Commit | Line | Data |
---|---|---|
b2441318 | 1 | // SPDX-License-Identifier: GPL-2.0 |
d97b46a6 CG |
2 | #include <linux/kernel.h> |
3 | #include <linux/syscalls.h> | |
4 | #include <linux/fdtable.h> | |
5 | #include <linux/string.h> | |
6 | #include <linux/random.h> | |
7 | #include <linux/module.h> | |
44fd07e9 | 8 | #include <linux/ptrace.h> |
d97b46a6 CG |
9 | #include <linux/init.h> |
10 | #include <linux/errno.h> | |
11 | #include <linux/cache.h> | |
12 | #include <linux/bug.h> | |
13 | #include <linux/err.h> | |
14 | #include <linux/kcmp.h> | |
0791e364 CG |
15 | #include <linux/capability.h> |
16 | #include <linux/list.h> | |
17 | #include <linux/eventpoll.h> | |
18 | #include <linux/file.h> | |
d97b46a6 CG |
19 | |
20 | #include <asm/unistd.h> | |
21 | ||
22 | /* | |
23 | * We don't expose the real in-memory order of objects for security reasons. | |
24 | * But still the comparison results should be suitable for sorting. So we | |
25 | * obfuscate kernel pointers values and compare the production instead. | |
26 | * | |
27 | * The obfuscation is done in two steps. First we xor the kernel pointer with | |
28 | * a random value, which puts pointer into a new position in a reordered space. | |
29 | * Secondly we multiply the xor production with a large odd random number to | |
30 | * permute its bits even more (the odd multiplier guarantees that the product | |
31 | * is unique ever after the high bits are truncated, since any odd number is | |
32 | * relative prime to 2^n). | |
33 | * | |
34 | * Note also that the obfuscation itself is invisible to userspace and if needed | |
35 | * it can be changed to an alternate scheme. | |
36 | */ | |
37 | static unsigned long cookies[KCMP_TYPES][2] __read_mostly; | |
38 | ||
39 | static long kptr_obfuscate(long v, int type) | |
40 | { | |
41 | return (v ^ cookies[type][0]) * cookies[type][1]; | |
42 | } | |
43 | ||
44 | /* | |
45 | * 0 - equal, i.e. v1 = v2 | |
46 | * 1 - less than, i.e. v1 < v2 | |
47 | * 2 - greater than, i.e. v1 > v2 | |
48 | * 3 - not equal but ordering unavailable (reserved for future) | |
49 | */ | |
50 | static int kcmp_ptr(void *v1, void *v2, enum kcmp_type type) | |
51 | { | |
acbbe6fb | 52 | long t1, t2; |
d97b46a6 | 53 | |
acbbe6fb RV |
54 | t1 = kptr_obfuscate((long)v1, type); |
55 | t2 = kptr_obfuscate((long)v2, type); | |
d97b46a6 | 56 | |
acbbe6fb | 57 | return (t1 < t2) | ((t1 > t2) << 1); |
d97b46a6 CG |
58 | } |
59 | ||
60 | /* The caller must have pinned the task */ | |
61 | static struct file * | |
62 | get_file_raw_ptr(struct task_struct *task, unsigned int idx) | |
63 | { | |
ed77e80e | 64 | struct file *file; |
d97b46a6 | 65 | |
d97b46a6 | 66 | rcu_read_lock(); |
0ede61d8 | 67 | file = task_lookup_fdget_rcu(task, idx); |
d97b46a6 | 68 | rcu_read_unlock(); |
0ede61d8 CB |
69 | if (file) |
70 | fput(file); | |
d97b46a6 CG |
71 | |
72 | return file; | |
73 | } | |
74 | ||
f7cfd871 | 75 | static void kcmp_unlock(struct rw_semaphore *l1, struct rw_semaphore *l2) |
d97b46a6 | 76 | { |
f7cfd871 EB |
77 | if (likely(l2 != l1)) |
78 | up_read(l2); | |
79 | up_read(l1); | |
d97b46a6 CG |
80 | } |
81 | ||
f7cfd871 | 82 | static int kcmp_lock(struct rw_semaphore *l1, struct rw_semaphore *l2) |
d97b46a6 CG |
83 | { |
84 | int err; | |
85 | ||
f7cfd871 EB |
86 | if (l2 > l1) |
87 | swap(l1, l2); | |
d97b46a6 | 88 | |
f7cfd871 EB |
89 | err = down_read_killable(l1); |
90 | if (!err && likely(l1 != l2)) { | |
91 | err = down_read_killable_nested(l2, SINGLE_DEPTH_NESTING); | |
d97b46a6 | 92 | if (err) |
f7cfd871 | 93 | up_read(l1); |
d97b46a6 CG |
94 | } |
95 | ||
96 | return err; | |
97 | } | |
98 | ||
0791e364 CG |
99 | #ifdef CONFIG_EPOLL |
100 | static int kcmp_epoll_target(struct task_struct *task1, | |
101 | struct task_struct *task2, | |
102 | unsigned long idx1, | |
103 | struct kcmp_epoll_slot __user *uslot) | |
104 | { | |
105 | struct file *filp, *filp_epoll, *filp_tgt; | |
106 | struct kcmp_epoll_slot slot; | |
0791e364 CG |
107 | |
108 | if (copy_from_user(&slot, uslot, sizeof(slot))) | |
