redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

arch/tile: don't allow user code to set the PL via ptrace or signal return

Browse source 
The kernel was allowing any component of the pt_regs to be updated either
by signal handlers writing to the stack, or by processes writing via
PTRACE_POKEUSR or PTRACE_SETREGS, which meant they could set their PL
up from 0 to 1 and get access to kernel code and data (or, in practice,
cause a kernel panic).  We now always reset the ex1 field, allowing the
user to set their ICS bit only.

Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
This commit is contained in:
Chris Metcalf 2010-10-28 15:47:06 -04:00
parent 34a89d26bd
commit 1deb9c5dfb
2 changed files with 24 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
arch/tile/kernel/ptrace.c
View file

@ -50,10 +50,10 @@ long arch_ptrace(struct task_struct *child, long request,
{ {
unsigned long __user *datap = (long __user __force *)data; unsigned long __user *datap = (long __user __force *)data;
unsigned long tmp; unsigned long tmp;
int i;
long ret = -EIO; long ret = -EIO;
unsigned long *childregs;
char *childreg; char *childreg;
struct pt_regs copyregs;
int ex1_offset;
switch (request) { switch (request) {
@ -80,6 +80,16 @@ long arch_ptrace(struct task_struct *child, long request,
if (addr >= PTREGS_SIZE) if (addr >= PTREGS_SIZE)
break; break;
childreg = (char *)task_pt_regs(child) + addr; childreg = (char *)task_pt_regs(child) + addr;
/* Guard against overwrites of the privilege level. */
ex1_offset = PTREGS_OFFSET_EX1;
#if defined(CONFIG_COMPAT) && defined(__BIG_ENDIAN)
if (is_compat_task()) /* point at low word */
ex1_offset += sizeof(compat_long_t);
#endif
if (addr == ex1_offset)
data = PL_ICS_EX1(USER_PL, EX1_ICS(data));
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
if (is_compat_task()) { if (is_compat_task()) {
if (addr & (sizeof(compat_long_t)-1)) if (addr & (sizeof(compat_long_t)-1))
@ -96,26 +106,19 @@ long arch_ptrace(struct task_struct *child, long request,
break; break;
case PTRACE_GETREGS: /* Get all registers from the child. */ case PTRACE_GETREGS: /* Get all registers from the child. */
if (!access_ok(VERIFY_WRITE, datap, PTREGS_SIZE)) if (copy_to_user(datap, task_pt_regs(child),
break; sizeof(struct pt_regs)) == 0) {
childregs = (long *)task_pt_regs(child); ret = 0;
for (i = 0; i < sizeof(struct pt_regs)/sizeof(unsigned long);
++i) {
ret = __put_user(childregs[i], &datap[i]);
if (ret != 0)
break;
} }
break; break;
case PTRACE_SETREGS: /* Set all registers in the child. */ case PTRACE_SETREGS: /* Set all registers in the child. */
if (!access_ok(VERIFY_READ, datap, PTREGS_SIZE)) if (copy_from_user(&copyregs, datap,
break; sizeof(struct pt_regs)) == 0) {
childregs = (long *)task_pt_regs(child); copyregs.ex1 =
for (i = 0; i < sizeof(struct pt_regs)/sizeof(unsigned long); PL_ICS_EX1(USER_PL, EX1_ICS(copyregs.ex1));
++i) { *task_pt_regs(child) = copyregs;
ret = __get_user(childregs[i], &datap[i]); ret = 0;
if (ret != 0)
break;
} }
break; break;

3
arch/tile/kernel/signal.c
View file

@ -71,6 +71,9 @@ int restore_sigcontext(struct pt_regs *regs,
for (i = 0; i < sizeof(struct pt_regs)/sizeof(long); ++i) for (i = 0; i < sizeof(struct pt_regs)/sizeof(long); ++i)
err |= __get_user(regs->regs[i], &sc->gregs[i]); err |= __get_user(regs->regs[i], &sc->gregs[i]);
/* Ensure that the PL is always set to USER_PL. */
regs->ex1 = PL_ICS_EX1(USER_PL, EX1_ICS(regs->ex1));
regs->faultnum = INT_SWINT_1_SIGRETURN; regs->faultnum = INT_SWINT_1_SIGRETURN;
err |= __get_user(*pr0, &sc->gregs[0]); err |= __get_user(*pr0, &sc->gregs[0]);