Commit | Line | Data |
---|---|---|
b2441318 | 1 | // SPDX-License-Identifier: GPL-2.0 |
1da177e4 | 2 | /* |
95c46b56 AL |
3 | * Copyright (c) 2012-2014 Andy Lutomirski <luto@amacapital.net> |
4 | * | |
5 | * Based on the original implementation which is: | |
1da177e4 LT |
6 | * Copyright (C) 2001 Andrea Arcangeli <andrea@suse.de> SuSE |
7 | * Copyright 2003 Andi Kleen, SuSE Labs. | |
8 | * | |
95c46b56 AL |
9 | * Parts of the original code have been moved to arch/x86/vdso/vma.c |
10 | * | |
11 | * This file implements vsyscall emulation. vsyscalls are a legacy ABI: | |
12 | * Userspace can request certain kernel services by calling fixed | |
13 | * addresses. This concept is problematic: | |
5cec93c2 | 14 | * |
95c46b56 AL |
15 | * - It interferes with ASLR. |
16 | * - It's awkward to write code that lives in kernel addresses but is | |
17 | * callable by userspace at fixed addresses. | |
18 | * - The whole concept is impossible for 32-bit compat userspace. | |
19 | * - UML cannot easily virtualize a vsyscall. | |
1da177e4 | 20 | * |
95c46b56 AL |
21 | * As of mid-2014, I believe that there is no new userspace code that |
22 | * will use a vsyscall if the vDSO is present. I hope that there will | |
23 | * soon be no new userspace code that will ever use a vsyscall. | |
1da177e4 | 24 | * |
95c46b56 AL |
25 | * The code in this file emulates vsyscalls when notified of a page |
26 | * fault to a vsyscall address. | |
1da177e4 LT |
27 | */ |
28 | ||
1da177e4 LT |
29 | #include <linux/kernel.h> |
30 | #include <linux/timer.h> | |
3f07c014 | 31 | #include <linux/sched/signal.h> |
589ee628 | 32 | #include <linux/mm_types.h> |
5cec93c2 AL |
33 | #include <linux/syscalls.h> |
34 | #include <linux/ratelimit.h> | |
1da177e4 LT |
35 | |
36 | #include <asm/vsyscall.h> | |
7460ed28 | 37 | #include <asm/unistd.h> |
1da177e4 | 38 | #include <asm/fixmap.h> |
5cec93c2 | 39 | #include <asm/traps.h> |
1da177e4 | 40 | |
c149a665 AL |
41 | #define CREATE_TRACE_POINTS |
42 | #include "vsyscall_trace.h" | |
43 | ||
3dc33bd3 | 44 | static enum { EMULATE, NATIVE, NONE } vsyscall_mode = |
93f13a9f | 45 | #if defined(CONFIG_LEGACY_VSYSCALL_NATIVE) |
3dc33bd3 | 46 | NATIVE; |
93f13a9f | 47 | #elif defined(CONFIG_LEGACY_VSYSCALL_NONE) |
3dc33bd3 KC |
48 | NONE; |
49 | #else | |
50 | EMULATE; | |
51 | #endif | |
3ae36655 AL |
52 | |
53 | static int __init vsyscall_setup(char *str) | |
54 | { | |
55 | if (str) { | |
56 | if (!strcmp("emulate", str)) | |
57 | vsyscall_mode = EMULATE; | |
58 | else if (!strcmp("native", str)) | |
59 | vsyscall_mode = NATIVE; | |
60 | else if (!strcmp("none", str)) | |
61 | vsyscall_mode = NONE; | |
62 | else | |
63 | return -EINVAL; | |
64 | ||
65 | return 0; | |
66 | } | |
67 | ||
68 | return -EINVAL; | |
69 | } | |
70 | early_param("vsyscall", vsyscall_setup); | |
71 | ||
5cec93c2 AL |
72 | static void warn_bad_vsyscall(const char *level, struct pt_regs *regs, |
73 | const char *message) | |
1da177e4 | 74 | { |
c767a54b | 75 | if (!show_unhandled_signals) |
5cec93c2 | 76 | return; |
1da177e4 | 77 | |
53b884ac AL |
78 | printk_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n", |
