2019-05-23 09:14:57 +00:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
2017-07-11 01:07:09 +00:00
|
|
|
/*
|
|
|
|
|
* Copyright (C) 2009 Sunplus Core Technology Co., Ltd.
|
|
|
|
|
* Chen Liqin <liqin.chen@sunplusct.com>
|
|
|
|
|
* Lennox Wu <lennox.wu@sunplusct.com>
|
|
|
|
|
* Copyright (C) 2012 Regents of the University of California
|
|
|
|
|
*/
|
|
|
|
|
|
2022-04-05 07:13:12 +00:00
|
|
|
#include <linux/compat.h>
|
2017-07-11 01:07:09 +00:00
|
|
|
#include <linux/signal.h>
|
|
|
|
|
#include <linux/uaccess.h>
|
|
|
|
|
#include <linux/syscalls.h>
|
2022-02-09 18:20:45 +00:00
|
|
|
#include <linux/resume_user_mode.h>
|
2017-07-11 01:07:09 +00:00
|
|
|
#include <linux/linkage.h>
|
2023-02-22 03:30:18 +00:00
|
|
|
#include <linux/entry-common.h>
|
2017-07-11 01:07:09 +00:00
|
|
|
|
|
|
|
|
#include <asm/ucontext.h>
|
|
|
|
|
#include <asm/vdso.h>
|
2022-08-14 14:12:37 +00:00
|
|
|
#include <asm/signal.h>
|
2022-04-05 07:13:12 +00:00
|
|
|
#include <asm/signal32.h>
|
2017-07-11 01:07:09 +00:00
|
|
|
#include <asm/switch_to.h>
|
2023-06-05 11:07:11 +00:00
|
|
|
#include <asm/vector.h>
|
2017-07-11 01:07:09 +00:00
|
|
|
#include <asm/csr.h>
|
2023-04-06 10:11:31 +00:00
|
|
|
#include <asm/cacheflush.h>
|
2017-07-11 01:07:09 +00:00
|
|
|
|
2023-06-05 11:07:12 +00:00
|
|
|
unsigned long signal_minsigstksz __ro_after_init;
|
|
|
|
|
|
2019-10-28 12:10:41 +00:00
|
|
|
extern u32 __user_rt_sigreturn[2];
|
2023-06-05 11:07:11 +00:00
|
|
|
static size_t riscv_v_sc_size __ro_after_init;
|
2019-10-28 12:10:41 +00:00
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
#define DEBUG_SIG 0
|
|
|
|
|
|
|
|
|
|
struct rt_sigframe {
|
|
|
|
|
struct siginfo info;
|
|
|
|
|
struct ucontext uc;
|
2019-10-28 12:10:41 +00:00
|
|
|
#ifndef CONFIG_MMU
|
|
|
|
|
u32 sigreturn_code[2];
|
|
|
|
|
#endif
|
2017-07-11 01:07:09 +00:00
|
|
|
};
|
|
|
|
|
|
2018-10-09 02:18:33 +00:00
|
|
|
#ifdef CONFIG_FPU
|
2018-10-09 02:18:31 +00:00
|
|
|
static long restore_fp_state(struct pt_regs *regs,
|
2019-10-17 22:41:25 +00:00
|
|
|
union __riscv_fp_state __user *sc_fpregs)
|
2017-07-11 01:07:09 +00:00
|
|
|
{
|
|
|
|
|
long err;
|
2018-10-09 02:18:31 +00:00
|
|
|
struct __riscv_d_ext_state __user *state = &sc_fpregs->d;
|
|
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
err = __copy_from_user(¤t->thread.fstate, state, sizeof(*state));
|
2018-10-09 02:18:31 +00:00
|
|
|
if (unlikely(err))
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
fstate_restore(current, regs);
|
2023-06-05 11:07:10 +00:00
|
|
|
return 0;
|
2017-07-11 01:07:09 +00:00
|
|
|
}
|
|
|
|
|
|
2018-10-09 02:18:31 +00:00
|
|
|
static long save_fp_state(struct pt_regs *regs,
|
2019-10-17 22:41:25 +00:00
|
|
|
union __riscv_fp_state __user *sc_fpregs)
|
2017-07-11 01:07:09 +00:00
|
|
|
{
|
2018-10-09 02:18:31 +00:00
|
|
|
long err;
|
|
|
|
|
struct __riscv_d_ext_state __user *state = &sc_fpregs->d;
|
|
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
fstate_save(current, regs);
|
2018-10-09 02:18:31 +00:00
|
|
|
err = __copy_to_user(state, ¤t->thread.fstate, sizeof(*state));
|
|
|
|
|
return err;
|
2017-07-11 01:07:09 +00:00
|
|
|
}
|
2018-10-09 02:18:33 +00:00
|
|
|
#else
|
|
|
|
|
#define save_fp_state(task, regs) (0)
|
|
|
|
|
#define restore_fp_state(task, regs) (0)
|
|
|
|
|
#endif
|
2017-07-11 01:07:09 +00:00
|
|
|
|
2023-06-05 11:07:11 +00:00
|
|
|
#ifdef CONFIG_RISCV_ISA_V
|
|
|
|
|
|
|
|
|
|
static long save_v_state(struct pt_regs *regs, void __user **sc_vec)
|
|
|
|
|
{
|
|
|
|
|
struct __riscv_ctx_hdr __user *hdr;
|
|
|
|
|
struct __sc_riscv_v_state __user *state;
|
|
|
|
|
void __user *datap;
|
|
|
|
|
long err;
|
|
|
|
|
|
|
|
|
|
hdr = *sc_vec;
|
|
|
|
|
/* Place state to the user's signal context space after the hdr */
|
|
|
|
|
state = (struct __sc_riscv_v_state __user *)(hdr + 1);
|
|
|
|
|
/* Point datap right after the end of __sc_riscv_v_state */
|
|
|
|
|
datap = state + 1;
|
|
|
|
|
|
|
|
|
|
/* datap is designed to be 16 byte aligned for better performance */
|
|
|
|
|
WARN_ON(unlikely(!IS_ALIGNED((unsigned long)datap, 16)));
|
|
|
|
|
|
2024-01-15 05:59:23 +00:00
|
|
|
get_cpu_vector_context();
|
2024-01-15 05:59:26 +00:00
|
|
|
riscv_v_vstate_save(¤t->thread.vstate, regs);
|
2024-01-15 05:59:23 +00:00
|
|
|
put_cpu_vector_context();
|
|
|
|
|
|
2023-06-05 11:07:11 +00:00
|
|
|
/* Copy everything of vstate but datap. */
|
|
|
|
|
err = __copy_to_user(&state->v_state, ¤t->thread.vstate,
|
|
|
|
|
offsetof(struct __riscv_v_ext_state, datap));
|
|
|
|
|
/* Copy the pointer datap itself. */
|
2023-11-23 14:27:08 +00:00
|
|
|
err |= __put_user((__force void *)datap, &state->v_state.datap);
|
2023-06-05 11:07:11 +00:00
|
|
|
/* Copy the whole vector content to user space datap. */
|
|
