提交 3d729dea 编写于 作者: J James Hogan 提交者: Ralf Baechle

MIPS: seccomp: Fix indirect syscall args

Since commit 669c4092 ("MIPS: Give __secure_computing() access to
syscall arguments."), upon syscall entry when seccomp is enabled,
syscall_trace_enter() passes a carefully prepared struct seccomp_data
containing syscall arguments to __secure_computing(). Unfortunately it
directly uses mips_get_syscall_arg() and fails to take into account the
indirect O32 system calls (i.e. syscall(2)) which put the system call
number in a0 and have the arguments shifted up by one entry.

We can't just revert that commit as samples/bpf/tracex5 would break
again, so use syscall_get_arguments() which already takes indirect
syscalls into account instead of directly using mips_get_syscall_arg(),
similar to what populate_seccomp_data() does.

This also removes the redundant error checking of the
mips_get_syscall_arg() return value (get_user() already zeroes the
result if an argument from the stack can't be loaded).
Reported-by: NJames Cowgill <James.Cowgill@imgtec.com>
Fixes: 669c4092 ("MIPS: Give __secure_computing() access to syscall arguments.")
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Reviewed-by: NKees Cook <keescook@chromium.org>
Cc: David Daney <david.daney@cavium.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Will Drewry <wad@chromium.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/16994/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
上级 cc4a41fe
...@@ -872,15 +872,13 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall) ...@@ -872,15 +872,13 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)
if (unlikely(test_thread_flag(TIF_SECCOMP))) { if (unlikely(test_thread_flag(TIF_SECCOMP))) {
int ret, i; int ret, i;
struct seccomp_data sd; struct seccomp_data sd;
unsigned long args[6];
sd.nr = syscall; sd.nr = syscall;
sd.arch = syscall_get_arch(); sd.arch = syscall_get_arch();
for (i = 0; i < 6; i++) { syscall_get_arguments(current, regs, 0, 6, args);
unsigned long v, r; for (i = 0; i < 6; i++)
sd.args[i] = args[i];
r = mips_get_syscall_arg(&v, current, regs, i);
sd.args[i] = r ? 0 : v;
}
sd.instruction_pointer = KSTK_EIP(current); sd.instruction_pointer = KSTK_EIP(current);
ret = __secure_computing(&sd); ret = __secure_computing(&sd);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册