[PW_SID:1123316] entry: Consolidate and rework syscall entry handling#2242
[PW_SID:1123316] entry: Consolidate and rework syscall entry handling#2242linux-riscv-bot wants to merge 20 commits into
Conversation
A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(),
where image->segment[i].buf might be NULL and copied unchecked.
The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by
kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without
a check in machine_kexec_prepare():
kexec_file_load
-> kimage_file_alloc_init()
-> kimage_file_prepare_segments()
-> ima_add_kexec_buffer()
-> kexec_add_buffer()
-> machine_kexec_prepare()
-> memcpy()
Address this by adding a check before the data copy attempt.
Fixes: b7fb4d7 ("RISC-V: use memcpy for kexec_file mode")
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/kexec/CAO7dBbVftLUhd2qrh7hmijTB3PEPfZAhykCGqEfrPoOcSrrj-w@mail.gmail.com/
Acked-by: Baoquan He <bhe@redhat.com>
Acked-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Signed-off-by: Tao Liu <ltao@redhat.com>
Link: https://patch.msgid.link/20260705232706.30265-2-ltao@redhat.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
add_random_kstack_offset() is invoked before syscall_enter_from_user_mode() establishes state. That's wrong because add_random_kstack_offset() calls into instrumentable code. Move it after syscall_enter_from_user_mode() to ensure that state is correctly established. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Shrikanth Hegde <sshegde@linux.ibm.com> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
add_random_kstack_offset() uses get/put_cpu_var() which is pointless overhead when it is invoked from low level entry code with interrupts disabled. Provide a irqsoff() variant, which avoids that. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: Kees Cook <kees@kernel.org> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Randomizing the syscall stack can only happen after state is established via enter_from_user_mode() or syscall_enter_from_user_mode(). The earlier it happens the better. Provide two new macros to consolidate that: - enter_from_user_mode_randomize_stack() enter_from_user_mode(); add_random_kstack_offset_irqsoff(); - syscall_enter_from_user_mode_randomize_stack() enter_from_user_mode_randomize_stack(); syscall_enter_from_user_mode_work(); to reduce boiler plate code. Those are macros and not inline functions as the latter would limit the stack randomization scope to the inline function itself. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
syscall_enter_from_user_mode_randomize_stack() replaces syscall_enter_from_user_mode() and the subsequent invocation of add_random_kstack_offset(). The advantage is that it applies the stack randomization right after enter_from_user_mode() and thereby avoids the overhead of get/put_cpu_var() as that code is invoked with interrupts disabled. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: Huacai Chen <chenhuacai@kernel.org> Cc: loongarch@lists.linux.dev Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
syscall_enter_from_user_mode_randomize_stack() replaces syscall_enter_from_user_mode() and the subsequent invocation of add_random_kstack_offset(). The advantage is that it applies the stack randomization right after enter_from_user_mode() and thereby avoids the overhead of get/put_cpu_var() as that code is invoked with interrupts disabled. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Shrikanth Hegde <sshegde@linux.ibm.com> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
syscall_enter_from_user_mode_randomize_stack() replaces syscall_enter_from_user_mode() and the subsequent invocation of add_random_kstack_offset(). The advantage is that it applies the stack randomization right after enter_from_user_mode() and thereby avoids the overhead of get/put_cpu_var() as that code is invoked with interrupts disabled. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: Paul Walmsley <pjw@kernel.org> Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: linux-riscv@lists.infradead.org Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
enter_from_user_mode_randomize_stack() replaces enter_from_user_mode() and the subsequent invocation of add_random_kstack_offset_irqsoff(). As a bonus this avoids the overhead of get/put_cpu_var() in add_random_kstack_offset(). No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: linux-s390@vger.kernel.org Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
These functions integrate the stack randomization. syscall_enter_from_user_mode_randomize_stack() has the advantage that the randomization happens early right after enter_from_user_mode(). In both cases also the overhead of get/put_cpu_var() in add_random_kstack_offset() is avoided. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: x86@kernel.org Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
All architecture use either:
nr = enter_from_user_mode_randomize_stack(regs, nr);
or
enter_from_user_mode_randomize_stack(regs);
nr = syscall_enter_from_user_mode_work(regs, nr);
Remove the now unused function.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
rseq_syscall_enter_work() is invoked before the syscall number can be modified. So there is no point in rereading it from pt_regs. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
…boolean The return value of __secure_computing() currently uses 0 to indicate that a system call should be allowed, and -1 to indicate that it should be blocked/killed. This 0/-1 pattern is non-intuitive for a security check function and makes the control flow at the call sites less readable. Furthermore, any potential future changes to these return values would require a high-risk, error-prone audit of all its users across different architectures. Sanitize this logic by converting the return type of __secure_computing() to a proper boolean, where 'true' explicitly means 'allow' and 'false' means 'fail/deny'. Update all the two dozen or so call sites across the tree to align with this new boolean semantic. No functional changes are intended, as the callers still return -1 to the lower-level assembly entry code upon seccomp denial. Rename the function to __seccomp_permit_syscall() so that the purpose is entirely clear. [ tglx: Rename the function ] Suggested-by: Thomas Gleixner <tglx@kernel.org> Suggested-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: Kees Cook <kees@kernel.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Cc: Russell King <linux@armlinux.org.uk> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Guo Ren <guoren@kernel.org> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Cc: Helge Deller <deller@gmx.de> Cc: Yoshinori Sato <ysato@users.sourceforge.jp> Cc: Richard Weinberger <richard@nod.at> Cc: Chris Zankel <chris@zankel.net> Cc: linux-arm-kernel@lists.infradead.org Cc: linux-alpha@vger.kernel.org Cc: linux-csky@vger.kernel.org Cc: linux-m68k@lists.linux-m68k.org Cc: linux-mips@vger.kernel.org Cc: linux-parisc@vger.kernel.org Cc: linux-sh@vger.kernel.org Cc: linux-um@lists.infradead.org Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
