linux-kernel - Re: [PATCH v2 1/3] powerpc: Don't force ENOSYS as error on syscall fail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 12 Feb 2015 16:24:39 +1100
From:	Michael Ellerman <mpe@...erman.id.au>
To:	Bogdan Purcareata <bogdan.purcareata@...escale.com>
Cc:	benh@...nel.crashing.org, paulus@...ba.org,
	linuxppc-dev@...ts.ozlabs.org, pmoore@...hat.com,
	linux-kernel@...r.kernel.org, strosake@...ux.vnet.ibm.com
Subject: Re: [PATCH v2 1/3] powerpc: Don't force ENOSYS as error on syscall
 fail

On Wed, 2015-02-11 at 08:36 +0000, Bogdan Purcareata wrote:
> In certain scenarios - e.g. seccomp filtering with ERRNO as default action -
> the system call fails for other reasons than the syscall not being available.
> The seccomp filter can be configured to store a user-defined error code on
> return from a blacklisted syscall. Don't always set ENOSYS on
> do_syscall_trace_enter failure.
> 
> v2:
> - move setting ENOSYS as errno from the syscall entry assembly to
>   do_syscall_trace_enter, only in the specific case

> diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
> index 194e46d..0111e04 100644
> --- a/arch/powerpc/kernel/entry_64.S
> +++ b/arch/powerpc/kernel/entry_64.S
> @@ -269,7 +269,6 @@ syscall_dotrace:
>  	b	.Lsyscall_dotrace_cont
>  
>  syscall_enosys:
> -	li	r3,-ENOSYS
>  	b	syscall_exit


This still looks wrong to me.

On 64 bit we do:

	CURRENT_THREAD_INFO(r11, r1)
	ld	r10,TI_FLAGS(r11)
	andi.	r11,r10,_TIF_SYSCALL_DOTRACE
	bne	syscall_dotrace
.Lsyscall_dotrace_cont:
	cmpldi	0,r0,NR_syscalls
	bge-	syscall_enosys
...

syscall_enosys:
	li	r3,-ENOSYS
	b	.Lsyscall_exit


Your patch removes the load of ENOSYS.

Which means if we're not doing syscall tracing, and we get an out-of-bounds
syscall number, we'll return with something random on r3. Won't we?

The 32-bit code looks more or less similar, although the label has a different
name.

cheers



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/