forked from Minki/linux
7b2dd36828
Commit:90954e7b94
("x86/coredump: Use pr_reg size, rather that TIF_IA32 flag") changed the coredumping code to construct the elf coredump file according to register set size - and that's good: if binary crashes with 32-bit code selector, generate 32-bit ELF core, otherwise - 64-bit core. That was made for restoring 32-bit applications on x86_64: we want 32-bit application after restore to generate 32-bit ELF dump on crash. All was quite good and recently I started reworking 32-bit applications dumping part of CRIU: now it has two parasites (32 and 64) for seizing compat/native tasks, after rework it'll have one parasite, working in 64-bit mode, to which 32-bit prologue long-jumps during infection. And while it has worked for my work machine, in VM with !CONFIG_X86_X32_ABI during reworking I faced that segfault in 32-bit binary, that has long-jumped to 64-bit mode results in dereference of garbage: 32-victim[19266]: segfault at f775ef65 ip 00000000f775ef65 sp 00000000f776aa50 error 14 BUG: unable to handle kernel paging request at ffffffffffffffff IP: [<ffffffff81332ce0>] strlen+0x0/0x20 [...] Call Trace: [] elf_core_dump+0x11a9/0x1480 [] do_coredump+0xa6b/0xe60 [] get_signal+0x1a8/0x5c0 [] do_signal+0x23/0x660 [] exit_to_usermode_loop+0x34/0x65 [] prepare_exit_to_usermode+0x2f/0x40 [] retint_user+0x8/0x10 That's because we have 64-bit registers set (with according total size) and we're writing it to elf_thread_core_info which has smaller size on !CONFIG_X86_X32_ABI. That lead to overwriting ELF notes part. Tested on 32-, 64-bit ELF crashes and on 32-bit binaries that have jumped with 64-bit code selector - all is readable with gdb. Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-mm@kvack.org Fixes:90954e7b94
("x86/coredump: Use pr_reg size, rather that TIF_IA32 flag") Signed-off-by: Ingo Molnar <mingo@kernel.org>
335 lines
7.4 KiB
C
335 lines
7.4 KiB
C
#ifndef _ASM_X86_COMPAT_H
|
|
#define _ASM_X86_COMPAT_H
|
|
|
|
/*
|
|
* Architecture specific compatibility types
|
|
*/
|
|
#include <linux/types.h>
|
|
#include <linux/sched.h>
|
|
#include <asm/processor.h>
|
|
#include <asm/user32.h>
|
|
#include <asm/unistd.h>
|
|
|
|
#define COMPAT_USER_HZ 100
|
|
#define COMPAT_UTS_MACHINE "i686\0\0"
|
|
|
|
typedef u32 compat_size_t;
|
|
typedef s32 compat_ssize_t;
|
|
typedef s32 compat_time_t;
|
|
typedef s32 compat_clock_t;
|
|
typedef s32 compat_pid_t;
|
|
typedef u16 __compat_uid_t;
|
|
typedef u16 __compat_gid_t;
|
|
typedef u32 __compat_uid32_t;
|
|
typedef u32 __compat_gid32_t;
|
|
typedef u16 compat_mode_t;
|
|
typedef u32 compat_ino_t;
|
|
typedef u16 compat_dev_t;
|
|
typedef s32 compat_off_t;
|
|
typedef s64 compat_loff_t;
|
|
typedef u16 compat_nlink_t;
|
|
typedef u16 compat_ipc_pid_t;
|
|
typedef s32 compat_daddr_t;
|
|
typedef u32 compat_caddr_t;
|
|
typedef __kernel_fsid_t compat_fsid_t;
|
|
typedef s32 compat_timer_t;
|
|
typedef s32 compat_key_t;
|
|
|
|
typedef s32 compat_int_t;
|
|
typedef s32 compat_long_t;
|
|
typedef s64 __attribute__((aligned(4))) compat_s64;
|
|
typedef u32 compat_uint_t;
|
|
typedef u32 compat_ulong_t;
|
|
typedef u32 compat_u32;
|
|
typedef u64 __attribute__((aligned(4))) compat_u64;
|
|
typedef u32 compat_uptr_t;
|
|
|
|
struct compat_timespec {
|
|
compat_time_t tv_sec;
|
|
s32 tv_nsec;
|
|
};
|
|
|
|
struct compat_timeval {
|
|
compat_time_t tv_sec;
|
|
s32 tv_usec;
|
|
};
|
|
|
|
struct compat_stat {
|
|
compat_dev_t st_dev;
|
|
u16 __pad1;
|
|
compat_ino_t st_ino;
|
|
compat_mode_t st_mode;
|
|
compat_nlink_t st_nlink;
|
|
__compat_uid_t st_uid;
|
|
__compat_gid_t st_gid;
|
|
compat_dev_t st_rdev;
|
|
u16 __pad2;
|
|
u32 st_size;
|
|
u32 st_blksize;
|
|
u32 st_blocks;
|
|
u32 st_atime;
|
|
u32 st_atime_nsec;
|
|
u32 st_mtime;
|
|
u32 st_mtime_nsec;
|
|
u32 st_ctime;
|
|
u32 st_ctime_nsec;
|
|
u32 __unused4;
|
|
u32 __unused5;
|
|
};
|
|
|
|
struct compat_flock {
|
|
short l_type;
|
|
short l_whence;
|
|
compat_off_t l_start;
|
|
compat_off_t l_len;
|
|
compat_pid_t l_pid;
|
|
};
|
|
|
|
#define F_GETLK64 12 /* using 'struct flock64' */
|
|
#define F_SETLK64 13
|
|
#define F_SETLKW64 14
|
|
|
|
/*
|
|
* IA32 uses 4 byte alignment for 64 bit quantities,
|
|
* so we need to pack this structure.