|
|
|
err |= __copy_to_user(datap, current->thread.vstate.datap, riscv_v_vsize);
|
|
|
|
|
/* Copy magic to the user space after saving all vector conetext */
|
|
|
|
|
err |= __put_user(RISCV_V_MAGIC, &hdr->magic);
|
|
|
|
|
err |= __put_user(riscv_v_sc_size, &hdr->size);
|
|
|
|
|
if (unlikely(err))
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
/* Only progress the sv_vec if everything has done successfully */
|
|
|
|
|
*sc_vec += riscv_v_sc_size;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Restore Vector extension context from the user's signal frame. This function
|
|
|
|
|
* assumes a valid extension header. So magic and size checking must be done by
|
|
|
|
|
* the caller.
|
|
|
|
|
*/
|
|
|
|
|
static long __restore_v_state(struct pt_regs *regs, void __user *sc_vec)
|
|
|
|
|
{
|
|
|
|
|
long err;
|
|
|
|
|
struct __sc_riscv_v_state __user *state = sc_vec;
|
|
|
|
|
void __user *datap;
|
|
|
|
|
|
riscv: Fix vector state restore in rt_sigreturn()
The RISC-V Vector specification states in "Appendix D: Calling
Convention for Vector State" [1] that "Executing a system call causes
all caller-saved vector registers (v0-v31, vl, vtype) and vstart to
become unspecified.". In the RISC-V kernel this is called "discarding
the vstate".
Returning from a signal handler via the rt_sigreturn() syscall, vector
discard is also performed. However, this is not an issue since the
vector state should be restored from the sigcontext, and therefore not
care about the vector discard.
The "live state" is the actual vector register in the running context,
and the "vstate" is the vector state of the task. A dirty live state,
means that the vstate and live state are not in synch.
When vectorized user_from_copy() was introduced, an bug sneaked in at
the restoration code, related to the discard of the live state.
An example when this go wrong:
1. A userland application is executing vector code
2. The application receives a signal, and the signal handler is
entered.
3. The application returns from the signal handler, using the
rt_sigreturn() syscall.
4. The live vector state is discarded upon entering the
rt_sigreturn(), and the live state is marked as "dirty", indicating
that the live state need to be synchronized with the current
vstate.
5. rt_sigreturn() restores the vstate, except the Vector registers,
from the sigcontext
6. rt_sigreturn() restores the Vector registers, from the sigcontext,
and now the vectorized user_from_copy() is used. The dirty live
state from the discard is saved to the vstate, making the vstate
corrupt.
7. rt_sigreturn() returns to the application, which crashes due to
corrupted vstate.
Note that the vectorized user_from_copy() is invoked depending on the
value of CONFIG_RISCV_ISA_V_UCOPY_THRESHOLD. Default is 768, which
means that vlen has to be larger than 128b for this bug to trigger.
The fix is simply to mark the live state as non-dirty/clean prior
performing the vstate restore.
Link: https://github.com/riscv/riscv-isa-manual/releases/download/riscv-isa-release-8abdb41-2024-03-26/unpriv-isa-asciidoc.pdf # [1]
Reported-by: Charlie Jenkins <charlie@rivosinc.com>
Reported-by: Vineet Gupta <vgupta@kernel.org>
Fixes: c2a658d41924 ("riscv: lib: vectorize copy_to_user/copy_from_user")
Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
Reviewed-by: Andy Chiu <andy.chiu@sifive.com>
Tested-by: Vineet Gupta <vineetg@rivosinc.com>
Link: https://lore.kernel.org/r/20240403072638.567446-1-bjorn@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
2024-04-03 07:26:38 +00:00
|
|
|
/*
|
|
|
|
|
* Mark the vstate as clean prior performing the actual copy,
|
|
|
|
|
* to avoid getting the vstate incorrectly clobbered by the
|
|
|
|
|
* discarded vector state.
|
|
|
|
|
*/
|
|
|
|
|
riscv_v_vstate_set_restore(current, regs);
|
|
|
|
|
|
2023-06-05 11:07:11 +00:00
|
|
|
/* Copy everything of __sc_riscv_v_state except datap. */
|
|
|
|
|
err = __copy_from_user(¤t->thread.vstate, &state->v_state,
|
|
|
|
|
offsetof(struct __riscv_v_ext_state, datap));
|
|
|
|
|
if (unlikely(err))
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
/* Copy the pointer datap itself. */
|
|
|
|
|
err = __get_user(datap, &state->v_state.datap);
|
|
|
|
|
if (unlikely(err))
|
|
|
|
|
return err;
|
|
|
|
|
/*
|
|
|
|
|
* Copy the whole vector content from user space datap. Use
|
|
|
|
|
* copy_from_user to prevent information leak.
|
|
|
|
|
*/
|
riscv: Fix vector state restore in rt_sigreturn()
The RISC-V Vector specification states in "Appendix D: Calling
Convention for Vector State" [1] that "Executing a system call causes
all caller-saved vector registers (v0-v31, vl, vtype) and vstart to
become unspecified.". In the RISC-V kernel this is called "discarding
the vstate".
