From patchwork Fri Aug 11 20:56:50 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Hogan X-Patchwork-Id: 800745 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3xTcm63Q6mz9sR9 for ; Sat, 12 Aug 2017 06:58:14 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753812AbdHKU5f (ORCPT ); Fri, 11 Aug 2017 16:57:35 -0400 Received: from mailapp01.imgtec.com ([195.59.15.196]:48187 "EHLO mailapp01.imgtec.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753627AbdHKU5c (ORCPT ); Fri, 11 Aug 2017 16:57:32 -0400 Received: from hhmail02.hh.imgtec.org (unknown [10.100.10.20]) by Forcepoint Email with ESMTPS id F3AA4A517A422; Fri, 11 Aug 2017 21:57:25 +0100 (IST) Received: from jhogan-linux.le.imgtec.org (192.168.154.110) by hhmail02.hh.imgtec.org (10.100.10.21) with Microsoft SMTP Server (TLS) id 14.3.294.0; Fri, 11 Aug 2017 21:57:30 +0100 From: James Hogan To: CC: , James Hogan , Ralf Baechle , David Daney , Kees Cook , Andy Lutomirski , Will Drewry , Oleg Nesterov , Alexei Starovoitov , Daniel Borkmann , Subject: [PATCH 1/4] MIPS/seccomp: Fix indirect syscall args Date: Fri, 11 Aug 2017 21:56:50 +0100 Message-ID: <20170811205653.21873-2-james.hogan@imgtec.com> X-Mailer: git-send-email 2.13.2 In-Reply-To: <20170811205653.21873-1-james.hogan@imgtec.com> References: <20170811205653.21873-1-james.hogan@imgtec.com> MIME-Version: 1.0 X-Originating-IP: [192.168.154.110] Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Since commit 669c4092225f ("MIPS: Give __secure_computing() access to syscall arguments."), upon syscall entry when seccomp is enabled, syscall_trace_enter() passes a carefully prepared struct seccomp_data containing syscall arguments to __secure_computing(). Unfortunately it directly uses mips_get_syscall_arg() and fails to take into account the indirect O32 system calls (i.e. syscall(2)) which put the system call number in a0 and have the arguments shifted up by one entry. We can't just revert that commit as samples/bpf/tracex5 would break again, so use syscall_get_arguments() which already takes indirect syscalls into account instead of directly using mips_get_syscall_arg(), similar to what populate_seccomp_data() does. This also removes the redundant error checking of the mips_get_syscall_arg() return value (get_user() already zeroes the result if an argument from the stack can't be loaded). Reported-by: James Cowgill Fixes: 669c4092225f ("MIPS: Give __secure_computing() access to syscall arguments.") Signed-off-by: James Hogan Cc: Ralf Baechle Cc: David Daney Cc: Kees Cook Cc: Andy Lutomirski Cc: Will Drewry Cc: Oleg Nesterov Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-mips@linux-mips.org Reviewed-by: Kees Cook --- It would have been much simpler for MIPS arch code to just pass a NULL seccomp_data to secure_computing() so populate_seccomp_data() would take care of fetching arguments, as it did for MIPS prior to commit 669c4092225f ("MIPS: Give __secure_computing() access to syscall arguments."), but as that commit mentions it breaks samples/bpf/tracex5, which relies on sd being non-NULL at entry to __seccomp_filter(). Arguably the samples/bpf/tracex5 test is flawed, at least for every arch except x86 (and now MIPS). --- arch/mips/kernel/ptrace.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c index 6dd13641a418..1395654cfc8d 100644 --- a/arch/mips/kernel/ptrace.c +++ b/arch/mips/kernel/ptrace.c @@ -872,15 +872,13 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall) if (unlikely(test_thread_flag(TIF_SECCOMP))) { int ret, i; struct seccomp_data sd; + unsigned long args[6]; sd.nr = syscall; sd.arch = syscall_get_arch(); - for (i = 0; i < 6; i++) { - unsigned long v, r; - - r = mips_get_syscall_arg(&v, current, regs, i); - sd.args[i] = r ? 0 : v; - } + syscall_get_arguments(current, regs, 0, 6, args); + for (i = 0; i < 6; i++) + sd.args[i] = args[i]; sd.instruction_pointer = KSTK_EIP(current); ret = __secure_computing(&sd);