From patchwork Wed Jul 22 23:13:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Karcher X-Patchwork-Id: 11679301 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7C542913 for ; Wed, 22 Jul 2020 23:21:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6DEAB22B47 for ; Wed, 22 Jul 2020 23:21:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733214AbgGVXVO (ORCPT ); Wed, 22 Jul 2020 19:21:14 -0400 Received: from outpost17.zedat.fu-berlin.de ([130.133.4.110]:40571 "EHLO outpost17.zedat.fu-berlin.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733132AbgGVXVN (ORCPT ); Wed, 22 Jul 2020 19:21:13 -0400 X-Greylist: delayed 420 seconds by postgrey-1.27 at vger.kernel.org; Wed, 22 Jul 2020 19:21:08 EDT Received: from relay1.zedat.fu-berlin.de ([130.133.4.67]) by outpost.zedat.fu-berlin.de (Exim 4.93) with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (envelope-from ) id 1jyNw6-000bTh-Pw; Thu, 23 Jul 2020 01:14:06 +0200 Received: from mx.physik.fu-berlin.de ([160.45.64.218]) by relay1.zedat.fu-berlin.de (Exim 4.93) with esmtps (TLS1.2) tls TLS_DHE_RSA_WITH_AES_128_CBC_SHA (envelope-from ) id 1jyNw6-001IqQ-Nc; Thu, 23 Jul 2020 01:14:06 +0200 Received: from epyc.physik.fu-berlin.de ([160.45.64.180]) by mx.physik.fu-berlin.de with esmtps (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from ) id 1jyNvz-0002Sc-H5; Thu, 23 Jul 2020 01:13:59 +0200 Received: from mkarcher by epyc.physik.fu-berlin.de with local (Exim 4.94 #2 (Debian)) id 1jyNvz-001lBb-8G; Thu, 23 Jul 2020 01:13:59 +0200 From: Michael Karcher To: linux-sh@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Yoshinori Sato , Rich Felker , Adrian Glaubitz , Michael Karcher Subject: [PATCH 1/4] sh: Fix validation of system call number Date: Thu, 23 Jul 2020 01:13:19 +0200 Message-Id: <20200722231322.419642-1-kernel@mkarcher.dialup.fu-berlin.de> X-Mailer: git-send-email 2.28.0.rc1 MIME-Version: 1.0 X-Originating-IP: 160.45.64.218 X-ZEDAT-Hint: RV Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org The slow path for traced system call entries accessed a wrong memory location to get the number of the maximum allowed system call number. Renumber the numbered "local" label for the correct location to avoid collisions with actual local labels. Signed-off-by: Michael Karcher --- arch/sh/kernel/entry-common.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S index 956a7a03b0c8..9bac5bbb67f3 100644 --- a/arch/sh/kernel/entry-common.S +++ b/arch/sh/kernel/entry-common.S @@ -199,7 +199,7 @@ syscall_trace_entry: mov.l @(OFF_R7,r15), r7 ! arg3 mov.l @(OFF_R3,r15), r3 ! syscall_nr ! - mov.l 2f, r10 ! Number of syscalls + mov.l 6f, r10 ! Number of syscalls cmp/hs r10, r3 bf syscall_call mov #-ENOSYS, r0 @@ -353,7 +353,7 @@ ENTRY(system_call) tst r9, r8 bf syscall_trace_entry ! - mov.l 2f, r8 ! Number of syscalls + mov.l 6f, r8 ! Number of syscalls cmp/hs r8, r3 bt syscall_badsys ! @@ -392,7 +392,7 @@ syscall_exit: #if !defined(CONFIG_CPU_SH2) 1: .long TRA #endif -2: .long NR_syscalls +6: .long NR_syscalls 3: .long sys_call_table 7: .long do_syscall_trace_enter 8: .long do_syscall_trace_leave From patchwork Wed Jul 22 23:13:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Karcher X-Patchwork-Id: 11679299 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id F128113A4 for ; Wed, 22 Jul 2020 23:21:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DE2FE2086A for ; Wed, 22 Jul 2020 23:21:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733201AbgGVXVK (ORCPT ); Wed, 22 Jul 2020 19:21:10 -0400 Received: from outpost17.zedat.fu-berlin.de ([130.133.4.110]:40571 "EHLO outpost17.zedat.fu-berlin.