Returning from a signal handler via the rt_sigreturn() syscall, vector
discard is also performed. However, this is not an issue since the
vector state should be restored from the sigcontext, and therefore not
care about the vector discard.
The "live state" is the actual vector register in the running context,
and the "vstate" is the vector state of the task. A dirty live state,
means that the vstate and live state are not in synch.
When vectorized user_from_copy() was introduced, an bug sneaked in at
the restoration code, related to the discard of the live state.
An example when this go wrong:
1. A userland application is executing vector code
2. The application receives a signal, and the signal handler is
entered.
3. The application returns from the signal handler, using the
rt_sigreturn() syscall.
4. The live vector state is discarded upon entering the
rt_sigreturn(), and the live state is marked as "dirty", indicating
that the live state need to be synchronized with the current
vstate.
5. rt_sigreturn() restores the vstate, except the Vector registers,
from the sigcontext
6. rt_sigreturn() restores the Vector registers, from the sigcontext,
and now the vectorized user_from_copy() is used. The dirty live
state from the discard is saved to the vstate, making the vstate
corrupt.
7. rt_sigreturn() returns to the application, which crashes due to
corrupted vstate.
Note that the vectorized user_from_copy() is invoked depending on the
value of CONFIG_RISCV_ISA_V_UCOPY_THRESHOLD. Default is 768, which
means that vlen has to be larger than 128b for this bug to trigger.
The fix is simply to mark the live state as non-dirty/clean prior
performing the vstate restore.
Link: https://github.com/riscv/riscv-isa-manual/releases/download/riscv-isa-release-8abdb41-2024-03-26/unpriv-isa-asciidoc.pdf # [1]
Reported-by: Charlie Jenkins <charlie@rivosinc.com>
Reported-by: Vineet Gupta <vgupta@kernel.org>
Fixes: c2a658d41924 ("riscv: lib: vectorize copy_to_user/copy_from_user")
Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
Reviewed-by: Andy Chiu <andy.chiu@sifive.com>
Tested-by: Vineet Gupta <vineetg@rivosinc.com>
Link: https://lore.kernel.org/r/20240403072638.567446-1-bjorn@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
2024-04-03 07:26:38 +00:00
|
|
|
return copy_from_user(current->thread.vstate.datap, datap, riscv_v_vsize);
|
2023-06-05 11:07:11 +00:00
|
|
|
}
|
|
|
|
|
#else
|
|
|
|
|
#define save_v_state(task, regs) (0)
|
|
|
|
|
#define __restore_v_state(task, regs) (0)
|
|
|
|
|
#endif
|
|
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
static long restore_sigcontext(struct pt_regs *regs,
|
|
|
|
|
struct sigcontext __user *sc)
|
|
|
|
|
{
|
2023-06-05 11:07:11 +00:00
|
|
|
void __user *sc_ext_ptr = &sc->sc_extdesc.hdr;
|
|
|
|
|
__u32 rsvd;
|
2017-07-11 01:07:09 +00:00
|
|
|
long err;
|
|
|
|
|
/* sc_regs is structured the same as the start of pt_regs */
|
|
|
|
|
err = __copy_from_user(regs, &sc->sc_regs, sizeof(sc->sc_regs));
|
2023-06-05 11:07:10 +00:00
|
|
|
if (unlikely(err))
|
|
|
|
|
return err;
|
|
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
/* Restore the floating-point state. */
|
2023-06-05 11:07:10 +00:00
|
|
|
if (has_fpu()) {
|
|
|
|
|
err = restore_fp_state(regs, &sc->sc_fpregs);
|
|
|
|
|
if (unlikely(err))
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2023-06-05 11:07:11 +00:00
|
|
|
/* Check the reserved word before extensions parsing */
|
|
|
|
|
err = __get_user(rsvd, &sc->sc_extdesc.reserved);
|
|
|
|
|
if (unlikely(err))
|
|
|
|
|
return err;
|
|
|
|
|
if (unlikely(rsvd))
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
while (!err) {
|
|
|
|
|
__u32 magic, size;
|
|
|
|
|
struct __riscv_ctx_hdr __user *head = sc_ext_ptr;
|
2023-06-05 11:07:10 +00:00
|
|
|
|
2023-06-05 11:07:11 +00:00
|
|
|
err |= __get_user(magic, &head->magic);
|
|
|
|
|
err |= __get_user(size, &head->size);
|
2023-06-05 11:07:10 +00:00
|
|
|
if (unlikely(err))
|
2023-06-05 11:07:11 +00:00
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
sc_ext_ptr += sizeof(*head);
|
|
|
|
|
switch (magic) {
|
|
|
|
|
case END_MAGIC:
|
|
|
|
|
if (size != END_HDR_SIZE)
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
case RISCV_V_MAGIC:
|
|
|
|
|
if (!has_vector() || !riscv_v_vstate_query(regs) ||
|
|
|
|
|
size != riscv_v_sc_size)
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
err = __restore_v_state(regs, sc_ext_ptr);
|
2023-06-05 11:07:10 +00:00
|
|
|
break;
|
2023-06-05 11:07:11 +00:00
