1. 25 7月, 2017 1 次提交
    • E
      signal: Remove kernel interal si_code magic · cc731525
      Eric W. Biederman 提交于
      struct siginfo is a union and the kernel since 2.4 has been hiding a union
      tag in the high 16bits of si_code using the values:
      __SI_KILL
      __SI_TIMER
      __SI_POLL
      __SI_FAULT
      __SI_CHLD
      __SI_RT
      __SI_MESGQ
      __SI_SYS
      
      While this looks plausible on the surface, in practice this situation has
      not worked well.
      
      - Injected positive signals are not copied to user space properly
        unless they have these magic high bits set.
      
      - Injected positive signals are not reported properly by signalfd
        unless they have these magic high bits set.
      
      - These kernel internal values leaked to userspace via ptrace_peek_siginfo
      
      - It was possible to inject these kernel internal values and cause the
        the kernel to misbehave.
      
      - Kernel developers got confused and expected these kernel internal values
        in userspace in kernel self tests.
      
      - Kernel developers got confused and set si_code to __SI_FAULT which
        is SI_USER in userspace which causes userspace to think an ordinary user
        sent the signal and that it was not kernel generated.
      
      - The values make it impossible to reorganize the code to transform
        siginfo_copy_to_user into a plain copy_to_user.  As si_code must
        be massaged before being passed to userspace.
      
      So remove these kernel internal si codes and make the kernel code simpler
      and more maintainable.
      
      To replace these kernel internal magic si_codes introduce the helper
      function siginfo_layout, that takes a signal number and an si_code and
      computes which union member of siginfo is being used.  Have
      siginfo_layout return an enumeration so that gcc will have enough
      information to warn if a switch statement does not handle all of union
      members.
      
      A couple of architectures have a messed up ABI that defines signal
      specific duplications of SI_USER which causes more special cases in
      siginfo_layout than I would like.  The good news is only problem
      architectures pay the cost.
      
      Update all of the code that used the previous magic __SI_ values to
      use the new SIL_ values and to call siginfo_layout to get those
      values.  Escept where not all of the cases are handled remove the
      defaults in the switch statements so that if a new case is missed in
      the future the lack will show up at compile time.
      
      Modify the code that copies siginfo si_code to userspace to just copy
      the value and not cast si_code to a short first.  The high bits are no
      longer used to hold a magic union member.
      
      Fixup the siginfo header files to stop including the __SI_ values in
      their constants and for the headers that were missing it to properly
      update the number of si_codes for each signal type.
      
      The fixes to copy_siginfo_from_user32 implementations has the
      interesting property that several of them perviously should never have
      worked as the __SI_ values they depended up where kernel internal.
      With that dependency gone those implementations should work much
      better.
      
      The idea of not passing the __SI_ values out to userspace and then
      not reinserting them has been tested with criu and criu worked without
      changes.
      
      Ref: 2.4.0-test1
      Signed-off-by: N"Eric W. Biederman" <ebiederm@xmission.com>
      cc731525
  2. 25 12月, 2016 1 次提交
  3. 02 8月, 2016 1 次提交
  4. 13 5月, 2016 1 次提交
  5. 11 11月, 2015 1 次提交
    • A
      MIPS: Initial implementation of a VDSO · ebb5e78c
      Alex Smith 提交于
      Add an initial implementation of a proper (i.e. an ELF shared library)
      VDSO. With this commit it does not export any symbols, it only replaces
      the current signal return trampoline page. A later commit will add user
      implementations of gettimeofday()/clock_gettime().
      
      To support both new toolchains and old ones which don't generate ABI
      flags section, we define its content manually and then use a tool
      (genvdso) to patch up the section to have the correct name and type.
      genvdso also extracts symbol offsets ({,rt_}sigreturn) needed by the
      kernel, and generates a C file containing a "struct mips_vdso_image"
      containing both the VDSO data and these offsets. This C file is
      compiled into the kernel.
      
      On 64-bit kernels we require a different VDSO for each supported ABI,
      so we may build up to 3 different VDSOs. The VDSO to use is selected by
      the mips_abi structure.
      
      A kernel/user shared data page is created and mapped below the VDSO
      image. This is currently empty, but will be used by the user time
      function implementations which are added later.
      
