vsyscall_64.c 8.4 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0
L
Linus Torvalds 已提交
2
/*
3 4 5
 * Copyright (c) 2012-2014 Andy Lutomirski <luto@amacapital.net>
 *
 * Based on the original implementation which is:
L
Linus Torvalds 已提交
6 7 8
 *  Copyright (C) 2001 Andrea Arcangeli <andrea@suse.de> SuSE
 *  Copyright 2003 Andi Kleen, SuSE Labs.
 *
9 10 11 12 13
 *  Parts of the original code have been moved to arch/x86/vdso/vma.c
 *
 * This file implements vsyscall emulation.  vsyscalls are a legacy ABI:
 * Userspace can request certain kernel services by calling fixed
 * addresses.  This concept is problematic:
14
 *
15 16 17 18 19
 * - It interferes with ASLR.
 * - It's awkward to write code that lives in kernel addresses but is
 *   callable by userspace at fixed addresses.
 * - The whole concept is impossible for 32-bit compat userspace.
 * - UML cannot easily virtualize a vsyscall.
L
Linus Torvalds 已提交
20
 *
21 22 23
 * As of mid-2014, I believe that there is no new userspace code that
 * will use a vsyscall if the vDSO is present.  I hope that there will
 * soon be no new userspace code that will ever use a vsyscall.
L
Linus Torvalds 已提交
24
 *
25 26
 * The code in this file emulates vsyscalls when notified of a page
 * fault to a vsyscall address.
L
Linus Torvalds 已提交
27 28 29 30
 */

#include <linux/kernel.h>
#include <linux/timer.h>
31
#include <linux/sched/signal.h>
32
#include <linux/mm_types.h>
33 34
#include <linux/syscalls.h>
#include <linux/ratelimit.h>
L
Linus Torvalds 已提交
35 36

#include <asm/vsyscall.h>
37
#include <asm/unistd.h>
L
Linus Torvalds 已提交
38
#include <asm/fixmap.h>
39
#include <asm/traps.h>
L
Linus Torvalds 已提交
40

41 42 43
#define CREATE_TRACE_POINTS
#include "vsyscall_trace.h"

44
static enum { EMULATE, NATIVE, NONE } vsyscall_mode =
45
#if defined(CONFIG_LEGACY_VSYSCALL_NATIVE)
46
	NATIVE;
47
#elif defined(CONFIG_LEGACY_VSYSCALL_NONE)
48 49 50 51
	NONE;
#else
	EMULATE;
#endif
52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71

static int __init vsyscall_setup(char *str)
{
	if (str) {
		if (!strcmp("emulate", str))
			vsyscall_mode = EMULATE;
		else if (!strcmp("native", str))
			vsyscall_mode = NATIVE;
		else if (!strcmp("none", str))
			vsyscall_mode = NONE;
		else
			return -EINVAL;

		return 0;
	}

	return -EINVAL;
}
early_param("vsyscall", vsyscall_setup);

72 73
static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
			      const char *message)
L
Linus Torvalds 已提交
74
{
75
	if (!show_unhandled_signals)
76
		return;
L
Linus Torvalds 已提交
77

78 79 80 81
	printk_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
			   level, current->comm, task_pid_nr(current),
			   message, regs->ip, regs->cs,
			   regs->sp, regs->ax, regs->si, regs->di);
82 83 84 85 86 87
}

static int addr_to_vsyscall_nr(unsigned long addr)
{
	int nr;

88
	if ((addr & ~0xC00UL) != VSYSCALL_ADDR)
89 90 91 92 93 94 95
		return -EINVAL;

	nr = (addr & 0xC00UL) >> 10;
	if (nr >= 3)
		return -EINVAL;

	return nr;
L
Linus Torvalds 已提交
96 97
}

98 99 100 101
static bool write_ok_or_segv(unsigned long ptr, size_t size)
{
	/*
	 * XXX: if access_ok, get_user, and put_user handled
102
	 * sig_on_uaccess_err, this could go away.
103 104 105 106 107 108 109 110
	 */