|
|
|
default:
|
2023-06-05 11:07:10 +00:00
|
|
|
return -EINVAL;
|
2023-06-05 11:07:11 +00:00
|
|
|
}
|
|
|
|
|
sc_ext_ptr = (void __user *)head + size;
|
2023-06-05 11:07:10 +00:00
|
|
|
}
|
2017-07-11 01:07:09 +00:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2023-06-05 11:07:12 +00:00
|
|
|
static size_t get_rt_frame_size(bool cal_all)
|
2023-06-05 11:07:11 +00:00
|
|
|
{
|
|
|
|
|
struct rt_sigframe __user *frame;
|
|
|
|
|
size_t frame_size;
|
|
|
|
|
size_t total_context_size = 0;
|
|
|
|
|
|
|
|
|
|
frame_size = sizeof(*frame);
|
|
|
|
|
|
2023-06-05 11:07:12 +00:00
|
|
|
if (has_vector()) {
|
|
|
|
|
if (cal_all || riscv_v_vstate_query(task_pt_regs(current)))
|
|
|
|
|
total_context_size += riscv_v_sc_size;
|
|
|
|
|
}
|
2023-06-05 11:07:11 +00:00
|
|
|
/*
|
|
|
|
|
* Preserved a __riscv_ctx_hdr for END signal context header if an
|
|
|
|
|
* extension uses __riscv_extra_ext_header
|
|
|
|
|
*/
|
|
|
|
|
if (total_context_size)
|
|
|
|
|
total_context_size += sizeof(struct __riscv_ctx_hdr);
|
|
|
|
|
|
|
|
|
|
frame_size += total_context_size;
|
|
|
|
|
|
|
|
|
|
frame_size = round_up(frame_size, 16);
|
|
|
|
|
return frame_size;
|
|
|
|
|
}
|
|
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
SYSCALL_DEFINE0(rt_sigreturn)
|
|
|
|
|
{
|
|
|
|
|
struct pt_regs *regs = current_pt_regs();
|
|
|
|
|
struct rt_sigframe __user *frame;
|
|
|
|
|
struct task_struct *task;
|
|
|
|
|
sigset_t set;
|
2023-06-05 11:07:12 +00:00
|
|
|
size_t frame_size = get_rt_frame_size(false);
|
2017-07-11 01:07:09 +00:00
|
|
|
|
|
|
|
|
/* Always make any pending restarted system calls return -EINTR */
|
|
|
|
|
current->restart_block.fn = do_no_restart_syscall;
|
|
|
|
|
|
|
|
|
|
frame = (struct rt_sigframe __user *)regs->sp;
|
|
|
|
|
|
2023-06-05 11:07:11 +00:00
|
|
|
if (!access_ok(frame, frame_size))
|
2017-07-11 01:07:09 +00:00
|
|
|
goto badframe;
|
|
|
|
|
|
|
|
|
|
if (__copy_from_user(&set, &frame->uc.uc_sigmask, sizeof(set)))
|
|
|
|
|
goto badframe;
|
|
|
|
|
|
|
|
|
|
set_current_blocked(&set);
|
|
|
|
|
|
|
|
|
|
if (restore_sigcontext(regs, &frame->uc.uc_mcontext))
|
|
|
|
|
goto badframe;
|
|
|
|
|
|
|
|
|
|
if (restore_altstack(&frame->uc.uc_stack))
|
|
|
|
|
goto badframe;
|
|
|
|
|
|
2021-09-24 01:55:27 +00:00
|
|
|
regs->cause = -1UL;
|
|
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
return regs->a0;
|
|
|
|
|
|
|
|
|
|
badframe:
|
|
|
|
|
task = current;
|
|
|
|
|
if (show_unhandled_signals) {
|
|
|
|
|
pr_info_ratelimited(
|
|
|
|
|
"%s[%d]: bad frame in %s: frame=%p pc=%p sp=%p\n",
|
|
|
|
|
task->comm, task_pid_nr(task), __func__,
|
2019-10-28 12:10:32 +00:00
|
|
|
frame, (void *)regs->epc, (void *)regs->sp);
|
2017-07-11 01:07:09 +00:00
|
|
|
}
|
2019-05-23 15:17:27 +00:00
|
|
|
force_sig(SIGSEGV);
|
2017-07-11 01:07:09 +00:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static long setup_sigcontext(struct rt_sigframe __user *frame,
|
|
|
|
|
struct pt_regs *regs)
|
|
|
|
|
{
|
|
|
|
|
struct sigcontext __user *sc = &frame->uc.uc_mcontext;
|
2023-06-05 11:07:11 +00:00
|
|
|
struct __riscv_ctx_hdr __user *sc_ext_ptr = &sc->sc_extdesc.hdr;
|
2017-07-11 01:07:09 +00:00
|
|
|
long err;
|
2023-06-05 11:07:10 +00:00
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
/* sc_regs is structured the same as the start of pt_regs */
|
|
|
|
|
err = __copy_to_user(&sc->sc_regs, regs, sizeof(sc->sc_regs));
|
|
|
|
|
/* Save the floating-point state. */
|
2021-05-12 14:55:45 +00:00
|
|
|
if (has_fpu())
|
2018-10-09 02:18:34 +00:00
|
|
|
err |= save_fp_state(regs, &sc->sc_fpregs);
|
2023-06-05 11:07:11 +00:00
|
|
|
/* Save the vector state. */
|
|
|
|
|
if (has_vector() && riscv_v_vstate_query(regs))
|
|
|
|
|
err |= save_v_state(regs, (void __user **)&sc_ext_ptr);
|
|
|
|
|
/* Write zero to fp-reserved space and check it on restore_sigcontext */
|
|
|
|
|
err |= __put_user(0, &sc->sc_extdesc.reserved);
|
|
|
|
|
/* And put END __riscv_ctx_hdr at the end. */
|
|
|
|
|
err |= __put_user(END_MAGIC, &sc_ext_ptr->magic);
|
|
|
|
|
err |= __put_user(END_HDR_SIZE, &sc_ext_ptr->size);
|
2023-06-05 11:07:10 +00:00
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline void __user *get_sigframe(struct ksignal *ksig,
|
|
|
|
|
struct pt_regs *regs, size_t framesize)
|
|
|
|
|
{
|
|
|
|
|
unsigned long sp;
|
|
|
|
|
/* Default to using normal stack */
|
|
|
|
|
sp = regs->sp;
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* If we are on the alternate signal stack and would overflow it, don't.