      [markos.chandras@imgtec.com:
      - Add more comments
      - Move abi detection in genvdso.h since it's the get_symbol function
      that needs it.
      - Add an R6 specific way to calculate the base address of VDSO in order
      to avoid the branch instruction which affects performance.
      - Do not patch .gnu.attributes since it's not needed for dynamic linking.
      - Simplify Makefile a little bit.
      - checkpatch fixes
      - Restrict VDSO support for binutils < 2.25 for pre-R6
      - Include atomic64.h for O32 variant on MIPS64]
      Signed-off-by: NAlex Smith <alex.smith@imgtec.com>
      Signed-off-by: NMarkos Chandras <markos.chandras@imgtec.com>
      Cc: Matthew Fortune <matthew.fortune@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/11337/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      ebb5e78c
  6. 03 9月, 2015 3 次提交
  7. 07 8月, 2015 1 次提交
    • A
      signal: fix information leak in copy_siginfo_from_user32 · 3c00cb5e
      Amanieu d'Antras 提交于
      This function can leak kernel stack data when the user siginfo_t has a
      positive si_code value.  The top 16 bits of si_code descibe which fields
      in the siginfo_t union are active, but they are treated inconsistently
      between copy_siginfo_from_user32, copy_siginfo_to_user32 and
      copy_siginfo_to_user.
      
      copy_siginfo_from_user32 is called from rt_sigqueueinfo and
      rt_tgsigqueueinfo in which the user has full control overthe top 16 bits
      of si_code.
      
      This fixes the following information leaks:
      x86:   8 bytes leaked when sending a signal from a 32-bit process to
             itself. This leak grows to 16 bytes if the process uses x32.
             (si_code = __SI_CHLD)
      x86:   100 bytes leaked when sending a signal from a 32-bit process to
             a 64-bit process. (si_code = -1)
      sparc: 4 bytes leaked when sending a signal from a 32-bit process to a
             64-bit process. (si_code = any)
      
      parsic and s390 have similar bugs, but they are not vulnerable because
      rt_[tg]sigqueueinfo have checks that prevent sending a positive si_code
      to a different process.  These bugs are also fixed for consistency.
      Signed-off-by: NAmanieu d'Antras <amanieu@gmail.com>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Russell King <rmk@arm.linux.org.uk>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Chris Metcalf <cmetcalf@ezchip.com>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3c00cb5e
  8. 13 2月, 2015 1 次提交
    • A
      all arches, signal: move restart_block to struct task_struct · f56141e3
      Andy Lutomirski 提交于
      If an attacker can cause a controlled kernel stack overflow, overwriting
      the restart block is a very juicy exploit target.  This is because the
      restart_block is held in the same memory allocation as the kernel stack.
      
      Moving the restart block to struct task_struct prevents this exploit by
      making the restart_block harder to locate.
      
      Note that there are other fields in thread_info that are also easy
      targets, at least on some architectures.
      
      It's also a decent simplification, since the restart code is more or less
      identical on all architectures.
      
      [james.hogan@imgtec.com: metag: align thread_info::supervisor_stack]
      Signed-off-by: NAndy Lutomirski <luto@amacapital.net>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: David Miller <davem@davemloft.net>
      Acked-by: NRichard Weinberger <richard@nod.at>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
      Cc: Matt Turner <mattst88@gmail.com>
      Cc: Vineet Gupta <vgupta@synopsys.com>
      Cc: Russell King <rmk@arm.linux.org.uk>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Haavard Skinnemoen <hskinnemoen@gmail.com>
      Cc: Hans-Christian Egtvedt <egtvedt@samfundet.no>
      Cc: Steven Miao <realmz6@gmail.com>
      Cc: Mark Salter <msalter@redhat.com>
      Cc: Aurelien Jacquiot <a-jacquiot@ti.com>
      Cc: Mikael Starvik <starvik@axis.com>
      Cc: Jesper Nilsson <jesper.nilsson@axis.com>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Richard Kuo <rkuo@codeaurora.org>
      Cc: "Luck, Tony" <tony.luck@intel.com>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Cc: Michal Simek <monstr@monstr.eu>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Jonas Bonn <jonas@southpole.se>
      Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
      Cc: Helge Deller <deller@gmx.de>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
      Tested-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
      Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: Chen Liqin <liqin.linux@gmail.com>
      Cc: Lennox Wu <lennox.wu@gmail.com>
      Cc: Chris Metcalf <cmetcalf@ezchip.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Chris Zankel <chris@zankel.net>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Guenter Roeck <linux@roeck-us.net>
      Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      f56141e3
  9. 06 8月, 2014 2 次提交
  10. 26 6月, 2014 1 次提交
    • P
      Revert "MIPS: Save/restore MSA context around signals" · 16f77de8
      Paul Burton 提交于
      This reverts commit eec43a22 "MIPS: Save/restore MSA context around
      signals" and the MSA parts of ca750649 "MIPS: kernel: signal:
      Prevent save/restore FPU context in user memory" (the restore path of
      which appears incorrect anyway...).
      
      The reverted patch took care not to break compatibility with userland
      users of struct sigcontext, but inadvertantly changed the offset of the
      uc_sigmask field of struct ucontext. Thus Linux v3.15 breaks the
      userland ABI. The MSA context will need to be saved via some other
      opt-in mechanism, but for now revert the change to reduce the fallout.
      