79 | level, current->comm, task_pid_nr(current), | |
80 | message, regs->ip, regs->cs, | |
81 | regs->sp, regs->ax, regs->si, regs->di); | |
c9712944 AL |
82 | } |
83 | ||
84 | static int addr_to_vsyscall_nr(unsigned long addr) | |
85 | { | |
86 | int nr; | |
87 | ||
f40c3300 | 88 | if ((addr & ~0xC00UL) != VSYSCALL_ADDR) |
c9712944 AL |
89 | return -EINVAL; |
90 | ||
91 | nr = (addr & 0xC00UL) >> 10; | |
92 | if (nr >= 3) | |
93 | return -EINVAL; | |
94 | ||
95 | return nr; | |
1da177e4 LT |
96 | } |
97 | ||
4fc34901 AL |
98 | static bool write_ok_or_segv(unsigned long ptr, size_t size) |
99 | { | |
100 | /* | |
101 | * XXX: if access_ok, get_user, and put_user handled | |
2a53ccbc | 102 | * sig_on_uaccess_err, this could go away. |
4fc34901 AL |
103 | */ |
104 | ||
105 | if (!access_ok(VERIFY_WRITE, (void __user *)ptr, size)) { | |
106 | siginfo_t info; | |
107 | struct thread_struct *thread = ¤t->thread; | |
108 | ||
109 | thread->error_code = 6; /* user fault, no page, write */ | |
110 | thread->cr2 = ptr; | |
51e7dc70 | 111 | thread->trap_nr = X86_TRAP_PF; |
4fc34901 AL |
112 | |
113 | memset(&info, 0, sizeof(info)); | |
114 | info.si_signo = SIGSEGV; | |
115 | info.si_errno = 0; | |
116 | info.si_code = SEGV_MAPERR; | |
117 | info.si_addr = (void __user *)ptr; | |
118 | ||
119 | force_sig_info(SIGSEGV, &info, current); | |
120 | return false; | |
121 | } else { | |
122 | return true; | |
123 | } | |
124 | } | |
125 | ||
3ae36655 | 126 | bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) |
1da177e4 | 127 | { |
5cec93c2 AL |
128 | struct task_struct *tsk; |
129 | unsigned long caller; | |
87b526d3 | 130 | int vsyscall_nr, syscall_nr, tmp; |
2a53ccbc | 131 | int prev_sig_on_uaccess_err; |
5cec93c2 AL |
132 | long ret; |
133 | ||
3ae36655 AL |
134 | /* |
135 | * No point in checking CS -- the only way to get here is a user mode | |
136 | * trap to a high address, which means that we're in 64-bit user code. | |
137 | */ | |
5cec93c2 | 138 | |
3ae36655 | 139 | WARN_ON_ONCE(address != regs->ip); |
c9712944 | 140 | |
3ae36655 AL |
141 | if (vsyscall_mode == NONE) { |
142 | warn_bad_vsyscall(KERN_INFO, regs, | |
143 | "vsyscall attempted with vsyscall=none"); | |
144 | return false; | |
c9712944 AL |
145 | } |
146 | ||
3ae36655 | 147 | vsyscall_nr = addr_to_vsyscall_nr(address); |
c149a665 AL |
148 | |
149 | trace_emulate_vsyscall(vsyscall_nr); | |
150 | ||
c9712944 AL |
151 | if (vsyscall_nr < 0) { |
152 | warn_bad_vsyscall(KERN_WARNING, regs, | |
3ae36655 | 153 | "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround"); |
5cec93c2 AL |
154 | goto sigsegv; |
155 | } | |
d0aff6e6 | 156 | |
5cec93c2 | 157 | if (get_user(caller, (unsigned long __user *)regs->sp) != 0) { |
3ae36655 AL |
158 | warn_bad_vsyscall(KERN_WARNING, regs, |
159 | "vsyscall with bad stack (exploit attempt?)"); | |
5cec93c2 AL |
160 | goto sigsegv; |
161 | } | |
8c73626a | 162 | |
5cec93c2 | 163 | tsk = current; |
4fc34901 AL |
164 | |
165 | /* | |
87b526d3 AL |
166 | * Check for access_ok violations and find the syscall nr. |
167 | * | |
46ed99d1 | 168 | * NULL is a valid user pointer (in the access_ok sense) on 32-bit and |