|
|
|
|
|
* Return an always-bogus address instead so we will die with SIGSEGV.
|
|
|
|
|
*/
|
|
|
|
|
if (on_sig_stack(sp) && !likely(on_sig_stack(sp - framesize)))
|
|
|
|
|
return (void __user __force *)(-1UL);
|
|
|
|
|
|
|
|
|
|
/* This is the X/Open sanctioned signal stack switching. */
|
|
|
|
|
sp = sigsp(sp, ksig) - framesize;
|
|
|
|
|
|
|
|
|
|
/* Align the stack frame. */
|
|
|
|
|
sp &= ~0xfUL;
|
|
|
|
|
|
|
|
|
|
return (void __user *)sp;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
|
|
|
|
|
struct pt_regs *regs)
|
|
|
|
|
{
|
|
|
|
|
struct rt_sigframe __user *frame;
|
|
|
|
|
long err = 0;
|
2023-04-06 10:11:31 +00:00
|
|
|
unsigned long __maybe_unused addr;
|
2023-06-05 11:07:12 +00:00
|
|
|
size_t frame_size = get_rt_frame_size(false);
|
2017-07-11 01:07:09 +00:00
|
|
|
|
2023-06-05 11:07:11 +00:00
|
|
|
frame = get_sigframe(ksig, regs, frame_size);
|
|
|
|
|
if (!access_ok(frame, frame_size))
|
2017-07-11 01:07:09 +00:00
|
|
|
return -EFAULT;
|
|
|
|
|
|
|
|
|
|
err |= copy_siginfo_to_user(&frame->info, &ksig->info);
|
|
|
|
|
|
|
|
|
|
/* Create the ucontext. */
|
|
|
|
|
err |= __put_user(0, &frame->uc.uc_flags);
|
|
|
|
|
err |= __put_user(NULL, &frame->uc.uc_link);
|
|
|
|
|
err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
|
|
|
|
|
err |= setup_sigcontext(frame, regs);
|
|
|
|
|
err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
|
|
|
|
|
if (err)
|
|
|
|
|
return -EFAULT;
|
|
|
|
|
|
|
|
|
|
/* Set up to return from userspace. */
|
2019-10-28 12:10:41 +00:00
|
|
|
#ifdef CONFIG_MMU
|
2017-07-11 01:07:09 +00:00
|
|
|
regs->ra = (unsigned long)VDSO_SYMBOL(
|
|
|
|
|
current->mm->context.vdso, rt_sigreturn);
|
2019-10-28 12:10:41 +00:00
|
|
|
#else
|
|
|
|
|
/*
|
|
|
|
|
* For the nommu case we don't have a VDSO. Instead we push two
|
|
|
|
|
* instructions to call the rt_sigreturn syscall onto the user stack.
|
|
|
|
|
*/
|
|
|
|
|
if (copy_to_user(&frame->sigreturn_code, __user_rt_sigreturn,
|
|
|
|
|
sizeof(frame->sigreturn_code)))
|
|
|
|
|
return -EFAULT;
|
2023-04-06 10:11:31 +00:00
|
|
|
|
|
|
|
|
addr = (unsigned long)&frame->sigreturn_code;
|
|
|
|
|
/* Make sure the two instructions are pushed to icache. */
|
|
|
|
|
flush_icache_range(addr, addr + sizeof(frame->sigreturn_code));
|
|
|
|
|
|
|
|
|
|
regs->ra = addr;
|
2019-10-28 12:10:41 +00:00
|
|
|
#endif /* CONFIG_MMU */
|
2017-07-11 01:07:09 +00:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Set up registers for signal handler.
|
|
|
|
|
* Registers that we don't modify keep the value they had from
|
|
|
|
|
* user-space at the time we took the signal.
|
|
|
|
|
* We always pass siginfo and mcontext, regardless of SA_SIGINFO,
|
|
|
|
|
* since some things rely on this (e.g. glibc's debug/segfault.c).
|
|
|
|
|
*/
|
2019-10-28 12:10:32 +00:00
|
|
|
regs->epc = (unsigned long)ksig->ka.sa.sa_handler;
|
2017-07-11 01:07:09 +00:00
|
|
|
regs->sp = (unsigned long)frame;
|
|
|
|
|
regs->a0 = ksig->sig; /* a0: signal number */
|
|
|
|
|
regs->a1 = (unsigned long)(&frame->info); /* a1: siginfo pointer */
|
|
|
|
|
regs->a2 = (unsigned long)(&frame->uc); /* a2: ucontext pointer */
|
|
|
|
|
|
|
|
|
|
#if DEBUG_SIG
|
|
|
|
|
pr_info("SIG deliver (%s:%d): sig=%d pc=%p ra=%p sp=%p\n",
|
|
|
|
|
current->comm, task_pid_nr(current), ksig->sig,
|
2019-10-28 12:10:32 +00:00
|
|
|
(void *)regs->epc, (void *)regs->ra, frame);
|
2017-07-11 01:07:09 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
|
|
|
|
|
{
|
|
|
|
|
sigset_t *oldset = sigmask_to_save();
|
|
|
|
|
int ret;
|
|
|
|
|
|
2022-03-08 08:32:52 +00:00
|
|
|
rseq_signal_deliver(ksig, regs);
|
|
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
/* Set up the stack frame */
|
2022-04-05 07:13:12 +00:00
|
|
|
if (is_compat_task())
|
|
|
|
|
ret = compat_setup_rt_frame(ksig, oldset, regs);
|
|
|
|
|
else
|
|
|
|
|
ret = setup_rt_frame(ksig, oldset, regs);
|
2017-07-11 01:07:09 +00:00
|
|
|
|
|
|
|
|
signal_setup_done(ret, ksig, 0);
|
|
|
|
|
}
|
|
|
|
|
|
2023-02-22 03:30:18 +00:00
|
|
|
void arch_do_signal_or_restart(struct pt_regs *regs)
|
2017-07-11 01:07:09 +00:00
|
|
|
{
|
riscv: signal: handle syscall restart before get_signal
In the current riscv implementation, blocking syscalls like read() may
not correctly restart after being interrupted by ptrace. This problem
arises when the syscall restart process in arch_do_signal_or_restart()
is bypassed due to changes to the regs->cause register, such as an
ebreak instruction.