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733132AbgGVXVK (ORCPT ); Wed, 22 Jul 2020 19:21:10 -0400 X-Greylist: delayed 420 seconds by postgrey-1.27 at vger.kernel.org; Wed, 22 Jul 2020 19:21:08 EDT Received: from relay1.zedat.fu-berlin.de ([130.133.4.67]) by outpost.zedat.fu-berlin.de (Exim 4.93) with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (envelope-from ) id 1jyNwD-000bZx-OI; Thu, 23 Jul 2020 01:14:13 +0200 Received: from mx.physik.fu-berlin.de ([160.45.64.218]) by relay1.zedat.fu-berlin.de (Exim 4.93) with esmtps (TLS1.2) tls TLS_DHE_RSA_WITH_AES_128_CBC_SHA (envelope-from ) id 1jyNwD-001IvP-Lp; Thu, 23 Jul 2020 01:14:13 +0200 Received: from epyc.physik.fu-berlin.de ([160.45.64.180]) by mx.physik.fu-berlin.de with esmtps (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from ) id 1jyNw6-0002TM-Ay; Thu, 23 Jul 2020 01:14:06 +0200 Received: from mkarcher by epyc.physik.fu-berlin.de with local (Exim 4.94 #2 (Debian)) id 1jyNw6-001lBg-23; Thu, 23 Jul 2020 01:14:06 +0200 From: Michael Karcher To: linux-sh@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Yoshinori Sato , Rich Felker , Adrian Glaubitz , Michael Karcher Subject: [PATCH 2/4] sh: Rearrange blocks in entry-common.S Date: Thu, 23 Jul 2020 01:13:20 +0200 Message-Id: <20200722231322.419642-2-kernel@mkarcher.dialup.fu-berlin.de> X-Mailer: git-send-email 2.28.0.rc1 In-Reply-To: <20200722231322.419642-1-kernel@mkarcher.dialup.fu-berlin.de> References: <20200722231322.419642-1-kernel@mkarcher.dialup.fu-berlin.de> MIME-Version: 1.0 X-Originating-IP: 160.45.64.218 X-ZEDAT-Hint: RV Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org This avoids out-of-range jumps that get auto-replaced by the assembler and prepares for the changes needed to implement SECCOMP_FILTER cleanly. Signed-off-by: Michael Karcher --- arch/sh/kernel/entry-common.S | 57 ++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 28 deletions(-) diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S index 9bac5bbb67f3..c4d88d61890d 100644 --- a/arch/sh/kernel/entry-common.S +++ b/arch/sh/kernel/entry-common.S @@ -178,34 +178,6 @@ syscall_exit_work: bra resume_userspace nop - .align 2 -syscall_trace_entry: - ! Yes it is traced. - mov r15, r4 - mov.l 7f, r11 ! Call do_syscall_trace_enter which notifies - jsr @r11 ! superior (will chomp R[0-7]) - nop - mov.l r0, @(OFF_R0,r15) ! Save return value - ! Reload R0-R4 from kernel stack, where the - ! parent may have modified them using - ! ptrace(POKEUSR). (Note that R0-R2 are - ! reloaded from the kernel stack by syscall_call - ! below, so don't need to be reloaded here.) - ! This allows the parent to rewrite system calls - ! and args on the fly. - mov.l @(OFF_R4,r15), r4 ! arg0 - mov.l @(OFF_R5,r15), r5 - mov.l @(OFF_R6,r15), r6 - mov.l @(OFF_R7,r15), r7 ! arg3 - mov.l @(OFF_R3,r15), r3 ! syscall_nr - ! - mov.l 6f, r10 ! Number of syscalls - cmp/hs r10, r3 - bf syscall_call - mov #-ENOSYS, r0 - bra syscall_exit - mov.l r0, @(OFF_R0,r15) ! Return value - __restore_all: mov #OFF_SR, r0 mov.l @(r0,r15), r0 ! get status register @@ -388,6 +360,35 @@ syscall_exit: bf syscall_exit_work bra __restore_all nop + + .align 2 +syscall_trace_entry: + ! Yes it is traced. + mov r15, r4 + mov.l 7f, r11 ! Call do_syscall_trace_enter which notifies + jsr @r11 ! superior (will chomp R[0-7]) + nop + mov.l r0, @(OFF_R0,r15) ! Save return value + ! Reload R0-R4 from kernel stack, where the + ! parent may have modified them using + ! ptrace(POKEUSR). (Note that R0-R2 are + ! reloaded from the kernel stack by syscall_call + ! below, so don't need to be reloaded here.) + ! This allows the parent to rewrite system calls + ! and args on the fly. + mov.l @(OFF_R4,r15), r4 ! arg0 + mov.l @(OFF_R5,r15), r5 + mov.l @(OFF_R6,r15), r6 + mov.l @(OFF_R7,r15), r7 ! arg3 + mov.l @(OFF_R3,r15), r3 ! syscall_nr + ! + mov.l 6f, r10 ! Number of syscalls + cmp/hs r10, r3 + bf syscall_call + mov #-ENOSYS, r0 + bra syscall_exit + mov.l r0, @(OFF_R0,r15) ! Return value + .align 2 #if !defined(CONFIG_CPU_SH2) 1: .long TRA From patchwork Wed Jul 22 23:13:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Karcher X-Patchwork-Id: 11679303 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 590C813A4 for ; Wed, 22 Jul 2020 23:21:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4A4C822B47 for ; Wed, 22 Jul 2020 23:21:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733227AbgGVXVS (ORCPT ); Wed, 22 Jul 2020 19:21:18 -0400 Received: from outpost17.zedat.fu-berlin.de ([130.133.4.110]:40571 "EHLO outpost17.zedat.fu-berlin.