4fc34901 | 169 | * 64-bit, so we don't need to special-case it here. For all the |
46ed99d1 | 170 | * vsyscalls, NULL means "don't write anything" not "write it at |
4fc34901 AL |
171 | * address 0". |
172 | */ | |
5cec93c2 AL |
173 | switch (vsyscall_nr) { |
174 | case 0: | |
4fc34901 | 175 | if (!write_ok_or_segv(regs->di, sizeof(struct timeval)) || |
87b526d3 AL |
176 | !write_ok_or_segv(regs->si, sizeof(struct timezone))) { |
177 | ret = -EFAULT; | |
178 | goto check_fault; | |
179 | } | |
4fc34901 | 180 | |
87b526d3 AL |
181 | syscall_nr = __NR_gettimeofday; |
182 | break; | |
183 | ||
184 | case 1: | |
185 | if (!write_ok_or_segv(regs->di, sizeof(time_t))) { | |
186 | ret = -EFAULT; | |
187 | goto check_fault; | |
188 | } | |
189 | ||
190 | syscall_nr = __NR_time; | |
191 | break; | |
192 | ||
193 | case 2: | |
194 | if (!write_ok_or_segv(regs->di, sizeof(unsigned)) || | |
195 | !write_ok_or_segv(regs->si, sizeof(unsigned))) { | |
196 | ret = -EFAULT; | |
197 | goto check_fault; | |
198 | } | |
199 | ||
200 | syscall_nr = __NR_getcpu; | |
201 | break; | |
202 | } | |
203 | ||
204 | /* | |
205 | * Handle seccomp. regs->ip must be the original value. | |
206 | * See seccomp_send_sigsys and Documentation/prctl/seccomp_filter.txt. | |
207 | * | |
208 | * We could optimize the seccomp disabled case, but performance | |
209 | * here doesn't matter. | |
210 | */ | |
211 | regs->orig_ax = syscall_nr; | |
212 | regs->ax = -ENOSYS; | |
2f275de5 | 213 | tmp = secure_computing(NULL); |
87b526d3 AL |
214 | if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) { |
215 | warn_bad_vsyscall(KERN_DEBUG, regs, | |
216 | "seccomp tried to change syscall nr or ip"); | |
217 | do_exit(SIGSYS); | |
218 | } | |
26893107 | 219 | regs->orig_ax = -1; |
87b526d3 AL |
220 | if (tmp) |
221 | goto do_ret; /* skip requested */ | |
222 | ||
223 | /* | |
224 | * With a real vsyscall, page faults cause SIGSEGV. We want to | |
225 | * preserve that behavior to make writing exploits harder. | |
226 | */ | |
2a53ccbc IM |
227 | prev_sig_on_uaccess_err = current->thread.sig_on_uaccess_err; |
228 | current->thread.sig_on_uaccess_err = 1; | |
87b526d3 AL |
229 | |
230 | ret = -EFAULT; | |
231 | switch (vsyscall_nr) { | |
232 | case 0: | |
5cec93c2 AL |
233 | ret = sys_gettimeofday( |
234 | (struct timeval __user *)regs->di, | |
235 | (struct timezone __user *)regs->si); | |
236 | break; | |
237 | ||
238 | case 1: | |
5cec93c2 AL |
239 | ret = sys_time((time_t __user *)regs->di); |
240 | break; | |
241 | ||
242 | case 2: | |
5cec93c2 AL |
243 | ret = sys_getcpu((unsigned __user *)regs->di, |
244 | (unsigned __user *)regs->si, | |
46ed99d1 | 245 | NULL); |
5cec93c2 | 246 | break; |
5cec93c2 | 247 | } |
8c73626a | 248 | |
2a53ccbc | 249 | current->thread.sig_on_uaccess_err = prev_sig_on_uaccess_err; |
4fc34901 | 250 | |
87b526d3 | 251 | check_fault: |
5cec93c2 | 252 | if (ret == -EFAULT) { |
4fc34901 | 253 | /* Bad news -- userspace fed a bad pointer to a vsyscall. */ |
5cec93c2 AL |
254 | warn_bad_vsyscall(KERN_INFO, regs, |
255 | "vsyscall fault (exploit attempt?)"); | |
4fc34901 AL |
256 | |
257 | /* | |
