vsyscall_64.c 9.3 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0
L
Linus Torvalds 已提交
2
/*
3 4 5
 * Copyright (c) 2012-2014 Andy Lutomirski <luto@amacapital.net>
 *
 * Based on the original implementation which is:
L
Linus Torvalds 已提交
6 7 8
 *  Copyright (C) 2001 Andrea Arcangeli <andrea@suse.de> SuSE
 *  Copyright 2003 Andi Kleen, SuSE Labs.
 *
9 10 11 12 13
 *  Parts of the original code have been moved to arch/x86/vdso/vma.c
 *
 * This file implements vsyscall emulation.  vsyscalls are a legacy ABI:
 * Userspace can request certain kernel services by calling fixed
 * addresses.  This concept is problematic:
14
 *
15 16 17 18 19
 * - It interferes with ASLR.
 * - It's awkward to write code that lives in kernel addresses but is
 *   callable by userspace at fixed addresses.
 * - The whole concept is impossible for 32-bit compat userspace.
 * - UML cannot easily virtualize a vsyscall.
L
Linus Torvalds 已提交
20
 *
21 22 23
 * As of mid-2014, I believe that there is no new userspace code that
 * will use a vsyscall if the vDSO is present.  I hope that there will
 * soon be no new userspace code that will ever use a vsyscall.
L
Linus Torvalds 已提交
24
 *
25 26
 * The code in this file emulates vsyscalls when notified of a page
 * fault to a vsyscall address.
L
Linus Torvalds 已提交
27 28 29 30
 */

#include <linux/kernel.h>
#include <linux/timer.h>
31
#include <linux/sched/signal.h>
32
#include <linux/mm_types.h>
33 34
#include <linux/syscalls.h>
#include <linux/ratelimit.h>
L
Linus Torvalds 已提交
35 36

#include <asm/vsyscall.h>
37
#include <asm/unistd.h>
L
Linus Torvalds 已提交
38
#include <asm/fixmap.h>
39
#include <asm/traps.h>
40
#include <asm/paravirt.h>
L
Linus Torvalds 已提交
41

42 43 44
#define CREATE_TRACE_POINTS
#include "vsyscall_trace.h"

45
static enum { EMULATE, NATIVE, NONE } vsyscall_mode =
46
#if defined(CONFIG_LEGACY_VSYSCALL_NATIVE)
47
	NATIVE;
48
#elif defined(CONFIG_LEGACY_VSYSCALL_NONE)
49 50 51 52
	NONE;
#else
	EMULATE;
#endif
53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72

static int __init vsyscall_setup(char *str)
{
	if (str) {
		if (!strcmp("emulate", str))
			vsyscall_mode = EMULATE;
		else if (!strcmp("native", str))
			vsyscall_mode = NATIVE;
		else if (!strcmp("none", str))
			vsyscall_mode = NONE;
		else
			return -EINVAL;

		return 0;
	}

	return -EINVAL;
}
early_param("vsyscall", vsyscall_setup);

73 74
static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
			      const char *message)
L
Linus Torvalds 已提交
75
{
76
	if (!show_unhandled_signals)
77
		return;
L
Linus Torvalds 已提交
78

79 80 81 82
	printk_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
			   level, current->comm, task_pid_nr(current),
			   message, regs->ip, regs->cs,
			   regs->sp, regs->ax, regs->si, regs->di);
83 84 85 86 87 88
}

static int addr_to_vsyscall_nr(unsigned long addr)
{
	int nr;

89
	if ((addr & ~0xC00UL) != VSYSCALL_ADDR)
90 91 92 93 94 95 96
		return -EINVAL;

	nr = (addr & 0xC00UL) >> 10;
	if (nr >= 3)
		return -EINVAL;

	return nr;
L
Linus Torvalds 已提交
97 98
}

99 100 101 102
static bool write_ok_or_segv(unsigned long ptr, size_t size)
{
	/*
	 * XXX: if access_ok, get_user, and put_user handled
103
	 * sig_on_uaccess_err, this could go away.
104 105 106 107 108 109 110 111
	 */

	if (!access_ok(VERIFY_WRITE, (void __user *)ptr, size)) {
		siginfo_t info;
		struct thread_struct *thread = &current->thread;

		thread->error_code	= 6;  /* user fault, no page, write */
		thread->cr2		= ptr;
112
		thread->trap_nr		= X86_TRAP_PF;
113 114 115 116 117 118 119 120 121 122 123 124 125 126

		memset(&info, 0, sizeof(info));
		info.si_signo		= SIGSEGV;
		info.si_errno		= 0;
		info.si_code		= SEGV_MAPERR;
		info.si_addr		= (void __user *)ptr;

		force_sig_info(SIGSEGV, &info, current);
		return false;
	} else {
		return true;
	}
}

