vsyscall_64.c 8.3 KB
Newer Older
L
Linus Torvalds 已提交
1
/*
2 3 4
 * Copyright (c) 2012-2014 Andy Lutomirski <luto@amacapital.net>
 *
 * Based on the original implementation which is:
L
Linus Torvalds 已提交
5 6 7
 *  Copyright (C) 2001 Andrea Arcangeli <andrea@suse.de> SuSE
 *  Copyright 2003 Andi Kleen, SuSE Labs.
 *
8 9 10 11 12
 *  Parts of the original code have been moved to arch/x86/vdso/vma.c
 *
 * This file implements vsyscall emulation.  vsyscalls are a legacy ABI:
 * Userspace can request certain kernel services by calling fixed
 * addresses.  This concept is problematic:
13
 *
14 15 16 17 18
 * - It interferes with ASLR.
 * - It's awkward to write code that lives in kernel addresses but is
 *   callable by userspace at fixed addresses.
 * - The whole concept is impossible for 32-bit compat userspace.
 * - UML cannot easily virtualize a vsyscall.
L
Linus Torvalds 已提交
19
 *
20 21 22
 * As of mid-2014, I believe that there is no new userspace code that
 * will use a vsyscall if the vDSO is present.  I hope that there will
 * soon be no new userspace code that will ever use a vsyscall.
L
Linus Torvalds 已提交
23
 *
24 25
 * The code in this file emulates vsyscalls when notified of a page
 * fault to a vsyscall address.
L
Linus Torvalds 已提交
26 27 28 29
 */

#include <linux/kernel.h>
#include <linux/timer.h>
30 31
#include <linux/syscalls.h>
#include <linux/ratelimit.h>
L
Linus Torvalds 已提交
32 33

#include <asm/vsyscall.h>
34
#include <asm/unistd.h>
L
Linus Torvalds 已提交
35
#include <asm/fixmap.h>
36
#include <asm/traps.h>
L
Linus Torvalds 已提交
37

38 39 40
#define CREATE_TRACE_POINTS
#include "vsyscall_trace.h"

41
static enum { EMULATE, NATIVE, NONE } vsyscall_mode =
42
#if defined(CONFIG_LEGACY_VSYSCALL_NATIVE)
43
	NATIVE;
44
#elif defined(CONFIG_LEGACY_VSYSCALL_NONE)
45 46 47 48
	NONE;
#else
	EMULATE;
#endif
49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68

static int __init vsyscall_setup(char *str)
{
	if (str) {
		if (!strcmp("emulate", str))
			vsyscall_mode = EMULATE;
		else if (!strcmp("native", str))
			vsyscall_mode = NATIVE;
		else if (!strcmp("none", str))
			vsyscall_mode = NONE;
		else
			return -EINVAL;

		return 0;
	}

	return -EINVAL;
}
early_param("vsyscall", vsyscall_setup);

69 70
static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
			      const char *message)
L
Linus Torvalds 已提交
71
{
72
	if (!show_unhandled_signals)
73
		return;
L
Linus Torvalds 已提交
74

75 76 77 78
	printk_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
			   level, current->comm, task_pid_nr(current),
			   message, regs->ip, regs->cs,
			   regs->sp, regs->ax, regs->si, regs->di);
79 80 81 82 83 84
}

static int addr_to_vsyscall_nr(unsigned long addr)
{
	int nr;

85
	if ((addr & ~0xC00UL) != VSYSCALL_ADDR)
86 87 88 89 90 91 92
		return -EINVAL;

	nr = (addr & 0xC00UL) >> 10;
	if (nr >= 3)
		return -EINVAL;

	return nr;
L
Linus Torvalds 已提交
93 94
}

95 96 97 98 99 100 101 102 103 104 105 106 107
static bool write_ok_or_segv(unsigned long ptr, size_t size)
{
	/*
	 * XXX: if access_ok, get_user, and put_user handled
	 * sig_on_uaccess_error, this could go away.
	 */

	if (!access_ok(VERIFY_WRITE, (void __user *)ptr, size)) {
		siginfo_t info;
		struct thread_struct *thread = &current->thread;

		thread->error_code	= 6;  /* user fault, no page, write */
		thread->cr2		= ptr;
108
		thread->trap_nr		= X86_TRAP_PF;
109 110 111 112 113 114 115 116 117 118 119 120 121 122

		memset(&info, 0, sizeof(info));
		info.si_signo		= SIGSEGV;
		info.si_errno		= 0;
		info.si_code		= SEGV_MAPERR;
		info.si_addr		= (void __user *)ptr;

		force_sig_info(SIGSEGV, &info, current);
		return false;
	} else {
		return true;
	}
}