Steps to reproduce:
1. Interrupt the tracee process with PTRACE_SEIZE & PTRACE_INTERRUPT.
2. Backup original registers and instruction at new_pc.
3. Change pc to new_pc, and inject an instruction (like ebreak) to this
address.
4. Resume with PTRACE_CONT and wait for the process to stop again after
executing ebreak.
5. Restore original registers and instructions, and detach from the
tracee process.
6. Now the read() syscall in tracee will return -1 with errno set to
ERESTARTSYS.
Specifically, during an interrupt, the regs->cause changes from
EXC_SYSCALL to EXC_BREAKPOINT due to the injected ebreak, which is
inaccessible via ptrace so we cannot restore it. This alteration breaks
the syscall restart condition and ends the read() syscall with an
ERESTARTSYS error. According to include/linux/errno.h, it should never
be seen by user programs. X86 can avoid this issue as it checks the
syscall condition using a register (orig_ax) exposed to user space.
Arm64 handles syscall restart before calling get_signal, where it could
be paused and inspected by ptrace/debugger.
This patch adjusts the riscv implementation to arm64 style, which also
checks syscall using a kernel register (syscallno). It ensures the
syscall restart process is not bypassed when changes to the cause
register occur, providing more consistent behavior across various
architectures.
For a simplified reproduction program, feel free to visit:
https://github.com/ancientmodern/riscv-ptrace-bug-demo.
Signed-off-by: Haorong Lu <ancientmodern4@gmail.com>
Link: https://lore.kernel.org/r/20230803224458.4156006-1-ancientmodern4@gmail.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
2023-08-03 22:44:54 +00:00
|
|
|
unsigned long continue_addr = 0, restart_addr = 0;
|
|
|
|
|
int retval = 0;
|
2017-07-11 01:07:09 +00:00
|
|
|
struct ksignal ksig;
|
riscv: signal: handle syscall restart before get_signal
In the current riscv implementation, blocking syscalls like read() may
not correctly restart after being interrupted by ptrace. This problem
arises when the syscall restart process in arch_do_signal_or_restart()
is bypassed due to changes to the regs->cause register, such as an
ebreak instruction.
Steps to reproduce:
1. Interrupt the tracee process with PTRACE_SEIZE & PTRACE_INTERRUPT.
2. Backup original registers and instruction at new_pc.
3. Change pc to new_pc, and inject an instruction (like ebreak) to this
address.
4. Resume with PTRACE_CONT and wait for the process to stop again after
executing ebreak.
5. Restore original registers and instructions, and detach from the
tracee process.
6. Now the read() syscall in tracee will return -1 with errno set to
ERESTARTSYS.
Specifically, during an interrupt, the regs->cause changes from
EXC_SYSCALL to EXC_BREAKPOINT due to the injected ebreak, which is
inaccessible via ptrace so we cannot restore it. This alteration breaks
the syscall restart condition and ends the read() syscall with an
ERESTARTSYS error. According to include/linux/errno.h, it should never
be seen by user programs. X86 can avoid this issue as it checks the
syscall condition using a register (orig_ax) exposed to user space.
Arm64 handles syscall restart before calling get_signal, where it could
be paused and inspected by ptrace/debugger.
This patch adjusts the riscv implementation to arm64 style, which also
checks syscall using a kernel register (syscallno). It ensures the
syscall restart process is not bypassed when changes to the cause
register occur, providing more consistent behavior across various
architectures.
For a simplified reproduction program, feel free to visit:
https://github.com/ancientmodern/riscv-ptrace-bug-demo.
Signed-off-by: Haorong Lu <ancientmodern4@gmail.com>
Link: https://lore.kernel.org/r/20230803224458.4156006-1-ancientmodern4@gmail.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
2023-08-03 22:44:54 +00:00
|
|
|
bool syscall = (regs->cause == EXC_SYSCALL);
|
2017-07-11 01:07:09 +00:00
|
|
|
|
riscv: signal: handle syscall restart before get_signal
In the current riscv implementation, blocking syscalls like read() may
not correctly restart after being interrupted by ptrace. This problem
arises when the syscall restart process in arch_do_signal_or_restart()
is bypassed due to changes to the regs->cause register, such as an
ebreak instruction.
Steps to reproduce:
1. Interrupt the tracee process with PTRACE_SEIZE & PTRACE_INTERRUPT.
2. Backup original registers and instruction at new_pc.
3. Change pc to new_pc, and inject an instruction (like ebreak) to this
address.
4. Resume with PTRACE_CONT and wait for the process to stop again after
executing ebreak.
5. Restore original registers and instructions, and detach from the
tracee process.