127
bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
L
Linus Torvalds 已提交
128
{
129 130
	struct task_struct *tsk;
	unsigned long caller;
131
	int vsyscall_nr, syscall_nr, tmp;
132
	int prev_sig_on_uaccess_err;
133 134
	long ret;

135 136 137 138
	/*
	 * No point in checking CS -- the only way to get here is a user mode
	 * trap to a high address, which means that we're in 64-bit user code.
	 */
139

140
	WARN_ON_ONCE(address != regs->ip);
141

142 143 144 145
	if (vsyscall_mode == NONE) {
		warn_bad_vsyscall(KERN_INFO, regs,
				  "vsyscall attempted with vsyscall=none");
		return false;
146 147
	}

148
	vsyscall_nr = addr_to_vsyscall_nr(address);
149 150 151

	trace_emulate_vsyscall(vsyscall_nr);

152 153
	if (vsyscall_nr < 0) {
		warn_bad_vsyscall(KERN_WARNING, regs,
154
				  "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround");
155 156
		goto sigsegv;
	}
J
john stultz 已提交
157

158
	if (get_user(caller, (unsigned long __user *)regs->sp) != 0) {
159 160
		warn_bad_vsyscall(KERN_WARNING, regs,
				  "vsyscall with bad stack (exploit attempt?)");
161 162
		goto sigsegv;
	}
163

164
	tsk = current;
165 166

	/*
167 168
	 * Check for access_ok violations and find the syscall nr.
	 *
169
	 * NULL is a valid user pointer (in the access_ok sense) on 32-bit and
170
	 * 64-bit, so we don't need to special-case it here.  For all the
171
	 * vsyscalls, NULL means "don't write anything" not "write it at
172 173
	 * address 0".
	 */
174 175
	switch (vsyscall_nr) {
	case 0:
176
		if (!write_ok_or_segv(regs->di, sizeof(struct timeval)) ||
177 178 179 180
		    !write_ok_or_segv(regs->si, sizeof(struct timezone))) {
			ret = -EFAULT;
			goto check_fault;
		}
181

182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213
		syscall_nr = __NR_gettimeofday;
		break;

	case 1:
		if (!write_ok_or_segv(regs->di, sizeof(time_t))) {
			ret = -EFAULT;
			goto check_fault;
		}

		syscall_nr = __NR_time;
		break;

	case 2:
		if (!write_ok_or_segv(regs->di, sizeof(unsigned)) ||
		    !write_ok_or_segv(regs->si, sizeof(unsigned))) {
			ret = -EFAULT;
			goto check_fault;
		}

		syscall_nr = __NR_getcpu;
		break;
	}

	/*
	 * Handle seccomp.  regs->ip must be the original value.
	 * See seccomp_send_sigsys and Documentation/prctl/seccomp_filter.txt.
	 *
	 * We could optimize the seccomp disabled case, but performance
	 * here doesn't matter.
	 */
	regs->orig_ax = syscall_nr;
	regs->ax = -ENOSYS;
214
	tmp = secure_computing(NULL);
215 216 217 218 219
	if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
		warn_bad_vsyscall(KERN_DEBUG, regs,
				  "seccomp tried to change syscall nr or ip");
		do_exit(SIGSYS);
	}
220
	regs->orig_ax = -1;
221 222 223 224 225 226 227
	if (tmp)
		goto do_ret;  /* skip requested */

	/*
	 * With a real vsyscall, page faults cause SIGSEGV.  We want to
	 * preserve that behavior to make writing exploits harder.
	 */
228 229
	prev_sig_on_uaccess_err = current->thread.sig_on_uaccess_err;
	current->thread.sig_on_uaccess_err = 1;
230 231 232 233

	ret = -EFAULT;
	switch (vsyscall_nr) {
	case 0:
234 235 236 237 238 239 240 241 242 243 244 245
		ret = sys_gettimeofday(
			(struct timeval __user *)regs->di,
			(struct timezone __user *)regs->si);
		break;

	case 1:
		ret = sys_time((time_t __user *)regs->di);
		break;

	case 2:
		ret = sys_getcpu((unsigned __user *)regs->di,
				 (unsigned __user *)regs->si,
246
				 NULL);
247 248
		break;
	}
249