|
|
*/
|
|
struct compat_flock64 {
|
|
short l_type;
|
|
short l_whence;
|
|
compat_loff_t l_start;
|
|
compat_loff_t l_len;
|
|
compat_pid_t l_pid;
|
|
} __attribute__((packed));
|
|
|
|
struct compat_statfs {
|
|
int f_type;
|
|
int f_bsize;
|
|
int f_blocks;
|
|
int f_bfree;
|
|
int f_bavail;
|
|
int f_files;
|
|
int f_ffree;
|
|
compat_fsid_t f_fsid;
|
|
int f_namelen; /* SunOS ignores this field. */
|
|
int f_frsize;
|
|
int f_flags;
|
|
int f_spare[4];
|
|
};
|
|
|
|
#define COMPAT_RLIM_OLD_INFINITY 0x7fffffff
|
|
#define COMPAT_RLIM_INFINITY 0xffffffff
|
|
|
|
typedef u32 compat_old_sigset_t; /* at least 32 bits */
|
|
|
|
#define _COMPAT_NSIG 64
|
|
#define _COMPAT_NSIG_BPW 32
|
|
|
|
typedef u32 compat_sigset_word;
|
|
|
|
typedef union compat_sigval {
|
|
compat_int_t sival_int;
|
|
compat_uptr_t sival_ptr;
|
|
} compat_sigval_t;
|
|
|
|
typedef struct compat_siginfo {
|
|
int si_signo;
|
|
int si_errno;
|
|
int si_code;
|
|
|
|
union {
|
|
int _pad[128/sizeof(int) - 3];
|
|
|
|
/* kill() */
|
|
struct {
|
|
unsigned int _pid; /* sender's pid */
|
|
unsigned int _uid; /* sender's uid */
|
|
} _kill;
|
|
|
|
/* POSIX.1b timers */
|
|
struct {
|
|
compat_timer_t _tid; /* timer id */
|
|
int _overrun; /* overrun count */
|
|
compat_sigval_t _sigval; /* same as below */
|
|
int _sys_private; /* not to be passed to user */
|
|
int _overrun_incr; /* amount to add to overrun */
|
|
} _timer;
|
|
|
|
/* POSIX.1b signals */
|
|
struct {
|
|
unsigned int _pid; /* sender's pid */
|
|
unsigned int _uid; /* sender's uid */
|
|
compat_sigval_t _sigval;
|
|
} _rt;
|
|
|
|
/* SIGCHLD */
|
|
struct {
|
|
unsigned int _pid; /* which child */
|
|
unsigned int _uid; /* sender's uid */
|
|
int _status; /* exit code */
|
|
compat_clock_t _utime;
|
|
compat_clock_t _stime;
|
|
} _sigchld;
|
|
|
|
/* SIGCHLD (x32 version) */
|
|
struct {
|
|
unsigned int _pid; /* which child */
|
|
unsigned int _uid; /* sender's uid */
|
|
int _status; /* exit code */
|
|
compat_s64 _utime;
|
|
compat_s64 _stime;
|
|
} _sigchld_x32;
|
|
|
|
/* SIGILL, SIGFPE, SIGSEGV, SIGBUS */
|
|
struct {
|
|
unsigned int _addr; /* faulting insn/memory ref. */
|
|
short int _addr_lsb; /* Valid LSB of the reported address. */
|
|
union {
|
|
/* used when si_code=SEGV_BNDERR */
|
|
struct {
|
|
compat_uptr_t _lower;
|
|
compat_uptr_t _upper;
|
|
} _addr_bnd;
|
|
/* used when si_code=SEGV_PKUERR */
|
|
compat_u32 _pkey;
|
|
};
|
|
} _sigfault;
|
|
|
|
/* SIGPOLL */
|
|
struct {
|
|
int _band; /* POLL_IN, POLL_OUT, POLL_MSG */
|
|
int _fd;
|
|
} _sigpoll;
|
|
|
|
struct {
|
|
unsigned int _call_addr; /* calling insn */
|
|
int _syscall; /* triggering system call number */
|
|
unsigned int _arch; /* AUDIT_ARCH_* of syscall */
|
|
} _sigsys;
|
|
} _sifields;
|
|
} compat_siginfo_t;
|
|
|
|
#define COMPAT_OFF_T_MAX 0x7fffffff
|
|
#define COMPAT_LOFF_T_MAX 0x7fffffffffffffffL
|
|
|
|
struct compat_ipc64_perm {
|
|
compat_key_t key;
|
|
__compat_uid32_t uid;
|
|
__compat_gid32_t gid;
|
|
__compat_uid32_t cuid;
|
|
__compat_gid32_t cgid;
|
|
unsigned short mode;
|
|
unsigned short __pad1;