6. Now the read() syscall in tracee will return -1 with errno set to
ERESTARTSYS.
Specifically, during an interrupt, the regs->cause changes from
EXC_SYSCALL to EXC_BREAKPOINT due to the injected ebreak, which is
inaccessible via ptrace so we cannot restore it. This alteration breaks
the syscall restart condition and ends the read() syscall with an
ERESTARTSYS error. According to include/linux/errno.h, it should never
be seen by user programs. X86 can avoid this issue as it checks the
syscall condition using a register (orig_ax) exposed to user space.
Arm64 handles syscall restart before calling get_signal, where it could
be paused and inspected by ptrace/debugger.
This patch adjusts the riscv implementation to arm64 style, which also
checks syscall using a kernel register (syscallno). It ensures the
syscall restart process is not bypassed when changes to the cause
register occur, providing more consistent behavior across various
architectures.
For a simplified reproduction program, feel free to visit:
https://github.com/ancientmodern/riscv-ptrace-bug-demo.
Signed-off-by: Haorong Lu <ancientmodern4@gmail.com>
Link: https://lore.kernel.org/r/20230803224458.4156006-1-ancientmodern4@gmail.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
2023-08-03 22:44:54 +00:00
|
|
|
/* If we were from a system call, check for system call restarting */
|
|
|
|
|
if (syscall) {
|
|
|
|
|
continue_addr = regs->epc;
|
|
|
|
|
restart_addr = continue_addr - 4;
|
|
|
|
|
retval = regs->a0;
|
2017-07-11 01:07:09 +00:00
|
|
|
|
2019-04-02 08:02:33 +00:00
|
|
|
/* Avoid additional syscall restarting via ret_from_exception */
|
2019-10-28 12:10:32 +00:00
|
|
|
regs->cause = -1UL;
|
2019-04-02 08:02:33 +00:00
|
|
|
|
riscv: signal: handle syscall restart before get_signal
In the current riscv implementation, blocking syscalls like read() may
not correctly restart after being interrupted by ptrace. This problem
arises when the syscall restart process in arch_do_signal_or_restart()
is bypassed due to changes to the regs->cause register, such as an
ebreak instruction.
Steps to reproduce:
1. Interrupt the tracee process with PTRACE_SEIZE & PTRACE_INTERRUPT.
2. Backup original registers and instruction at new_pc.
3. Change pc to new_pc, and inject an instruction (like ebreak) to this
address.
4. Resume with PTRACE_CONT and wait for the process to stop again after
executing ebreak.
5. Restore original registers and instructions, and detach from the
tracee process.
6. Now the read() syscall in tracee will return -1 with errno set to
ERESTARTSYS.
Specifically, during an interrupt, the regs->cause changes from
EXC_SYSCALL to EXC_BREAKPOINT due to the injected ebreak, which is
inaccessible via ptrace so we cannot restore it. This alteration breaks
the syscall restart condition and ends the read() syscall with an
ERESTARTSYS error. According to include/linux/errno.h, it should never
be seen by user programs. X86 can avoid this issue as it checks the
syscall condition using a register (orig_ax) exposed to user space.
Arm64 handles syscall restart before calling get_signal, where it could
be paused and inspected by ptrace/debugger.
This patch adjusts the riscv implementation to arm64 style, which also
checks syscall using a kernel register (syscallno). It ensures the
syscall restart process is not bypassed when changes to the cause
register occur, providing more consistent behavior across various
architectures.
For a simplified reproduction program, feel free to visit:
https://github.com/ancientmodern/riscv-ptrace-bug-demo.
Signed-off-by: Haorong Lu <ancientmodern4@gmail.com>
Link: https://lore.kernel.org/r/20230803224458.4156006-1-ancientmodern4@gmail.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
2023-08-03 22:44:54 +00:00
|
|
|
/*
|
|
|
|
|
* Prepare for system call restart. We do this here so that a
|
|
|
|
|
* debugger will see the already changed PC.
|
|
|
|
|
*/
|
|
|
|
|
switch (retval) {
|
2017-07-11 01:07:09 +00:00
|
|
|
case -ERESTARTNOHAND:
|
|
|
|
|
case -ERESTARTSYS:
|
|
|
|
|
case -ERESTARTNOINTR:
|
|
|
|
|
case -ERESTART_RESTARTBLOCK:
|
riscv: signal: handle syscall restart before get_signal
In the current riscv implementation, blocking syscalls like read() may
not correctly restart after being interrupted by ptrace. This problem
arises when the syscall restart process in arch_do_signal_or_restart()
is bypassed due to changes to the regs->cause register, such as an
ebreak instruction.
Steps to reproduce:
1. Interrupt the tracee process with PTRACE_SEIZE & PTRACE_INTERRUPT.
2. Backup original registers and instruction at new_pc.
3. Change pc to new_pc, and inject an instruction (like ebreak) to this
address.
4. Resume with PTRACE_CONT and wait for the process to stop again after
executing ebreak.
5. Restore original registers and instructions, and detach from the
tracee process.
6. Now the read() syscall in tracee will return -1 with errno set to
ERESTARTSYS.
Specifically, during an interrupt, the regs->cause changes from
EXC_SYSCALL to EXC_BREAKPOINT due to the injected ebreak, which is
inaccessible via ptrace so we cannot restore it. This alteration breaks
the syscall restart condition and ends the read() syscall with an
ERESTARTSYS error. According to include/linux/errno.h, it should never
be seen by user programs. X86 can avoid this issue as it checks the
syscall condition using a register (orig_ax) exposed to user space.
Arm64 handles syscall restart before calling get_signal, where it could
be paused and inspected by ptrace/debugger.
This patch adjusts the riscv implementation to arm64 style, which also
checks syscall using a kernel register (syscallno). It ensures the
syscall restart process is not bypassed when changes to the cause
register occur, providing more consistent behavior across various
architectures.