250
	current->thread.sig_on_uaccess_err = prev_sig_on_uaccess_err;
251

252
check_fault:
253
	if (ret == -EFAULT) {
254
		/* Bad news -- userspace fed a bad pointer to a vsyscall. */
255 256
		warn_bad_vsyscall(KERN_INFO, regs,
				  "vsyscall fault (exploit attempt?)");
257 258 259 260 261 262 263 264 265 266

		/*
		 * If we failed to generate a signal for any reason,
		 * generate one here.  (This should be impossible.)
		 */
		if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) &&
				 !sigismember(&tsk->pending.signal, SIGSEGV)))
			goto sigsegv;

		return true;  /* Don't emulate the ret. */
267
	}
268

269
	regs->ax = ret;
L
Linus Torvalds 已提交
270

271
do_ret:
272 273 274
	/* Emulate a ret instruction. */
	regs->ip = caller;
	regs->sp += 8;
275
	return true;
276 277 278

sigsegv:
	force_sig(SIGSEGV, current);
279
	return true;
L
Linus Torvalds 已提交
280 281
}

282 283 284 285 286 287 288 289 290
/*
 * A pseudo VMA to allow ptrace access for the vsyscall page.  This only
 * covers the 64bit vsyscall page now. 32bit has a real VMA now and does
 * not need special handling anymore:
 */
static const char *gate_vma_name(struct vm_area_struct *vma)
{
	return "[vsyscall]";
}
291
static const struct vm_operations_struct gate_vma_ops = {
292 293 294 295 296 297 298 299 300 301 302 303
	.name = gate_vma_name,
};
static struct vm_area_struct gate_vma = {
	.vm_start	= VSYSCALL_ADDR,
	.vm_end		= VSYSCALL_ADDR + PAGE_SIZE,
	.vm_page_prot	= PAGE_READONLY_EXEC,
	.vm_flags	= VM_READ | VM_EXEC,
	.vm_ops		= &gate_vma_ops,
};

struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
{
304
#ifdef CONFIG_COMPAT
305 306 307
	if (!mm || mm->context.ia32_compat)
		return NULL;
#endif
308 309
	if (vsyscall_mode == NONE)
		return NULL;
310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329
	return &gate_vma;
}

int in_gate_area(struct mm_struct *mm, unsigned long addr)
{
	struct vm_area_struct *vma = get_gate_vma(mm);

	if (!vma)
		return 0;

	return (addr >= vma->vm_start) && (addr < vma->vm_end);
}

/*
 * Use this when you have no reliable mm, typically from interrupt
 * context. It is less reliable than using a task's mm and may give
 * false positives.
 */
int in_gate_area_no_mm(unsigned long addr)
{
330
	return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR;
331 332
}

333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361
/*
 * The VSYSCALL page is the only user-accessible page in the kernel address
 * range.  Normally, the kernel page tables can have _PAGE_USER clear, but
 * the tables covering VSYSCALL_ADDR need _PAGE_USER set if vsyscalls
 * are enabled.
 *
 * Some day we may create a "minimal" vsyscall mode in which we emulate
 * vsyscalls but leave the page not present.  If so, we skip calling
 * this.
 */
static void __init set_vsyscall_pgtable_user_bits(void)
{
	pgd_t *pgd;
	p4d_t *p4d;
	pud_t *pud;
	pmd_t *pmd;

	pgd = pgd_offset_k(VSYSCALL_ADDR);
	set_pgd(pgd, __pgd(pgd_val(*pgd) | _PAGE_USER));
	p4d = p4d_offset(pgd, VSYSCALL_ADDR);
#if CONFIG_PGTABLE_LEVELS >= 5
	p4d->p4d |= _PAGE_USER;
#endif
	pud = pud_offset(p4d, VSYSCALL_ADDR);
	set_pud(pud, __pud(pud_val(*pud) | _PAGE_USER));
	pmd = pmd_offset(pud, VSYSCALL_ADDR);
	set_pmd(pmd, __pmd(pmd_val(*pmd) | _PAGE_USER));
}

I
Ingo Molnar 已提交
362
void __init map_vsyscall(void)
L
Linus Torvalds 已提交
363
{
364 365
	extern char __vsyscall_page;
	unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
L
Linus Torvalds 已提交
366

367
	if (vsyscall_mode != NONE) {
368 369 370 371
		__set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
			     vsyscall_mode == NATIVE
			     ? PAGE_KERNEL_VSYSCALL
			     : PAGE_KERNEL_VVAR);
372 373
		set_vsyscall_pgtable_user_bits();
	}
374

375 376
	BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
		     (unsigned long)VSYSCALL_ADDR);
L
Linus Torvalds 已提交
377
}