mirror of
https://github.com/torvalds/linux.git
synced 2026-06-08 14:42:37 +02:00
fe67da49f7
commit 941edc5bf1 upstream.
Use force_fatal_sig instead of calling do_exit directly. This ensures
the ordinary signal handling path gets invoked, core dumps as
appropriate get created, and for multi-threaded processes all of the
threads are terminated not just a single thread.
When asked Gabriel Krisman Bertazi <krisman@collabora.com> said [1]:
> ebiederm@xmission.com (Eric W. Biederman) asked:
>
> > Why does do_syscal_user_dispatch call do_exit(SIGSEGV) and
> > do_exit(SIGSYS) instead of force_sig(SIGSEGV) and force_sig(SIGSYS)?
> >
> > Looking at the code these cases are not expected to happen, so I would
> > be surprised if userspace depends on any particular behaviour on the
> > failure path so I think we can change this.
>
> Hi Eric,
>
> There is not really a good reason, and the use case that originated the
> feature doesn't rely on it.
>
> Unless I'm missing yet another problem and others correct me, I think
> it makes sense to change it as you described.
>
> > Is using do_exit in this way something you copied from seccomp?
>
> I'm not sure, its been a while, but I think it might be just that. The
> first prototype of SUD was implemented as a seccomp mode.
If at some point it becomes interesting we could relax
"force_fatal_sig(SIGSEGV)" to instead say
"force_sig_fault(SIGSEGV, SEGV_MAPERR, sd->selector)".
I avoid doing that in this patch to avoid making it possible
to catch currently uncatchable signals.
Cc: Gabriel Krisman Bertazi <krisman@collabora.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andy Lutomirski <luto@kernel.org>
[1] https://lkml.kernel.org/r/87mtr6gdvi.fsf@collabora.com
Link: https://lkml.kernel.org/r/20211020174406.17889-14-ebiederm@xmission.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: Thomas Backlund <tmb@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
109 lines
2.4 KiB
C
109 lines
2.4 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (C) 2020 Collabora Ltd.
|
|
*/
|
|
#include <linux/sched.h>
|
|
#include <linux/prctl.h>
|
|
#include <linux/syscall_user_dispatch.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/signal.h>
|
|
#include <linux/elf.h>
|
|
|
|
#include <linux/sched/signal.h>
|
|
#include <linux/sched/task_stack.h>
|
|
|
|
#include <asm/syscall.h>
|
|
|
|
#include "common.h"
|
|
|
|
static void trigger_sigsys(struct pt_regs *regs)
|
|
{
|
|
struct kernel_siginfo info;
|
|
|
|
clear_siginfo(&info);
|
|
info.si_signo = SIGSYS;
|
|
info.si_code = SYS_USER_DISPATCH;
|
|
info.si_call_addr = (void __user *)KSTK_EIP(current);
|
|
info.si_errno = 0;
|
|
info.si_arch = syscall_get_arch(current);
|
|
info.si_syscall = syscall_get_nr(current, regs);
|
|
|
|
force_sig_info(&info);
|
|
}
|
|
|
|
bool syscall_user_dispatch(struct pt_regs *regs)
|
|
{
|
|
struct syscall_user_dispatch *sd = ¤t->syscall_dispatch;
|
|
char state;
|
|
|
|
if (likely(instruction_pointer(regs) - sd->offset < sd->len))
|
|
return false;
|
|
|
|
if (unlikely(arch_syscall_is_vdso_sigreturn(regs)))
|
|
return false;
|
|
|
|
if (likely(sd->selector)) {
|
|
/*
|
|
* access_ok() is performed once, at prctl time, when
|
|
* the selector is loaded by userspace.
|
|
*/
|
|
if (unlikely(__get_user(state, sd->selector))) {
|
|
force_fatal_sig(SIGSEGV);
|
|
return true;
|
|
}
|
|
|
|
if (likely(state == SYSCALL_DISPATCH_FILTER_ALLOW))
|
|
return false;
|
|
|
|
if (state != SYSCALL_DISPATCH_FILTER_BLOCK) {
|
|
force_fatal_sig(SIGSYS);
|
|
return true;
|
|
}
|
|
}
|
|
|
|
sd->on_dispatch = true;
|
|
syscall_rollback(current, regs);
|
|
trigger_sigsys(regs);
|
|
|
|
return true;
|
|
}
|
|
|
|
int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,
|
|
unsigned long len, char __user *selector)
|
|
{
|
|
switch (mode) {
|
|
case PR_SYS_DISPATCH_OFF:
|
|
if (offset || len || selector)
|
|
return -EINVAL;
|
|
break;
|
|
case PR_SYS_DISPATCH_ON:
|
|
/*
|
|
* Validate the direct dispatcher region just for basic
|
|
* sanity against overflow and a 0-sized dispatcher
|
|
* region. If the user is able to submit a syscall from
|
|
* an address, that address is obviously valid.
|
|
*/
|
|
if (offset && offset + len <= offset)
|
|
return -EINVAL;
|
|
|
|
if (selector && !access_ok(selector, sizeof(*selector)))
|
|
return -EFAULT;
|
|
|
|
break;
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
|
|
current->syscall_dispatch.selector = selector;
|
|
current->syscall_dispatch.offset = offset;
|
|
current->syscall_dispatch.len = len;
|
|
current->syscall_dispatch.on_dispatch = false;
|
|
|
|
if (mode == PR_SYS_DISPATCH_ON)
|
|
set_syscall_work(SYSCALL_USER_DISPATCH);
|
|
else
|
|
clear_syscall_work(SYSCALL_USER_DISPATCH);
|
|
|
|
return 0;
|
|
}
|