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733219AbgGVXVR (ORCPT ); Wed, 22 Jul 2020 19:21:17 -0400 X-Greylist: delayed 420 seconds by postgrey-1.27 at vger.kernel.org; Wed, 22 Jul 2020 19:21:08 EDT Received: from relay1.zedat.fu-berlin.de ([130.133.4.67]) by outpost.zedat.fu-berlin.de (Exim 4.93) with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (envelope-from ) id 1jyNwG-000baX-ST; Thu, 23 Jul 2020 01:14:16 +0200 Received: from mx.physik.fu-berlin.de ([160.45.64.218]) by relay1.zedat.fu-berlin.de (Exim 4.93) with esmtps (TLS1.2) tls TLS_DHE_RSA_WITH_AES_128_CBC_SHA (envelope-from ) id 1jyNwG-001Iw5-QC; Thu, 23 Jul 2020 01:14:16 +0200 Received: from epyc.physik.fu-berlin.de ([160.45.64.180]) by mx.physik.fu-berlin.de with esmtps (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from ) id 1jyNwA-0002UU-5I; Thu, 23 Jul 2020 01:14:10 +0200 Received: from mkarcher by epyc.physik.fu-berlin.de with local (Exim 4.94 #2 (Debian)) id 1jyNw9-001lBn-T7; Thu, 23 Jul 2020 01:14:09 +0200 From: Michael Karcher To: linux-sh@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Yoshinori Sato , Rich Felker , Adrian Glaubitz , Michael Karcher Subject: [PATCH 3/4] sh: Add SECCOMP_FILTER Date: Thu, 23 Jul 2020 01:13:21 +0200 Message-Id: <20200722231322.419642-3-kernel@mkarcher.dialup.fu-berlin.de> X-Mailer: git-send-email 2.28.0.rc1 In-Reply-To: <20200722231322.419642-1-kernel@mkarcher.dialup.fu-berlin.de> References: <20200722231322.419642-1-kernel@mkarcher.dialup.fu-berlin.de> MIME-Version: 1.0 X-Originating-IP: 160.45.64.218 X-ZEDAT-Hint: RV Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org Port sh to use the new SECCOMP_FILTER code. Signed-off-by: Michael Karcher --- arch/sh/Kconfig | 1 + arch/sh/kernel/entry-common.S | 2 ++ arch/sh/kernel/ptrace_32.c | 5 +++-- tools/testing/selftests/seccomp/seccomp_bpf.c | 8 +++++++- 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig index 32d959849df9..10b510c16841 100644 --- a/arch/sh/Kconfig +++ b/arch/sh/Kconfig @@ -27,6 +27,7 @@ config SUPERH select GENERIC_SMP_IDLE_THREAD select GUP_GET_PTE_LOW_HIGH if X2TLB select HAVE_ARCH_AUDITSYSCALL + select HAVE_ARCH_SECCOMP_FILTER select HAVE_ARCH_KGDB select HAVE_ARCH_TRACEHOOK select HAVE_DEBUG_BUGVERBOSE diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S index c4d88d61890d..ad963104d22d 100644 --- a/arch/sh/kernel/entry-common.S +++ b/arch/sh/kernel/entry-common.S @@ -368,6 +368,8 @@ syscall_trace_entry: mov.l 7f, r11 ! Call do_syscall_trace_enter which notifies jsr @r11 ! superior (will chomp R[0-7]) nop + cmp/eq #-1, r0 + bt syscall_exit mov.l r0, @(OFF_R0,r15) ! Save return value ! Reload R0-R4 from kernel stack, where the ! parent may have modified them using diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c index 64bfb714943e..25ccfbd02bfa 100644 --- a/arch/sh/kernel/ptrace_32.c +++ b/arch/sh/kernel/ptrace_32.c @@ -485,8 +485,6 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs) { long ret = 0; - secure_computing_strict(regs->regs[0]); - if (test_thread_flag(TIF_SYSCALL_TRACE) && tracehook_report_syscall_entry(regs)) /* @@ -496,6 +494,9 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs) */ ret = -1L; + if (secure_computing() == -1) + return -1; + if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) trace_sys_enter(regs, regs->regs[0]); diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c index 252140a52553..6eb21685c88f 100644 --- a/tools/testing/selftests/seccomp/seccomp_bpf.c +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c @@ -122,6 +122,8 @@ struct seccomp_data { # define __NR_seccomp 358 # elif defined(__s390__) # define __NR_seccomp 348 +# elif defined(__sh__) +# define __NR_seccomp 372 # else # warning "seccomp syscall number unknown for this architecture" # define __NR_seccomp 0xffff @@ -1622,6 +1624,10 @@ TEST_F(TRACE_poke, getpid_runs_normally) # define SYSCALL_SYSCALL_NUM regs[4] # define SYSCALL_RET regs[2] # define SYSCALL_NUM_RET_SHARE_REG +#elif defined(__sh__) +# define ARCH_REGS struct pt_regs +# define SYSCALL_NUM gpr[3] +# define SYSCALL_RET gpr[0] #else # error "Do not know how to find your architecture's registers and syscalls" #endif @@ -1693,7 +1699,7 @@ void change_syscall(struct __test_metadata *_metadata, EXPECT_EQ(0, ret) {} #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \ - defined(__s390__) || defined(__hppa__) || defined(__riscv) + defined(__s390__) || defined(__hppa__) || defined(__riscv) || defined(__sh__) { regs.SYSCALL_NUM = syscall; } From patchwork Wed Jul 22 23:13:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Karcher X-Patchwork-Id: 11679305 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B0F29913 for ; Wed, 22 Jul 2020 23:21:21 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A0DCA2080D for ; Wed, 22 Jul 2020 23:21:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730837AbgGVXVV (ORCPT ); Wed, 22 Jul 2020 19:21:21 -0400 Received: from outpost17.zedat.fu-berlin.de ([130.133.4.110]:40571 "EHLO outpost17.zedat.fu-berlin.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733242AbgGVXVV (ORCPT ); Wed, 22 Jul 2020 19:21:21 -0400 X-Greylist: delayed 420 seconds by postgrey-1.27 at vger.kernel.org; Wed, 22 Jul 2020 19:21:08 EDT Received: from relay1.zedat.fu-berlin.de ([130.133.4.67]) by outpost.zedat.fu-berlin.de (Exim 4.93) with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (envelope-from ) id 1jyNwH-000bao-U8; Thu, 23 Jul 2020 01:14:17 +0200 Received: from mx.physik.fu-berlin.de ([160.45.64.218]) by relay1.zedat.fu-berlin.de (Exim 4.93) with esmtps (TLS1.2) tls TLS_DHE_RSA_WITH_AES_128_CBC_SHA (envelope-from ) id 1jyNwH-001IwG-Ra; Thu, 23 Jul 2020 01:14:17 +0200 Received: from epyc.physik.fu-berlin.de ([160.45.64.180]) by mx.physik.fu-berlin.de with esmtps (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from ) id 1jyNwB-0002Uf-Bg; Thu, 23 Jul 2020 01:14:11 +0200 Received: from mkarcher by epyc.physik.fu-berlin.de with local (Exim 4.94 #2 (Debian)) id 1jyNwB-001lBq-3K; Thu, 23 Jul 2020 01:14:11 +0200 From: Michael Karcher To: linux-sh@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Yoshinori Sato , Rich Felker , Adrian Glaubitz , Michael Karcher Subject: [PATCH 4/4] sh: bring syscall_set_return_value in line with other architectures Date: Thu, 23 Jul 2020 01:13:22 +0200 Message-Id: <20200722231322.419642-4-kernel@mkarcher.dialup.fu-berlin.de> X-Mailer: git-send-email 2.28.0.rc1 In-Reply-To: <20200722231322.419642-1-kernel@mkarcher.dialup.fu-berlin.de> References: <20200722231322.419642-1-kernel@mkarcher.dialup.fu-berlin.de> MIME-Version: 1.0 X-Originating-IP: 160.45.64.218 X-ZEDAT-Hint: RV Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org Other architectures expect that syscall_set_return_value gets an already negative value as error. That's also what kernel/seccomp.c provides. Signed-off-by: Michael Karcher --- arch/sh/include/asm/syscall_32.h | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h index 0b5b8e75edac..cb51a7528384 100644 --- a/arch/sh/include/asm/syscall_32.h +++ b/arch/sh/include/asm/syscall_32.h @@ -40,10 +40,7 @@ static inline void syscall_set_return_value(struct task_struct *task, struct pt_regs *regs, int error, long val) { - if (error) - regs->regs[0] = -error; - else - regs->regs[0] = val; + regs->regs[0] = (long) error ?: val; } static inline void syscall_get_arguments(struct task_struct *task,