	if (!access_ok(VERIFY_WRITE, (void __user *)ptr, size)) {
		siginfo_t info;
		struct thread_struct *thread = &current->thread;

		thread->error_code	= 6;  /* user fault, no page, write */
		thread->cr2		= ptr;
111
		thread->trap_nr		= X86_TRAP_PF;
112 113 114 115 116 117 118 119 120 121 122 123 124 125

		memset(&info, 0, sizeof(info));
		info.si_signo		= SIGSEGV;
		info.si_errno		= 0;
		info.si_code		= SEGV_MAPERR;
		info.si_addr		= (void __user *)ptr;

		force_sig_info(SIGSEGV, &info, current);
		return false;
	} else {
		return true;
	}
}

126
bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
L
Linus Torvalds 已提交
127
{
128 129
	struct task_struct *tsk;
	unsigned long caller;
130
	int vsyscall_nr, syscall_nr, tmp;
131
	int prev_sig_on_uaccess_err;
132 133
	long ret;

134 135 136 137
	/*
	 * No point in checking CS -- the only way to get here is a user mode
	 * trap to a high address, which means that we're in 64-bit user code.
	 */
138

139
	WARN_ON_ONCE(address != regs->ip);
140

141 142 143 144
	if (vsyscall_mode == NONE) {
		warn_bad_vsyscall(KERN_INFO, regs,
				  "vsyscall attempted with vsyscall=none");
		return false;
145 146
	}

147
	vsyscall_nr = addr_to_vsyscall_nr(address);
148 149 150

	trace_emulate_vsyscall(vsyscall_nr);

151 152
	if (vsyscall_nr < 0) {
		warn_bad_vsyscall(KERN_WARNING, regs,
153
				  "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround");
154 155
		goto sigsegv;
	}
J
john stultz 已提交
156

157
	if (get_user(caller, (unsigned long __user *)regs->sp) != 0) {
158 159
		warn_bad_vsyscall(KERN_WARNING, regs,
				  "vsyscall with bad stack (exploit attempt?)");
160 161
		goto sigsegv;
	}
162

163
	tsk = current;
164 165

	/*
166 167
	 * Check for access_ok violations and find the syscall nr.
	 *
168
	 * NULL is a valid user pointer (in the access_ok sense) on 32-bit and
169
	 * 64-bit, so we don't need to special-case it here.  For all the
170
	 * vsyscalls, NULL means "don't write anything" not "write it at
171 172
	 * address 0".
	 */
173 174
	switch (vsyscall_nr) {
	case 0:
175
		if (!write_ok_or_segv(regs->di, sizeof(struct timeval)) ||
176 177 178 179
		    !write_ok_or_segv(regs->si, sizeof(struct timezone))) {
			ret = -EFAULT;
			goto check_fault;
		}
180

181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212
		syscall_nr = __NR_gettimeofday;
		break;

	case 1:
		if (!write_ok_or_segv(regs->di, sizeof(time_t))) {
			ret = -EFAULT;
			goto check_fault;
		}

		syscall_nr = __NR_time;
		break;

	case 2:
		if (!write_ok_or_segv(regs->di, sizeof(unsigned)) ||
		    !write_ok_or_segv(regs->si, sizeof(unsigned))) {
			ret = -EFAULT;
			goto check_fault;
		}

		syscall_nr = __NR_getcpu;
		break;
	}

	/*
	 * Handle seccomp.  regs->ip must be the original value.
	 * See seccomp_send_sigsys and Documentation/prctl/seccomp_filter.txt.
	 *
	 * We could optimize the seccomp disabled case, but performance
	 * here doesn't matter.
	 */
	regs->orig_ax = syscall_nr;
	regs->ax = -ENOSYS;
213
	tmp = secure_computing(NULL);
214 215 216 217 218
	if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
		warn_bad_vsyscall(KERN_DEBUG, regs,
				  "seccomp tried to change syscall nr or ip");
		do_exit(SIGSYS);
	}
219
	regs->orig_ax = -1;
220 221 222 223 224 225 226
	if (tmp)
		goto do_ret;  /* skip requested */