|
|
unsigned short seq;
|
|
unsigned short __pad2;
|
|
compat_ulong_t unused1;
|
|
compat_ulong_t unused2;
|
|
};
|
|
|
|
struct compat_semid64_ds {
|
|
struct compat_ipc64_perm sem_perm;
|
|
compat_time_t sem_otime;
|
|
compat_ulong_t __unused1;
|
|
compat_time_t sem_ctime;
|
|
compat_ulong_t __unused2;
|
|
compat_ulong_t sem_nsems;
|
|
compat_ulong_t __unused3;
|
|
compat_ulong_t __unused4;
|
|
};
|
|
|
|
struct compat_msqid64_ds {
|
|
struct compat_ipc64_perm msg_perm;
|
|
compat_time_t msg_stime;
|
|
compat_ulong_t __unused1;
|
|
compat_time_t msg_rtime;
|
|
compat_ulong_t __unused2;
|
|
compat_time_t msg_ctime;
|
|
compat_ulong_t __unused3;
|
|
compat_ulong_t msg_cbytes;
|
|
compat_ulong_t msg_qnum;
|
|
compat_ulong_t msg_qbytes;
|
|
compat_pid_t msg_lspid;
|
|
compat_pid_t msg_lrpid;
|
|
compat_ulong_t __unused4;
|
|
compat_ulong_t __unused5;
|
|
};
|
|
|
|
struct compat_shmid64_ds {
|
|
struct compat_ipc64_perm shm_perm;
|
|
compat_size_t shm_segsz;
|
|
compat_time_t shm_atime;
|
|
compat_ulong_t __unused1;
|
|
compat_time_t shm_dtime;
|
|
compat_ulong_t __unused2;
|
|
compat_time_t shm_ctime;
|
|
compat_ulong_t __unused3;
|
|
compat_pid_t shm_cpid;
|
|
compat_pid_t shm_lpid;
|
|
compat_ulong_t shm_nattch;
|
|
compat_ulong_t __unused4;
|
|
compat_ulong_t __unused5;
|
|
};
|
|
|
|
/*
|
|
* The type of struct elf_prstatus.pr_reg in compatible core dumps.
|
|
*/
|
|
typedef struct user_regs_struct compat_elf_gregset_t;
|
|
|
|
/* Full regset -- prstatus on x32, otherwise on ia32 */
|
|
#define PRSTATUS_SIZE(S, R) (R != sizeof(S.pr_reg) ? 144 : 296)
|
|
#define SET_PR_FPVALID(S, V, R) \
|
|
do { *(int *) (((void *) &((S)->pr_reg)) + R) = (V); } \
|
|
while (0)
|
|
|
|
#ifdef CONFIG_X86_X32_ABI
|
|
#define COMPAT_USE_64BIT_TIME \
|
|
(!!(task_pt_regs(current)->orig_ax & __X32_SYSCALL_BIT))
|
|
#endif
|
|
|
|
/*
|
|
* A pointer passed in from user mode. This should not
|
|
* be used for syscall parameters, just declare them
|
|
* as pointers because the syscall entry code will have
|
|
* appropriately converted them already.
|
|
*/
|
|
|
|
static inline void __user *compat_ptr(compat_uptr_t uptr)
|
|
{
|
|
return (void __user *)(unsigned long)uptr;
|
|
}
|
|
|
|
static inline compat_uptr_t ptr_to_compat(void __user *uptr)
|
|
{
|
|
return (u32)(unsigned long)uptr;
|
|
}
|
|
|
|
static inline void __user *arch_compat_alloc_user_space(long len)
|
|
{
|
|
compat_uptr_t sp;
|
|
|
|
if (test_thread_flag(TIF_IA32)) {
|
|
sp = task_pt_regs(current)->sp;
|
|
} else {
|
|
/* -128 for the x32 ABI redzone */
|
|
sp = task_pt_regs(current)->sp - 128;
|
|
}
|
|
|
|
return (void __user *)round_down(sp - len, 16);
|
|
}
|
|
|
|
static inline bool in_x32_syscall(void)
|
|
{
|
|
#ifdef CONFIG_X86_X32_ABI
|
|
if (task_pt_regs(current)->orig_ax & __X32_SYSCALL_BIT)
|
|
return true;
|
|
#endif
|
|
return false;
|
|
}
|
|
|
|
static inline bool in_compat_syscall(void)
|
|
{
|
|
return in_ia32_syscall() || in_x32_syscall();
|
|
}
|
|
#define in_compat_syscall in_compat_syscall /* override the generic impl */
|
|
|
|
#endif /* _ASM_X86_COMPAT_H */
|