      This will have minimal impact upon use of MSA since the only supported
      CPU which includes it (the P5600) is 32-bit and therefore requires that
      the experimental CONFIG_MIPS_O32_FP64_SUPPORT Kconfig option be selected
      before the kernel will set FR=1 for a task, a requirement for MSA use.
      Thus the users of MSA are limited to known small groups of people & this
      patch won't be breaking any previously working MSA-using userland
      outside of experimental settings.
      
      [ralf@linux-mips.org: Fixed rejects.]
      
      Cc: stable@vger.kernel.org
      Reported-by: NJoseph S. Myers <joseph@codesourcery.com>
      Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Cc: stable@vger.kernel.org
      Patchwork: https://patchwork.linux-mips.org/patch/7107/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      16f77de8
  11. 27 3月, 2014 4 次提交
  12. 14 1月, 2014 1 次提交
    • P
      MIPS: Support for 64-bit FP with O32 binaries · 597ce172
      Paul Burton 提交于
      CPUs implementing MIPS32 R2 may include a 64-bit FPU, just as MIPS64 CPUs
      do. In order to preserve backwards compatibility a 64-bit FPU will act
      like a 32-bit FPU (by accessing doubles from the least significant 32
      bits of an even-odd pair of FP registers) when the Status.FR bit is
      zero, again just like a mips64 CPU. The standard O32 ABI is defined
      expecting a 32-bit FPU, however recent toolchains support use of a
      64-bit FPU from an O32 MIPS32 executable. When an ELF executable is
      built to use a 64-bit FPU a new flag (EF_MIPS_FP64) is set in the ELF
      header.
      
      With this patch the kernel will check the EF_MIPS_FP64 flag when
      executing an O32 binary, and set Status.FR accordingly. The addition
      of O32 64-bit FP support lessens the opportunity for optimisation in
      the FPU emulator, so a CONFIG_MIPS_O32_FP64_SUPPORT Kconfig option is
      introduced to allow this support to be disabled for those that don't
      require it.
      
      Inspired by an earlier patch by Leonid Yegoshin, but implemented more
      cleanly & correctly.
      Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Cc: Paul Burton <paul.burton@imgtec.com>
      Patchwork: https://patchwork.linux-mips.org/patch/6154/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      597ce172
  13. 09 11月, 2013 1 次提交
  14. 04 2月, 2013 8 次提交
  15. 01 2月, 2013 1 次提交
  16. 02 6月, 2012 1 次提交
  17. 22 5月, 2012 1 次提交
  18. 27 4月, 2012 1 次提交
    • M
      MIPS: Use set_current_blocked() and block_sigmask() · 8598f3cd
      Matt Fleming 提交于
      As described in e6fa16ab ("signal: sigprocmask() should do
      retarget_shared_pending()") the modification of current->blocked is
      incorrect as we need to check whether the signal we're about to block
      is pending in the shared queue.
      
      Also, use the new helper function introduced in commit 5e6292c0
      ("signal: add block_sigmask() for adding sigmask to current->blocked")
      which centralises the code for updating current->blocked after
      successfully delivering a signal and reduces the amount of duplicate
      code across architectures. In the past some architectures got this
      code wrong, so using this helper function should stop that from
      happening again.
      
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: linux-kernel@vger.kernel.org
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: David Daney <ddaney@caviumnetworks.com>
      Cc: linux-mips@linux-mips.org
      Signed-off-by: NMatt Fleming <matt.fleming@intel.com>
      Patchwork: https://patchwork.linux-mips.org/patch/3363/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      8598f3cd
  19. 29 3月, 2012 1 次提交
  20. 15 3月, 2011 1 次提交
  21. 13 4月, 2010 1 次提交
    • D
      MIPS: Move signal trampolines off of the stack. · d814c28c
      David Daney 提交于
      This is a follow on to the vdso patch.
      
      Since all processes now have signal trampolines permanently mapped, we
      can use those instead of putting the trampoline on the stack and
      invalidating the corresponding icache across all CPUs.  We also get rid
      of a bunch of ICACHE_REFILLS_WORKAROUND_WAR code.
      
      [Ralf: GDB 7.1 which has the necessary modifications to allow backtracing
      over signal frames will supposedly be released tomorrow.  The old signal
      frame format obsoleted by this patch exists in two variations, for sane
      processors and for those requiring ICACHE_REFILLS_WORKAROUND_WAR.  So
      there was never a GDB which did support backtracing over signal frames
      on all MIPS systems.  This convinved me this series should be applied and
      pushed upstream as soon as possible.]
      Signed-off-by: NDavid Daney <ddaney@caviumnetworks.com>
      To: linux-mips@linux-mips.org
      Patchwork: http://patchwork.linux-mips.org/patch/974/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      d814c28c
  22. 17 12月, 2009 1 次提交
  23. 28 2月, 2009 1 次提交
  24. 11 10月, 2008 1 次提交
  25. 12 10月, 2007 1 次提交
  26. 01 8月, 2007 1 次提交
  27. 27 6月, 2007 1 次提交