	/*
	 * With a real vsyscall, page faults cause SIGSEGV.  We want to
	 * preserve that behavior to make writing exploits harder.
	 */
227 228
	prev_sig_on_uaccess_err = current->thread.sig_on_uaccess_err;
	current->thread.sig_on_uaccess_err = 1;
229 230 231 232

	ret = -EFAULT;
	switch (vsyscall_nr) {
	case 0:
233 234 235 236 237 238 239 240 241 242 243 244
		ret = sys_gettimeofday(
			(struct timeval __user *)regs->di,
			(struct timezone __user *)regs->si);
		break;

	case 1:
		ret = sys_time((time_t __user *)regs->di);
		break;

	case 2:
		ret = sys_getcpu((unsigned __user *)regs->di,
				 (unsigned __user *)regs->si,
245
				 NULL);
246 247
		break;
	}
248

249
	current->thread.sig_on_uaccess_err = prev_sig_on_uaccess_err;
250

251
check_fault:
252
	if (ret == -EFAULT) {
253
		/* Bad news -- userspace fed a bad pointer to a vsyscall. */
254 255
		warn_bad_vsyscall(KERN_INFO, regs,
				  "vsyscall fault (exploit attempt?)");
256 257 258 259 260 261 262 263 264 265

		/*
		 * If we failed to generate a signal for any reason,
		 * generate one here.  (This should be impossible.)
		 */
		if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) &&
				 !sigismember(&tsk->pending.signal, SIGSEGV)))
			goto sigsegv;

		return true;  /* Don't emulate the ret. */
266
	}
267

268
	regs->ax = ret;
L
Linus Torvalds 已提交
269

270
do_ret:
271 272 273
	/* Emulate a ret instruction. */
	regs->ip = caller;
	regs->sp += 8;
274
	return true;
275 276 277

sigsegv:
	force_sig(SIGSEGV, current);
278
	return true;
L
Linus Torvalds 已提交
279 280
}

281 282 283 284 285 286 287 288 289
/*
 * A pseudo VMA to allow ptrace access for the vsyscall page.  This only
 * covers the 64bit vsyscall page now. 32bit has a real VMA now and does
 * not need special handling anymore:
 */
static const char *gate_vma_name(struct vm_area_struct *vma)
{
	return "[vsyscall]";
}
290
static const struct vm_operations_struct gate_vma_ops = {
291 292 293 294 295 296 297 298 299 300 301 302
	.name = gate_vma_name,
};
static struct vm_area_struct gate_vma = {
	.vm_start	= VSYSCALL_ADDR,
	.vm_end		= VSYSCALL_ADDR + PAGE_SIZE,
	.vm_page_prot	= PAGE_READONLY_EXEC,
	.vm_flags	= VM_READ | VM_EXEC,
	.vm_ops		= &gate_vma_ops,
};

struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
{
303
#ifdef CONFIG_COMPAT
304 305 306
	if (!mm || mm->context.ia32_compat)
		return NULL;
#endif
307 308
	if (vsyscall_mode == NONE)
		return NULL;
309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328
	return &gate_vma;
}

int in_gate_area(struct mm_struct *mm, unsigned long addr)
{
	struct vm_area_struct *vma = get_gate_vma(mm);

	if (!vma)
		return 0;

	return (addr >= vma->vm_start) && (addr < vma->vm_end);
}

/*
 * Use this when you have no reliable mm, typically from interrupt
 * context. It is less reliable than using a task's mm and may give
 * false positives.
 */
int in_gate_area_no_mm(unsigned long addr)
{
329
	return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR;
330 331
}

I
Ingo Molnar 已提交
332
void __init map_vsyscall(void)
L
Linus Torvalds 已提交
333
{
334 335
	extern char __vsyscall_page;
	unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
L
Linus Torvalds 已提交
336

337 338 339 340 341 342
	if (vsyscall_mode != NONE)
		__set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
			     vsyscall_mode == NATIVE
			     ? PAGE_KERNEL_VSYSCALL
			     : PAGE_KERNEL_VVAR);

343 344
	BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
		     (unsigned long)VSYSCALL_ADDR);
L
Linus Torvalds 已提交
345
}