Commit | Line | Data |
---|---|---|
d97b46a6 CG |
1 | #include <linux/kernel.h> |
2 | #include <linux/syscalls.h> | |
3 | #include <linux/fdtable.h> | |
4 | #include <linux/string.h> | |
5 | #include <linux/random.h> | |
6 | #include <linux/module.h> | |
44fd07e9 | 7 | #include <linux/ptrace.h> |
d97b46a6 CG |
8 | #include <linux/init.h> |
9 | #include <linux/errno.h> | |
10 | #include <linux/cache.h> | |
11 | #include <linux/bug.h> | |
12 | #include <linux/err.h> | |
13 | #include <linux/kcmp.h> | |
14 | ||
15 | #include <asm/unistd.h> | |
16 | ||
17 | /* | |
18 | * We don't expose the real in-memory order of objects for security reasons. | |
19 | * But still the comparison results should be suitable for sorting. So we | |
20 | * obfuscate kernel pointers values and compare the production instead. | |
21 | * | |
22 | * The obfuscation is done in two steps. First we xor the kernel pointer with | |
23 | * a random value, which puts pointer into a new position in a reordered space. | |
24 | * Secondly we multiply the xor production with a large odd random number to | |
25 | * permute its bits even more (the odd multiplier guarantees that the product | |
26 | * is unique ever after the high bits are truncated, since any odd number is | |
27 | * relative prime to 2^n). | |
28 | * | |
29 | * Note also that the obfuscation itself is invisible to userspace and if needed | |
30 | * it can be changed to an alternate scheme. | |
31 | */ | |
32 | static unsigned long cookies[KCMP_TYPES][2] __read_mostly; | |
33 | ||
34 | static long kptr_obfuscate(long v, int type) | |
35 | { | |
36 | return (v ^ cookies[type][0]) * cookies[type][1]; | |
37 | } | |
38 | ||
39 | /* | |
40 | * 0 - equal, i.e. v1 = v2 | |
41 | * 1 - less than, i.e. v1 < v2 | |
42 | * 2 - greater than, i.e. v1 > v2 | |
43 | * 3 - not equal but ordering unavailable (reserved for future) | |
44 | */ | |
45 | static int kcmp_ptr(void *v1, void *v2, enum kcmp_type type) | |
46 | { | |
acbbe6fb | 47 | long t1, t2; |
d97b46a6 | 48 | |
acbbe6fb RV |
49 | t1 = kptr_obfuscate((long)v1, type); |
50 | t2 = kptr_obfuscate((long)v2, type); | |
d97b46a6 | 51 | |
acbbe6fb | 52 | return (t1 < t2) | ((t1 > t2) << 1); |
d97b46a6 CG |
53 | } |
54 | ||
55 | /* The caller must have pinned the task */ | |
56 | static struct file * | |
57 | get_file_raw_ptr(struct task_struct *task, unsigned int idx) | |
58 | { | |
59 | struct file *file = NULL; | |
60 | ||
61 | task_lock(task); | |
62 | rcu_read_lock(); | |
63 | ||
64 | if (task->files) | |
65 | file = fcheck_files(task->files, idx); | |
66 | ||
67 | rcu_read_unlock(); | |
68 | task_unlock(task); | |
69 | ||
70 | return file; | |
71 | } | |
72 | ||
73 | static void kcmp_unlock(struct mutex *m1, struct mutex *m2) | |
74 | { | |
75 | if (likely(m2 != m1)) | |
76 | mutex_unlock(m2); | |
77 | mutex_unlock(m1); | |
78 | } | |
79 | ||
80 | static int kcmp_lock(struct mutex *m1, struct mutex *m2) | |
81 | { | |
82 | int err; | |
83 | ||
84 | if (m2 > m1) | |
85 | swap(m1, m2); | |
86 | ||
87 | err = mutex_lock_killable(m1); | |
88 | if (!err && likely(m1 != m2)) { | |
