github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-26 08:02:27 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

powerpc/rtas: Avoid warning on invalid token argument to sys_rtas()

Browse Source 
rtas_token_to_function() WARNs when passed an invalid token; it's
meant to catch bugs in kernel-based users of RTAS functions. However,
user space controls the token value passed to rtas_token_to_function()
by block_rtas_call(), so user space with sufficient privilege to use
sys_rtas() can trigger the warnings at will:

  unexpected failed lookup for token 2048
  WARNING: CPU: 20 PID: 2247 at arch/powerpc/kernel/rtas.c:556
    rtas_token_to_function+0xfc/0x110
  ...
  NIP rtas_token_to_function+0xfc/0x110
  LR  rtas_token_to_function+0xf8/0x110
  Call Trace:
    rtas_token_to_function+0xf8/0x110 (unreliable)
    sys_rtas+0x188/0x880
    system_call_exception+0x268/0x530
    system_call_common+0x160/0x2c4

It's desirable to continue warning on bogus tokens in
rtas_token_to_function(). Currently it is used to look up RTAS
function descriptors when tracing, where we know there has to have
been a successful descriptor lookup by different means already, and it
would be a serious inconsistency for the reverse lookup to fail.

So instead of weakening rtas_token_to_function()'s contract by
removing the warnings, introduce rtas_token_to_function_untrusted(),
which has no opinion on failed lookups. Convert block_rtas_call() and
rtas_token_to_function() to use it.

Fixes: 8252b88294 ("powerpc/rtas: improve function information lookups")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231212-papr-sys_rtas-vs-lockdown-v6-1-e9eafd0c8c6c@linux.ibm.com
This commit is contained in:
Nathan Lynch 2023-12-12 11:01:48 -06:00 committed by Michael Ellerman
parent 070b71f428
commit 01e346ffef
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
arch/powerpc/kernel/rtas.c
View File

@ -544,6 +544,21 @@ static int __init rtas_token_to_function_xarray_init(void)
}
arch_initcall(rtas_token_to_function_xarray_init);
/*
* For use by sys_rtas(), where the token value is provided by user
* space and we don't want to warn on failed lookups.
*/
static const struct rtas_function *rtas_token_to_function_untrusted(s32 token)
{
return xa_load(&rtas_token_to_function_xarray, token);
}
/*
* Reverse lookup for deriving the function descriptor from a
* known-good token value in contexts where the former is not already
* available. @token must be valid, e.g. derived from the result of a
* prior lookup against the function table.
*/
static const struct rtas_function *rtas_token_to_function(s32 token)
{
const struct rtas_function *func;
@ -551,7 +566,7 @@ static const struct rtas_function *rtas_token_to_function(s32 token)
if (WARN_ONCE(token < 0, "invalid token %d", token))
return NULL;
func = xa_load(&rtas_token_to_function_xarray, token);
func = rtas_token_to_function_untrusted(token);
if (WARN_ONCE(!func, "unexpected failed lookup for token %d", token))
return NULL;
@ -1721,7 +1736,7 @@ static bool block_rtas_call(int token, int nargs,
* If this token doesn't correspond to a function the kernel
* understands, you're not allowed to call it.
*/
func = rtas_token_to_function(token);
func = rtas_token_to_function_untrusted(token);
if (!func)
goto err;
/*