123
bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
L
Linus Torvalds 已提交
124
{
125 126
	struct task_struct *tsk;
	unsigned long caller;
127
	int vsyscall_nr, syscall_nr, tmp;
128
	int prev_sig_on_uaccess_error;
129 130
	long ret;

131 132 133 134
	/*
	 * No point in checking CS -- the only way to get here is a user mode
	 * trap to a high address, which means that we're in 64-bit user code.
	 */
135

136
	WARN_ON_ONCE(address != regs->ip);
137

138 139 140 141
	if (vsyscall_mode == NONE) {
		warn_bad_vsyscall(KERN_INFO, regs,
				  "vsyscall attempted with vsyscall=none");
		return false;
142 143
	}

144
	vsyscall_nr = addr_to_vsyscall_nr(address);
145 146 147

	trace_emulate_vsyscall(vsyscall_nr);

148 149
	if (vsyscall_nr < 0) {
		warn_bad_vsyscall(KERN_WARNING, regs,
150
				  "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround");
151 152
		goto sigsegv;
	}
J
john stultz 已提交
153

154
	if (get_user(caller, (unsigned long __user *)regs->sp) != 0) {
155 156
		warn_bad_vsyscall(KERN_WARNING, regs,
				  "vsyscall with bad stack (exploit attempt?)");
157 158
		goto sigsegv;
	}
159

160
	tsk = current;
161 162

	/*
163 164
	 * Check for access_ok violations and find the syscall nr.
	 *
165
	 * NULL is a valid user pointer (in the access_ok sense) on 32-bit and
166
	 * 64-bit, so we don't need to special-case it here.  For all the
167
	 * vsyscalls, NULL means "don't write anything" not "write it at
168 169
	 * address 0".
	 */
170 171
	switch (vsyscall_nr) {
	case 0:
172
		if (!write_ok_or_segv(regs->di, sizeof(struct timeval)) ||
173 174 175 176
		    !write_ok_or_segv(regs->si, sizeof(struct timezone))) {
			ret = -EFAULT;
			goto check_fault;
		}
177

178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209
		syscall_nr = __NR_gettimeofday;
		break;

	case 1:
		if (!write_ok_or_segv(regs->di, sizeof(time_t))) {
			ret = -EFAULT;
			goto check_fault;
		}

		syscall_nr = __NR_time;
		break;

	case 2:
		if (!write_ok_or_segv(regs->di, sizeof(unsigned)) ||
		    !write_ok_or_segv(regs->si, sizeof(unsigned))) {
			ret = -EFAULT;
			goto check_fault;
		}

		syscall_nr = __NR_getcpu;
		break;
	}

	/*
	 * Handle seccomp.  regs->ip must be the original value.
	 * See seccomp_send_sigsys and Documentation/prctl/seccomp_filter.txt.
	 *
	 * We could optimize the seccomp disabled case, but performance
	 * here doesn't matter.
	 */
	regs->orig_ax = syscall_nr;
	regs->ax = -ENOSYS;
210
	tmp = secure_computing();
211 212 213 214 215
	if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
		warn_bad_vsyscall(KERN_DEBUG, regs,
				  "seccomp tried to change syscall nr or ip");
		do_exit(SIGSYS);
	}
216
	regs->orig_ax = -1;
217 218 219 220 221 222 223 224 225 226 227 228 229
	if (tmp)
		goto do_ret;  /* skip requested */

