Re: [PATCH 06/11] powerpc: Use orig_gpr3 in syscall_get_arguments()

[Kees Cook]

On Thu, Jul 23, 2015 at 3:21 AM, Michael Ellerman <mpe@xxxxxxxxxxxxxx> wrote:
> Currently syscall_get_arguments() is used by syscall tracepoints, and
> collect_syscall() which is used in some debugging as well as
> /proc/pid/syscall.
>
> The current implementation just copies regs->gpr[3 .. 5] out, which is
> fine for all the current use cases.
>
> When we enable seccomp filter, that will also start using
> syscall_get_arguments(). However for seccomp filter we want to use r3
> as the return value of the syscall, and orig_gpr3 as the first
> parameter. This will allow seccomp to modify the return value in r3.
>
> To support this we need to modify syscall_get_arguments() to return
> orig_gpr3 instead of r3. This is safe for all uses because orig_gpr3
> always contains the r3 value that was passed to the syscall. We store it
> in the syscall entry path and never modify it.
>
> Update syscall_set_arguments() while we're here, even though it's never
> used.
>
> Signed-off-by: Michael Ellerman <mpe@xxxxxxxxxxxxxx>

Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>

-Kees

> ---
>  arch/powerpc/include/asm/syscall.h | 16 +++++++++++++---
>  1 file changed, 13 insertions(+), 3 deletions(-)
>
> diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
> index 403e2303fe18..8d79a87c0511 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -64,7 +64,7 @@ static inline void syscall_get_arguments(struct task_struct *task,
>                                          unsigned int i, unsigned int n,
>                                          unsigned long *args)
>  {
> -       unsigned long mask = -1UL;
> +       unsigned long val, mask = -1UL;
>
>         BUG_ON(i + n > 6);
>
> @@ -72,8 +72,14 @@ static inline void syscall_get_arguments(struct task_struct *task,
>         if (test_tsk_thread_flag(task, TIF_32BIT))
>                 mask = 0xffffffff;
>  #endif
> -       while (n--)
> -               args[n] = regs->gpr[3 + i + n] & mask;
> +       while (n--) {
> +               if (n == 0 && i == 0)
> +                       val = regs->orig_gpr3;
> +               else
> +                       val = regs->gpr[3 + i + n];
> +
> +               args[n] = val & mask;
> +       }
>  }
>
>  static inline void syscall_set_arguments(struct task_struct *task,
> @@ -83,6 +89,10 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  {
>         BUG_ON(i + n > 6);
>         memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
> +
> +       /* Also copy the first argument into orig_gpr3 */
> +       if (i == 0 && n > 0)
> +               regs->orig_gpr3 = args[0];
>  }
>
>  static inline int syscall_get_arch(void)
> --
> 2.1.0
>



-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/