89 | err = mutex_lock_killable_nested(m2, SINGLE_DEPTH_NESTING); | |
90 | if (err) | |
91 | mutex_unlock(m1); | |
92 | } | |
93 | ||
94 | return err; | |
95 | } | |
96 | ||
97 | SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type, | |
98 | unsigned long, idx1, unsigned long, idx2) | |
99 | { | |
100 | struct task_struct *task1, *task2; | |
101 | int ret; | |
102 | ||
103 | rcu_read_lock(); | |
104 | ||
105 | /* | |
106 | * Tasks are looked up in caller's PID namespace only. | |
107 | */ | |
108 | task1 = find_task_by_vpid(pid1); | |
109 | task2 = find_task_by_vpid(pid2); | |
110 | if (!task1 || !task2) | |
111 | goto err_no_task; | |
112 | ||
113 | get_task_struct(task1); | |
114 | get_task_struct(task2); | |
115 | ||
116 | rcu_read_unlock(); | |
117 | ||
118 | /* | |
119 | * One should have enough rights to inspect task details. | |
120 | */ | |
121 | ret = kcmp_lock(&task1->signal->cred_guard_mutex, | |
122 | &task2->signal->cred_guard_mutex); | |
123 | if (ret) | |
124 | goto err; | |
caaee623 JH |
125 | if (!ptrace_may_access(task1, PTRACE_MODE_READ_REALCREDS) || |
126 | !ptrace_may_access(task2, PTRACE_MODE_READ_REALCREDS)) { | |
d97b46a6 CG |
127 | ret = -EPERM; |
128 | goto err_unlock; | |
129 | } | |
130 | ||
131 | switch (type) { | |
132 | case KCMP_FILE: { | |
133 | struct file *filp1, *filp2; | |
134 | ||
135 | filp1 = get_file_raw_ptr(task1, idx1); | |
136 | filp2 = get_file_raw_ptr(task2, idx2); | |
137 | ||
138 | if (filp1 && filp2) | |
139 | ret = kcmp_ptr(filp1, filp2, KCMP_FILE); | |
140 | else | |
141 | ret = -EBADF; | |
142 | break; | |
143 | } | |
144 | case KCMP_VM: | |
145 | ret = kcmp_ptr(task1->mm, task2->mm, KCMP_VM); | |
146 | break; | |
147 | case KCMP_FILES: | |
148 | ret = kcmp_ptr(task1->files, task2->files, KCMP_FILES); | |
149 | break; | |
150 | case KCMP_FS: | |
151 | ret = kcmp_ptr(task1->fs, task2->fs, KCMP_FS); | |
152 | break; | |
153 | case KCMP_SIGHAND: | |
154 | ret = kcmp_ptr(task1->sighand, task2->sighand, KCMP_SIGHAND); | |
155 | break; | |
156 | case KCMP_IO: | |
157 | ret = kcmp_ptr(task1->io_context, task2->io_context, KCMP_IO); | |
158 | break; | |
159 | case KCMP_SYSVSEM: | |
160 | #ifdef CONFIG_SYSVIPC | |
161 | ret = kcmp_ptr(task1->sysvsem.undo_list, | |
162 | task2->sysvsem.undo_list, | |
163 | KCMP_SYSVSEM); | |
164 | #else | |
165 | ret = -EOPNOTSUPP; | |
166 | #endif | |
167 | break; | |
168 | default: | |
169 | ret = -EINVAL; | |
170 | break; | |
171 | } | |
172 | ||
173 | err_unlock: | |
174 | kcmp_unlock(&task1->signal->cred_guard_mutex, | |
175 | &task2->signal->cred_guard_mutex); | |
176 | err: | |
177 | put_task_struct(task1); | |
178 | put_task_struct(task2); | |
179 | ||
180 | return ret; | |
181 | ||
182 | err_no_task: | |
183 | rcu_read_unlock(); | |
184 | return -ESRCH; | |
185 | } | |
186 | ||
187 | static __init int kcmp_cookies_init(void) | |
188 | { | |
189 | int i; | |
190 | ||
191 | get_random_bytes(cookies, sizeof(cookies)); | |
192 | ||
193 | for (i = 0; i < KCMP_TYPES; i++) | |
194 | cookies[i][1] |= (~(~0UL >> 1) | 1); | |
195 | ||
196 | return 0; | |
197 | } | |
198 | arch_initcall(kcmp_cookies_init); |