258 | * If we failed to generate a signal for any reason, | |
259 | * generate one here. (This should be impossible.) | |
260 | */ | |
261 | if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) && | |
262 | !sigismember(&tsk->pending.signal, SIGSEGV))) | |
263 | goto sigsegv; | |
264 | ||
265 | return true; /* Don't emulate the ret. */ | |
5cec93c2 | 266 | } |
8c73626a | 267 | |
5cec93c2 | 268 | regs->ax = ret; |
1da177e4 | 269 | |
5651721e | 270 | do_ret: |
5cec93c2 AL |
271 | /* Emulate a ret instruction. */ |
272 | regs->ip = caller; | |
273 | regs->sp += 8; | |
3ae36655 | 274 | return true; |
5cec93c2 AL |
275 | |
276 | sigsegv: | |
5cec93c2 | 277 | force_sig(SIGSEGV, current); |
3ae36655 | 278 | return true; |
1da177e4 LT |
279 | } |
280 | ||
b9359090 AL |
281 | /* |
282 | * A pseudo VMA to allow ptrace access for the vsyscall page. This only | |
283 | * covers the 64bit vsyscall page now. 32bit has a real VMA now and does | |
284 | * not need special handling anymore: | |
285 | */ | |
286 | static const char *gate_vma_name(struct vm_area_struct *vma) | |
287 | { | |
288 | return "[vsyscall]"; | |
289 | } | |
7cbea8dc | 290 | static const struct vm_operations_struct gate_vma_ops = { |
b9359090 AL |
291 | .name = gate_vma_name, |
292 | }; | |
293 | static struct vm_area_struct gate_vma = { | |
294 | .vm_start = VSYSCALL_ADDR, | |
295 | .vm_end = VSYSCALL_ADDR + PAGE_SIZE, | |
296 | .vm_page_prot = PAGE_READONLY_EXEC, | |
297 | .vm_flags = VM_READ | VM_EXEC, | |
298 | .vm_ops = &gate_vma_ops, | |
299 | }; | |
300 | ||
301 | struct vm_area_struct *get_gate_vma(struct mm_struct *mm) | |
302 | { | |
c338867d | 303 | #ifdef CONFIG_COMPAT |
b9359090 AL |
304 | if (!mm || mm->context.ia32_compat) |
305 | return NULL; | |
306 | #endif | |
87983c66 AL |
307 | if (vsyscall_mode == NONE) |
308 | return NULL; | |
b9359090 AL |
309 | return &gate_vma; |
310 | } | |
311 | ||
312 | int in_gate_area(struct mm_struct *mm, unsigned long addr) | |
313 | { | |
314 | struct vm_area_struct *vma = get_gate_vma(mm); | |
315 | ||
316 | if (!vma) | |
317 | return 0; | |
318 | ||
319 | return (addr >= vma->vm_start) && (addr < vma->vm_end); | |
320 | } | |
321 | ||
322 | /* | |
323 | * Use this when you have no reliable mm, typically from interrupt | |
324 | * context. It is less reliable than using a task's mm and may give | |
325 | * false positives. | |
326 | */ | |
327 | int in_gate_area_no_mm(unsigned long addr) | |
328 | { | |
87983c66 | 329 | return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR; |
b9359090 AL |
330 | } |
331 | ||
e4026440 | 332 | void __init map_vsyscall(void) |
1da177e4 | 333 | { |
3ae36655 AL |
334 | extern char __vsyscall_page; |
335 | unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page); | |
1da177e4 | 336 | |
87983c66 AL |
337 | if (vsyscall_mode != NONE) |
338 | __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall, | |
339 | vsyscall_mode == NATIVE | |
340 | ? PAGE_KERNEL_VSYSCALL | |
341 | : PAGE_KERNEL_VVAR); | |
342 | ||
f40c3300 AL |
343 | BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) != |
344 | (unsigned long)VSYSCALL_ADDR); | |
1da177e4 | 345 | } |