arm64: syscallno is secretly an int, make it official

The upper 32 bits of the syscallno field in thread_struct are
handled inconsistently, being sometimes zero extended and sometimes
sign-extended.  In fact, only the lower 32 bits seem to have any
real significance for the behaviour of the code: it's been OK to
handle the upper bits inconsistently because they don't matter.

Currently, the only place I can find where those bits are
significant is in calling trace_sys_enter(), which may be
unintentional: for example, if a compat tracer attempts to cancel a
syscall by passing -1 to (COMPAT_)PTRACE_SET_SYSCALL at the
syscall-enter-stop, it will be traced as syscall 4294967295
rather than -1 as might be expected (and as occurs for a native
tracer doing the same thing).  Elsewhere, reads of syscallno cast
it to an int or truncate it.

There's also a conspicuous amount of code and casting to bodge
around the fact that although semantically an int, syscallno is
stored as a u64.

Let's not pretend any more.

In order to preserve the stp x instruction that stores the syscall
number in entry.S, this patch special-cases the layout of struct
pt_regs for big endian so that the newly 32-bit syscallno field
maps onto the low bits of the stored value.  This is not beautiful,
but benchmarking of the getpid syscall on Juno suggests indicates a
minor slowdown if the stp is split into an stp x and stp w.

Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit 35d0e6fb4d219d64ab3b7cffef7a11a0662140f5)

CVE-2017-5753
CVE-2017-5715
CVE-2017-5754

Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
Acked-by: Brad Figg <brad.figg@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 6687dd29f7e02d428e538dce649bc0309260f90f..c21f90739d6b5274aadf32e27576aa227132fec9 100644 (file)
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -112,7 +112,7 @@ void tls_preserve_current_state(void);
 static inline void start_thread_common(struct pt_regs *regs, unsigned long pc)
 {
        memset(regs, 0, sizeof(*regs));
-       regs->syscallno = ~0UL;
+       regs->syscallno = ~0;
        regs->pc = pc;
 }
 

diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h
index ee72aa9790789b7db6afc14bc31a6226aa046535..9c84fd2f5a198743b4282724539f11821500f77a 100644 (file)
--- a/arch/arm64/include/asm/ptrace.h
+++ b/arch/arm64/include/asm/ptrace.h
@@ -116,7 +116,14 @@ struct pt_regs {
                };
        };
        u64 orig_x0;
-       u64 syscallno;
+#ifdef __AARCH64EB__
+       u32 unused2;
+       s32 syscallno;
+#else
+       s32 syscallno;
+       u32 unused2;
+#endif
+
        u64 orig_addr_limit;
        u64 unused;     // maintain 16 byte alignment
        u64 stackframe[2];

diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 3ef6e2297fb4048c22ea99df37d42d9599b2b009..5ae7879f6c3967c352045df7b082264ce080789e 100644 (file)
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -201,8 +201,8 @@ alternative_else_nop_endif
         * Set syscallno to -1 by default (overridden later if real syscall).
         */
        .if     \el == 0
-       mvn     x21, xzr
-       str     x21, [sp, #S_SYSCALLNO]
+       mvn     w21, wzr
+       str     w21, [sp, #S_SYSCALLNO]
        .endif
 
        /*
@@ -341,8 +341,9 @@ alternative_else_nop_endif
  *
  * x7 is reserved for the system call number in 32-bit mode.
  */
-sc_nr  .req    x25             // number of system calls
-scno   .req    x26             // syscall number
+wsc_nr .req    w25             // number of system calls
+wscno  .req    w26             // syscall number
+xscno  .req    x26             // syscall number (zero-extended)
 stbl   .req    x27             // syscall table pointer
 tsk    .req    x28             // current thread_info
 
@@ -660,8 +661,8 @@ el0_svc_compat:
         * AArch32 syscall handling
         */
        adrp    stbl, compat_sys_call_table     // load compat syscall table pointer
-       uxtw    scno, w7                        // syscall number in w7 (r7)
-       mov     sc_nr, #__NR_compat_syscalls
+       mov     wscno, w7                       // syscall number in w7 (r7)
+       mov     wsc_nr, #__NR_compat_syscalls
        b       el0_svc_naked
 
        .align  6
@@ -837,19 +838,19 @@ ENDPROC(ret_to_user)
        .align  6
 el0_svc:
        adrp    stbl, sys_call_table            // load syscall table pointer
-       uxtw    scno, w8                        // syscall number in w8
-       mov     sc_nr, #__NR_syscalls
+       mov     wscno, w8                       // syscall number in w8
+       mov     wsc_nr, #__NR_syscalls
 el0_svc_naked:                                 // compat entry point
-       stp     x0, scno, [sp, #S_ORIG_X0]      // save the original x0 and syscall number
+       stp     x0, xscno, [sp, #S_ORIG_X0]     // save the original x0 and syscall number
        enable_dbg_and_irq
        ct_user_exit 1
 