	/*
	 * With a real vsyscall, page faults cause SIGSEGV.  We want to
	 * preserve that behavior to make writing exploits harder.
	 */
	prev_sig_on_uaccess_error = current_thread_info()->sig_on_uaccess_error;
	current_thread_info()->sig_on_uaccess_error = 1;

	ret = -EFAULT;
	switch (vsyscall_nr) {
	case 0:
230 231 232 233 234 235 236 237 238 239 240 241
		ret = sys_gettimeofday(
			(struct timeval __user *)regs->di,
			(struct timezone __user *)regs->si);
		break;

	case 1:
		ret = sys_time((time_t __user *)regs->di);
		break;

	case 2:
		ret = sys_getcpu((unsigned __user *)regs->di,
				 (unsigned __user *)regs->si,
242
				 NULL);
243 244
		break;
	}
245

246 247
	current_thread_info()->sig_on_uaccess_error = prev_sig_on_uaccess_error;

248
check_fault:
249
	if (ret == -EFAULT) {
250
		/* Bad news -- userspace fed a bad pointer to a vsyscall. */
251 252
		warn_bad_vsyscall(KERN_INFO, regs,
				  "vsyscall fault (exploit attempt?)");
253 254 255 256 257 258 259 260 261 262

		/*
		 * If we failed to generate a signal for any reason,
		 * generate one here.  (This should be impossible.)
		 */
		if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) &&
				 !sigismember(&tsk->pending.signal, SIGSEGV)))
			goto sigsegv;

		return true;  /* Don't emulate the ret. */
263
	}
264

265
	regs->ax = ret;
L
Linus Torvalds 已提交
266

267
do_ret:
268 269 270
	/* Emulate a ret instruction. */
	regs->ip = caller;
	regs->sp += 8;
271
	return true;
272 273 274

sigsegv:
	force_sig(SIGSEGV, current);
275
	return true;
L
Linus Torvalds 已提交
276 277
}

278 279 280 281 282 283 284 285 286
/*
 * A pseudo VMA to allow ptrace access for the vsyscall page.  This only
 * covers the 64bit vsyscall page now. 32bit has a real VMA now and does
 * not need special handling anymore:
 */
static const char *gate_vma_name(struct vm_area_struct *vma)
{
	return "[vsyscall]";
}
287
static const struct vm_operations_struct gate_vma_ops = {
288 289 290 291 292 293 294 295 296 297 298 299
	.name = gate_vma_name,
};
static struct vm_area_struct gate_vma = {
	.vm_start	= VSYSCALL_ADDR,
	.vm_end		= VSYSCALL_ADDR + PAGE_SIZE,
	.vm_page_prot	= PAGE_READONLY_EXEC,
	.vm_flags	= VM_READ | VM_EXEC,
	.vm_ops		= &gate_vma_ops,
};

struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
{
300
#ifdef CONFIG_COMPAT
301 302 303
	if (!mm || mm->context.ia32_compat)
		return NULL;
#endif
304 305
	if (vsyscall_mode == NONE)
		return NULL;
306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325
	return &gate_vma;
}

int in_gate_area(struct mm_struct *mm, unsigned long addr)
{
	struct vm_area_struct *vma = get_gate_vma(mm);

	if (!vma)
		return 0;

	return (addr >= vma->vm_start) && (addr < vma->vm_end);
}

/*
 * Use this when you have no reliable mm, typically from interrupt
 * context. It is less reliable than using a task's mm and may give
 * false positives.
 */
int in_gate_area_no_mm(unsigned long addr)
{
326
	return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR;
327 328
}

I
Ingo Molnar 已提交
329
void __init map_vsyscall(void)
L
Linus Torvalds 已提交
330
{
331 332
	extern char __vsyscall_page;
	unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
L
Linus Torvalds 已提交
333

334 335 336 337 338 339
	if (vsyscall_mode != NONE)
		__set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
			     vsyscall_mode == NATIVE
			     ? PAGE_KERNEL_VSYSCALL
			     : PAGE_KERNEL_VVAR);

340 341
	BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
		     (unsigned long)VSYSCALL_ADDR);
L
Linus Torvalds 已提交
342
}