For a simplified reproduction program, feel free to visit:
https://github.com/ancientmodern/riscv-ptrace-bug-demo.
Signed-off-by: Haorong Lu <ancientmodern4@gmail.com>
Link: https://lore.kernel.org/r/20230803224458.4156006-1-ancientmodern4@gmail.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
2023-08-03 22:44:54 +00:00
|
|
|
regs->a0 = regs->orig_a0;
|
|
|
|
|
regs->epc = restart_addr;
|
2017-07-11 01:07:09 +00:00
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
riscv: signal: handle syscall restart before get_signal
In the current riscv implementation, blocking syscalls like read() may
not correctly restart after being interrupted by ptrace. This problem
arises when the syscall restart process in arch_do_signal_or_restart()
is bypassed due to changes to the regs->cause register, such as an
ebreak instruction.
Steps to reproduce:
1. Interrupt the tracee process with PTRACE_SEIZE & PTRACE_INTERRUPT.
2. Backup original registers and instruction at new_pc.
3. Change pc to new_pc, and inject an instruction (like ebreak) to this
address.
4. Resume with PTRACE_CONT and wait for the process to stop again after
executing ebreak.
5. Restore original registers and instructions, and detach from the
tracee process.
6. Now the read() syscall in tracee will return -1 with errno set to
ERESTARTSYS.
Specifically, during an interrupt, the regs->cause changes from
EXC_SYSCALL to EXC_BREAKPOINT due to the injected ebreak, which is
inaccessible via ptrace so we cannot restore it. This alteration breaks
the syscall restart condition and ends the read() syscall with an
ERESTARTSYS error. According to include/linux/errno.h, it should never
be seen by user programs. X86 can avoid this issue as it checks the
syscall condition using a register (orig_ax) exposed to user space.
Arm64 handles syscall restart before calling get_signal, where it could
be paused and inspected by ptrace/debugger.
This patch adjusts the riscv implementation to arm64 style, which also
checks syscall using a kernel register (syscallno). It ensures the
syscall restart process is not bypassed when changes to the cause
register occur, providing more consistent behavior across various
architectures.
For a simplified reproduction program, feel free to visit:
https://github.com/ancientmodern/riscv-ptrace-bug-demo.
Signed-off-by: Haorong Lu <ancientmodern4@gmail.com>
Link: https://lore.kernel.org/r/20230803224458.4156006-1-ancientmodern4@gmail.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
2023-08-03 22:44:54 +00:00
|
|
|
/*
|
|
|
|
|
* Get the signal to deliver. When running under ptrace, at this point
|
|
|
|
|
* the debugger may change all of our registers.
|
|
|
|
|
*/
|
|
|
|
|
if (get_signal(&ksig)) {
|
|
|
|
|
/*
|
|
|
|
|
* Depending on the signal settings, we may need to revert the
|
|
|
|
|
* decision to restart the system call, but skip this if a
|
|
|
|
|
* debugger has chosen to restart at a different PC.
|
|
|
|
|
*/
|
|
|
|
|
if (regs->epc == restart_addr &&
|
|
|
|
|
(retval == -ERESTARTNOHAND ||
|
|
|
|
|
retval == -ERESTART_RESTARTBLOCK ||
|
|
|
|
|
(retval == -ERESTARTSYS &&
|
|
|
|
|
!(ksig.ka.sa.sa_flags & SA_RESTART)))) {
|
|
|
|
|
regs->a0 = -EINTR;
|
|
|
|
|
regs->epc = continue_addr;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Actually deliver the signal */
|
|
|
|
|
handle_signal(&ksig, regs);
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Handle restarting a different system call. As above, if a debugger
|
|
|
|
|
* has chosen to restart at a different PC, ignore the restart.
|
|
|
|
|
*/
|
|
|
|
|
if (syscall && regs->epc == restart_addr && retval == -ERESTART_RESTARTBLOCK)
|
|
|
|
|
regs->a7 = __NR_restart_syscall;
|
|
|
|
|
|
2017-07-11 01:07:09 +00:00
|
|
|
/*
|
|
|
|
|
* If there is no signal to deliver, we just put the saved
|
|
|
|
|
* sigmask back.
|
|
|
|
|
*/
|
|
|
|
|
restore_saved_sigmask();
|
|
|
|
|
}
|
2023-06-05 11:07:11 +00:00
|
|
|
|
|
|
|
|
void init_rt_signal_env(void);
|
|
|
|
|
void __init init_rt_signal_env(void)
|
|
|
|
|
{
|
|
|
|
|
riscv_v_sc_size = sizeof(struct __riscv_ctx_hdr) +
|
|
|
|
|
sizeof(struct __sc_riscv_v_state) + riscv_v_vsize;
|
2023-06-05 11:07:12 +00:00
|
|
|
/*
|
|
|
|
|
* Determine the stack space required for guaranteed signal delivery.
|
|
|
|
|
* The signal_minsigstksz will be populated into the AT_MINSIGSTKSZ entry
|
|
|
|
|
* in the auxiliary array at process startup.
|
|
|
|
|
*/
|
|
|
|
|
signal_minsigstksz = get_rt_frame_size(true);
|
2023-06-05 11:07:11 +00:00
|
|
|
}
|
2023-06-05 11:07:13 +00:00
|
|
|
|
|
|
|
|
#ifdef CONFIG_DYNAMIC_SIGFRAME
|
|
|
|
|
bool sigaltstack_size_valid(size_t ss_size)
|
|
|
|
|
{
|
|
|
|
|
return ss_size > get_rt_frame_size(false);
|
|
|
|
|
}
|
|
|
|
|
#endif /* CONFIG_DYNAMIC_SIGFRAME */
|