…rt_syscall_permit_entry() The return value of that function is boolean and tells the caller whether to permit the syscall processing or not. Rename the function so the purpose is clear and make the return type bool. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Cc: Vineet Gupta <vgupta@kernel.org> Cc: Russell King <linux@armlinux.org.uk> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will@kernel.org> Cc: Guo Ren <guoren@kernel.org> Cc: Brian Cain <bcain@kernel.org> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Michal Simek <monstr@monstr.eu> Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Cc: Dinh Nguyen <dinguyen@kernel.org> Cc: Helge Deller <deller@gmx.de> Cc: Yoshinori Sato <ysato@users.sourceforge.jp> Cc: "David S. Miller" <davem@davemloft.net> Cc: Andreas Larsson <andreas@gaisler.com> Cc: Chris Zankel <chris@zankel.net> Cc: linux-alpha@vger.kernel.org Cc: linux-snps-arc@lists.infradead.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-csky@vger.kernel.org Cc: linux-hexagon@vger.kernel.org Cc: linux-m68k@lists.linux-m68k.org Cc: linux-mips@vger.kernel.org Cc: linux-openrisc@vger.kernel.org Cc: linux-parisc@vger.kernel.org Cc: linux-sh@vger.kernel.org Cc: sparclinux@vger.kernel.org Cc: linux-um@lists.infradead.org Cc: linux-arch@vger.kernel.org Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
In preparation of converting the return value of syscall_enter_from_user_mode[_work]() bool, rework trace_syscall_enter() to - update the syscall number via a pointer argument - Return True if the syscall number is != -1, False otherwise That aligns with ptrace_report_syscall_permit_enter() and seccomp_permit_syscall(). The only difference is that this also returns False, when the syscall number was already -1 to begin with, but there is not much which can be done about that. As the architecture has to preset the return value to -ENOSYS anyway, that results in the correct return value for such an invalid syscall. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
This prepares for changing the return types of syscall_enter_from_user_mode[_work]() to bool, which in turn separates the decision of invoking the syscall from the syscall number, which might have been changed in the call by ptrace, seccomp, tracing. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
They are only used in the respective source files. No point in exposing them. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Invoking sys_ni_syscall() from a code path, which already knows that the syscall number is invalid just to assign -ENOSYS to regs->ax is a pointless exercise. It's even redundant as the low level entry code already has set regs->ax to -ENOSYS on entry. Remove the extra conditionals and the function calls. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Converting from int to long, back to int and then to unsigned int is confusing at best. None of this voodoo is required. Negative syscall numbers including -1 don't need any of this treatment and the low level ASM code already does the sign extension to 64-bit on a 64-bit kernel. The only point where signedness matters is the comparison against the maximum syscall number, but that can be simplified by just using a unsigned argument for the various syscall invocation functions. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
…syscall execution
The return values of syscall_enter_from_user_mode[_work]() are
non-intuitive. Both functions return the syscall number which should be
invoked by the architecture specific syscall entry code. The returned
number can be:
- the unmodified syscall number which was handed in by the caller
- a modified syscall number (ptrace, seccomp, trace/probe/bpf)
That has an additional twist. If the return value is -1L then the caller is
not allowed to modify the return value as that indicates that the modifying
entity requests to abort the syscall and set the return value already. That
can obviously not be differentiated from a syscall which handed in -1 as
syscall number.
The established way to deal with that is:
set_return_value(regs, -ENOSYS);
nr = syscall_enter_from_user_mode(regs, nr);
if ((unsigned)nr < SYSCALLNR_MAX)
handle_syscall(regs, nr);
else if (nr != -1)
set_return_value(regs, -ENOSYS);
The latter is obviously redundant, but that's just a leftover of the
historical evolution of this code. S390 has some special requirements here,
which can be avoided when the return value is not ambiguous.
Now that the functions which modify the syscall number and want to abort
are converted to indicate that with a boolean return value, it's obvious to
hand this through to the callers.
Rework syscall_enter_from_user_mode[_work]) so they take a pointer to the
syscall number and return a boolean, which indicates whether the syscall
should be handled or not.
That's not only more intuitive, it also results in slightly denser
executable code on x86 at least, but perf results are neutral and within
the noise.
[ tglx: Adopted it to the changes in the generic entry code, fixed up the
32-bit fallout and rewrote change log ]
Signed-off-by: Michal Suchánek <msuchanek@suse.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Shrikanth Hegde <sshegde@linux.ibm.com>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: linux-doc@vger.kernel.org
Cc: loongarch@lists.linux.dev
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-riscv@lists.infradead.org
Cc: linux-s390@vger.kernel.org
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 1: "[01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 17: "[17/18] x86/entry: Simplify the syscall number logic" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
|
Patch 18: "[18/18] entry, treewide: Make syscall_enter_from_user_mode_work indicate syscall execution" |
869345e to
f54dc6c
Compare
4 participants
PR for series 1123316 applied to workflow__riscv__fixes
Name: entry: Consolidate and rework syscall entry handling
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1123316
Version: 1