109 | return -EFAULT; | |
110 | ||
111 | filp = get_file_raw_ptr(task1, idx1); | |
112 | if (!filp) | |
113 | return -EBADF; | |
114 | ||
f43c283a EB |
115 | filp_epoll = fget_task(task2, slot.efd); |
116 | if (!filp_epoll) | |
0791e364 CG |
117 | return -EBADF; |
118 | ||
f43c283a EB |
119 | filp_tgt = get_epoll_tfile_raw_ptr(filp_epoll, slot.tfd, slot.toff); |
120 | fput(filp_epoll); | |
0791e364 CG |
121 | |
122 | if (IS_ERR(filp_tgt)) | |
123 | return PTR_ERR(filp_tgt); | |
124 | ||
125 | return kcmp_ptr(filp, filp_tgt, KCMP_FILE); | |
126 | } | |
127 | #else | |
128 | static int kcmp_epoll_target(struct task_struct *task1, | |
129 | struct task_struct *task2, | |
130 | unsigned long idx1, | |
131 | struct kcmp_epoll_slot __user *uslot) | |
132 | { | |
133 | return -EOPNOTSUPP; | |
134 | } | |
135 | #endif | |
136 | ||
d97b46a6 CG |
137 | SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type, |
138 | unsigned long, idx1, unsigned long, idx2) | |
139 | { | |
140 | struct task_struct *task1, *task2; | |
141 | int ret; | |
142 | ||
143 | rcu_read_lock(); | |
144 | ||
145 | /* | |
146 | * Tasks are looked up in caller's PID namespace only. | |
147 | */ | |
148 | task1 = find_task_by_vpid(pid1); | |
149 | task2 = find_task_by_vpid(pid2); | |
150 | if (!task1 || !task2) | |
151 | goto err_no_task; | |
152 | ||
153 | get_task_struct(task1); | |
154 | get_task_struct(task2); | |
155 | ||
156 | rcu_read_unlock(); | |
157 | ||
158 | /* | |
159 | * One should have enough rights to inspect task details. | |
160 | */ | |
f7cfd871 EB |
161 | ret = kcmp_lock(&task1->signal->exec_update_lock, |
162 | &task2->signal->exec_update_lock); | |
d97b46a6 CG |
163 | if (ret) |
164 | goto err; | |
caaee623 JH |
165 | if (!ptrace_may_access(task1, PTRACE_MODE_READ_REALCREDS) || |
166 | !ptrace_may_access(task2, PTRACE_MODE_READ_REALCREDS)) { | |
d97b46a6 CG |
167 | ret = -EPERM; |
168 | goto err_unlock; | |
169 | } | |
170 | ||
171 | switch (type) { | |
172 | case KCMP_FILE: { | |
173 | struct file *filp1, *filp2; | |
174 | ||
175 | filp1 = get_file_raw_ptr(task1, idx1); | |
176 | filp2 = get_file_raw_ptr(task2, idx2); | |
177 | ||
178 | if (filp1 && filp2) | |
179 | ret = kcmp_ptr(filp1, filp2, KCMP_FILE); | |
180 | else | |
181 | ret = -EBADF; | |
182 | break; | |
183 | } | |
184 | case KCMP_VM: | |
185 | ret = kcmp_ptr(task1->mm, task2->mm, KCMP_VM); | |
186 | break; | |
187 | case KCMP_FILES: | |
188 | ret = kcmp_ptr(task1->files, task2->files, KCMP_FILES); | |
189 | break; | |
190 | case KCMP_FS: | |
191 | ret = kcmp_ptr(task1->fs, task2->fs, KCMP_FS); | |
192 | break; | |
193 | case KCMP_SIGHAND: | |
194 | ret = kcmp_ptr(task1->sighand, task2->sighand, KCMP_SIGHAND); | |
195 | break; | |
196 | case KCMP_IO: | |
197 | ret = kcmp_ptr(task1->io_context, task2->io_context, KCMP_IO); | |
198 | break; | |
199 | case KCMP_SYSVSEM: | |
200 | #ifdef CONFIG_SYSVIPC | |
201 | ret = kcmp_ptr(task1->sysvsem.undo_list, | |
202 | task2->sysvsem.undo_list, | |
203 | KCMP_SYSVSEM); | |
204 | #else | |
205 | ret = -EOPNOTSUPP; | |
206 | #endif | |
207 | break; | |
0791e364 CG |
208 | case KCMP_EPOLL_TFD: |
209 | ret = kcmp_epoll_target(task1, task2, idx1, (void *)idx2); | |
210 | break; | |
d97b46a6 CG |
211 | default: |
212 | ret = -EINVAL; | |
213 | break; | |
214 | } | |
215 | ||
216 | err_unlock: | |
f7cfd871 EB |
217 | kcmp_unlock(&task1->signal->exec_update_lock, |
218 | &task2->signal->exec_update_lock); | |
d97b46a6 CG |
219 | err: |
220 | put_task_struct(task1); | |
221 | put_task_struct(task2); | |
222 | ||
223 | return ret; | |
224 | ||
225 | err_no_task: | |
226 | rcu_read_unlock(); | |
227 | return -ESRCH; | |
228 | } | |
229 | ||
230 | static __init int kcmp_cookies_init(void) | |
231 | { | |
232 | int i; | |
233 | ||
234 | get_random_bytes(cookies, sizeof(cookies)); | |
235 | ||
236 | for (i = 0; i < KCMP_TYPES; i++) | |
237 | cookies[i][1] |= (~(~0UL >> 1) | 1); | |
238 | ||
239 | return 0; | |
240 | } | |
241 | arch_initcall(kcmp_cookies_init); |