github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry

Browse Source 
Commit e057b94772 ("arm64: syscall: Ensure saved x0 is kept in-sync
with tracer updates") attempted to resolve a long-standing issue with
syscall entry tracing, where a tracer is able to manipulate the first
syscall argument without being subjected to seccomp or audit checking.

Unfortunately, that fix was incomplete [1], as it failed to update
'orig_x0' between a tracer updating x0 during a seccomp ptrace exit
(SECCOMP_RET_TRACE) and the seccomp filter being re-evaluated.

Rather than add hooks to the core seccomp code, instead move the
synchronisation code into the ptrace GPR and syscall setting code so
that 'orig_x0' is kept up to date with x0 whenever we're stopped on the
syscall entry path.

Cc: Kees Cook <kees@kernel.org>
Cc: Jinjie Ruan <ruanjinjie@huawei.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Link: https://sashiko.dev/#/patchset/20260716120640.6590-1-will@kernel.org [1]
Reported-by: Yiqi Sun <sunyiqixm@gmail.com>
Link: https://lore.kernel.org/all/20260529065444.1336608-1-sunyiqixm@gmail.com/
Fixes: e057b94772 ("arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates")
Fixes: a5cd110cb8 ("arm64/ptrace: run seccomp after ptrace")
Tested-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Will Deacon <will@kernel.org>
This commit is contained in:
Will Deacon 2026-07-30 14:26:50 +01:00
parent c3f83d0211
commit 88b839ce49
1 changed files with 50 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
arch/arm64/kernel/ptrace.c
View File

@ -560,6 +560,42 @@ static int gpr_get(struct task_struct *target,
return membuf_write(&to, uregs, sizeof(*uregs));
}
static void update_syscall_orig_x0_after_ptrace(struct task_struct *target)
{
struct pt_regs *regs = task_pt_regs(target);
struct kernel_siginfo *info = target->last_siginfo;
/*
* Skip the update for NO_SYSCALL (set either by the user or the
* tracer), as regs[0] holds the return value (see the comment in
* el0_svc_common()) and can be unwound using syscall_rollback().
*/
if (regs->syscallno == NO_SYSCALL)
return;
/* We should only be called when target is in a ptrace stop */
if (WARN_ON_ONCE(!info))
return;
/*
* For compat tasks, orig_r0 is provided directly through GPR index
* 17.
*/
if (is_compat_thread(task_thread_info(target)))
return;
/*
* Don't update orig_x0 for a syscall-exit-stop, as x0 now contains the
* return value of the system call.
*/
if ((info->si_code & ~0x80) == SIGTRAP &&
target->ptrace_message == PTRACE_EVENTMSG_SYSCALL_EXIT) {
return;
}
regs->orig_x0 = regs->regs[0];
}
static int gpr_set(struct task_struct *target, const struct user_regset *regset,
unsigned int pos, unsigned int count,
const void *kbuf, const void __user *ubuf)
@ -575,6 +611,14 @@ static int gpr_set(struct task_struct *target, const struct user_regset *regset,
return -EINVAL;
task_pt_regs(target)->user_regs = newregs;
/*
* Keep orig_x0 authoritative so that seccomp (via
* syscall_get_arguments()), audit and the restart path all see the same
* first argument the syscall is dispatched with, even if it has been
* updated by a tracer.
*/
update_syscall_orig_x0_after_ptrace(target);
return 0;
}
@ -753,6 +797,12 @@ static int system_call_set(struct task_struct *target,
return ret;
task_pt_regs(target)->syscallno = syscallno;
/*
* Re-sync orig_x0 in case the syscall number has been changed
* from NO_SYSCALL.
*/
update_syscall_orig_x0_after_ptrace(target);
return ret;
}