTIFY_RESUME) {
clear_thread_flag(TIF_NOTIFY_RESUME);
tracehook_notify_resume(regs);
}
}
Reference in a new issue View git blame Copy permalink