mirror of
https://github.com/torvalds/linux.git
synced 2024-12-22 10:56:40 +00:00
72c33734b5
Merge PTRACE_SETREGSET leakage fixes from Dave Martin:
"This series is the collection of fixes I proposed on this topic, that
have not yet appeared upstream or in the stable branches,
The issue can leak kernel stack, but doesn't appear to allow userspace
to attack the kernel directly. The affected architectures are c6x,
h8300, metag, mips and sparc.
[ Mark Salter points out that c6x has no MMU or other mechanism to
prevent userspace access to kernel code or data on c6x, but it
doesn't hurt to clean that case up too. ]
The bugs arise from use of user_regset_copyin(). Users of
user_regset_copyin() can work in one of two ways:
1) Copy directly to thread_struct or equivalent. (This seems to be
the design assumption of the regset API, and is the most common
approach.)
2) Copy to a local variable and then transfer to thread_struct. (A
significant minority of cases.)
Buggy code typically involves approach 2"
* emailed patches from Dave Martin <Dave.Martin@arm.com>:
sparc/ptrace: Preserve previous registers for short regset write
mips/ptrace: Preserve previous registers for short regset write
metag/ptrace: Reject partial NT_METAG_RPIPE writes
metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS
metag/ptrace: Preserve previous registers for short regset write
h8300/ptrace: Fix incorrect register transfer count
c6x/ptrace: Remove useless PTRACE_SETREGSET implementation
148 lines
3.2 KiB
C
148 lines
3.2 KiB
C
/*
|
|
* Port on Texas Instruments TMS320C6x architecture
|
|
*
|
|
* Copyright (C) 2004, 2006, 2009, 2010, 2011 Texas Instruments Incorporated
|
|
* Author: Aurelien Jacquiot (aurelien.jacquiot@jaluna.com)
|
|
*
|
|
* Updated for 2.6.34: Mark Salter <msalter@redhat.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
#include <linux/ptrace.h>
|
|
#include <linux/tracehook.h>
|
|
#include <linux/regset.h>
|
|
#include <linux/elf.h>
|
|
#include <linux/sched/task_stack.h>
|
|
|
|
#include <asm/cacheflush.h>
|
|
|
|
#define PT_REG_SIZE (sizeof(struct pt_regs))
|
|
|
|
/*
|
|
* Called by kernel/ptrace.c when detaching.
|
|
*/
|
|
void ptrace_disable(struct task_struct *child)
|
|
{
|
|
/* nothing to do */
|
|
}
|
|
|
|
/*
|
|
* Get a register number from live pt_regs for the specified task.
|
|
*/
|
|
static inline long get_reg(struct task_struct *task, int regno)
|
|
{
|
|
long *addr = (long *)task_pt_regs(task);
|
|
|
|
if (regno == PT_TSR || regno == PT_CSR)
|
|
return 0;
|
|
|
|
return addr[regno];
|
|
}
|
|
|
|
/*
|
|
* Write contents of register REGNO in task TASK.
|
|
*/
|
|
static inline int put_reg(struct task_struct *task,
|
|
int regno,
|
|
unsigned long data)
|
|
{
|
|
unsigned long *addr = (unsigned long *)task_pt_regs(task);
|
|
|
|
if (regno != PT_TSR && regno != PT_CSR)
|
|
addr[regno] = data;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* regset get/set implementations */
|
|
|
|
static int gpr_get(struct task_struct *target,
|
|
const struct user_regset *regset,
|
|
unsigned int pos, unsigned int count,
|
|
void *kbuf, void __user *ubuf)
|
|
{
|
|
struct pt_regs *regs = task_pt_regs(target);
|
|
|
|
return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
|
|
regs,
|
|
0, sizeof(*regs));
|
|
}
|
|
|
|
enum c6x_regset {
|
|
REGSET_GPR,
|
|
};
|
|
|
|
static const struct user_regset c6x_regsets[] = {
|
|
[REGSET_GPR] = {
|
|
.core_note_type = NT_PRSTATUS,
|
|
.n = ELF_NGREG,
|
|
.size = sizeof(u32),
|
|
.align = sizeof(u32),
|
|
.get = gpr_get,
|
|
},
|
|
};
|
|
|
|
static const struct user_regset_view user_c6x_native_view = {
|
|
.name = "tic6x",
|
|
.e_machine = EM_TI_C6000,
|
|
.regsets = c6x_regsets,
|
|
.n = ARRAY_SIZE(c6x_regsets),
|
|
};
|
|
|
|
const struct user_regset_view *task_user_regset_view(struct task_struct *task)
|
|
{
|
|
return &user_c6x_native_view;
|
|
}
|
|
|
|
/*
|
|
* Perform ptrace request
|
|
*/
|
|
long arch_ptrace(struct task_struct *child, long request,
|
|
unsigned long addr, unsigned long data)
|
|
{
|
|
int ret = 0;
|
|
|
|
switch (request) {
|
|
/*
|
|
* write the word at location addr.
|
|
*/
|
|
case PTRACE_POKETEXT:
|
|
ret = generic_ptrace_pokedata(child, addr, data);
|
|
if (ret == 0 && request == PTRACE_POKETEXT)
|
|
flush_icache_range(addr, addr + 4);
|
|
break;
|
|
default:
|
|
ret = ptrace_request(child, request, addr, data);
|
|
break;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* handle tracing of system call entry
|
|
* - return the revised system call number or ULONG_MAX to cause ENOSYS
|
|
*/
|
|
asmlinkage unsigned long syscall_trace_entry(struct pt_regs *regs)
|
|
{
|
|
if (tracehook_report_syscall_entry(regs))
|
|
/* tracing decided this syscall should not happen, so
|
|
* We'll return a bogus call number to get an ENOSYS
|
|
* error, but leave the original number in
|
|
* regs->orig_a4
|
|
*/
|
|
return ULONG_MAX;
|
|
|
|
return regs->b0;
|
|
}
|
|
|
|
/*
|
|
* handle tracing of system call exit
|
|
*/
|
|
asmlinkage void syscall_trace_exit(struct pt_regs *regs)
|
|
{
|
|
tracehook_report_syscall_exit(regs, 0);
|
|
}
|