        ldr     x16, [tsk, #TSK_TI_FLAGS]       // check for syscall hooks
        tst     x16, #_TIF_SYSCALL_WORK
        b.ne    __sys_trace
-       cmp     scno, sc_nr                     // check upper syscall limit
+       cmp     wscno, wsc_nr                   // check upper syscall limit
        b.hs    ni_sys
-       ldr     x16, [stbl, scno, lsl #3]       // address in the syscall table
+       ldr     x16, [stbl, xscno, lsl #3]      // address in the syscall table
        blr     x16                             // call sys_* routine
        b       ret_fast_syscall
 ni_sys:
@@ -863,24 +864,23 @@ ENDPROC(el0_svc)
         * switches, and waiting for our parent to respond.
         */
 __sys_trace:
-       mov     w0, #-1                         // set default errno for
-       cmp     scno, x0                        // user-issued syscall(-1)
+       cmp     wscno, #-1                      // user-issued syscall(-1)?
        b.ne    1f
-       mov     x0, #-ENOSYS
+       mov     x0, #-ENOSYS                    // set default errno if so
        str     x0, [sp, #S_X0]
 1:     mov     x0, sp
        bl      syscall_trace_enter
        cmp     w0, #-1                         // skip the syscall?
        b.eq    __sys_trace_return_skipped
-       uxtw    scno, w0                        // syscall number (possibly new)
+       mov     wscno, w0                       // syscall number (possibly new)
        mov     x1, sp                          // pointer to regs
-       cmp     scno, sc_nr                     // check upper syscall limit
+       cmp     wscno, wsc_nr                   // check upper syscall limit
        b.hs    __ni_sys_trace
        ldp     x0, x1, [sp]                    // restore the syscall args
        ldp     x2, x3, [sp, #S_X2]
        ldp     x4, x5, [sp, #S_X4]
        ldp     x6, x7, [sp, #S_X6]
-       ldr     x16, [stbl, scno, lsl #3]       // address in the syscall table
+       ldr     x16, [stbl, xscno, lsl #3]      // address in the syscall table
        blr     x16                             // call sys_* routine
 
 __sys_trace_return:

diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index a9f87157c3716cccb5622be35113459ae2774c44..cb77d9438d1ec336d2e55f4a67b4c8f4ce1c8c7a 100644 (file)
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -1364,7 +1364,7 @@ static void tracehook_report_syscall(struct pt_regs *regs,
        if (dir == PTRACE_SYSCALL_EXIT)
                tracehook_report_syscall_exit(regs, 0);
        else if (tracehook_report_syscall_entry(regs))
-               regs->syscallno = ~0UL;
+               regs->syscallno = ~0;
 
        regs->regs[regno] = saved_reg;
 }

diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
index 8e2705983e1d7b4de5fe4258eddfe6a2eb6357a5..ac92f8dc07f4f5ebac0ad36b074dcbeafd7bfed3 100644 (file)
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -388,7 +388,7 @@ static int restore_sigframe(struct pt_regs *regs,
        /*
         * Avoid sys_rt_sigreturn() restarting.
         */
-       regs->syscallno = ~0UL;
+       regs->syscallno = ~0;
 
        err |= !valid_user_regs(&regs->user_regs, current);
        if (err == 0)
@@ -674,7 +674,7 @@ static void do_signal(struct pt_regs *regs)
 {
        unsigned long continue_addr = 0, restart_addr = 0;
        int retval = 0;
-       int syscall = (int)regs->syscallno;
+       int syscall = regs->syscallno;
        struct ksignal ksig;
 
        /*
@@ -688,7 +688,7 @@ static void do_signal(struct pt_regs *regs)
                /*
                 * Avoid additional syscall restarting via ret_to_user.
                 */
-               regs->syscallno = ~0UL;
+               regs->syscallno = ~0;
 
                /*
                 * Prepare for system call restart. We do this here so that a

diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
index c747a0fc5d7d174d59d0470127f35f6354fa5aaf..d98ca76cbd391ebfe0ae290cad96176f00db508c 100644 (file)
--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -354,7 +354,7 @@ static int compat_restore_sigframe(struct pt_regs *regs,
        /*
         * Avoid compat_sys_sigreturn() restarting.
         */
-       regs->syscallno = ~0UL;
+       regs->syscallno = ~0;
 
        err |= !valid_user_regs(&regs->user_regs, current);
 

diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 62acc870c6bdbec1ab8a9fdc094e72e4c3151987..1a27eb0e4cbf65f0fb42254d1b0a62f0fd565fc5 100644 (file)
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -577,7 +577,7 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs)
 
        if (show_unhandled_signals_ratelimited()) {
                pr_info("%s[%d]: syscall %d\n", current->comm,
-                       task_pid_nr(current), (int)regs->syscallno);
+                       task_pid_nr(current), regs->syscallno);
                dump_instr("", regs);
                if (user_mode(regs))
                        __show_regs(regs);