linux-kernel - Re: [PATCH 16/17] RISC-V: User-facing API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 12 Jul 2017 12:07:51 +0100
From:   James Hogan <james.hogan@...tec.com>
To:     Palmer Dabbelt <palmer@...belt.com>
CC:     Olof Johansson <olof@...om.net>, Arnd Bergmann <arnd@...db.de>,
        <akpm@...ux-foundation.org>, <albert@...ive.com>,
        <yamada.masahiro@...ionext.com>, <mmarek@...e.com>,
        <will.deacon@....com>, <peterz@...radead.org>,
        <boqun.feng@...il.com>, <mingo@...hat.com>,
        <daniel.lezcano@...aro.org>, <tglx@...utronix.de>,
        <jason@...edaemon.net>, <marc.zyngier@....com>,
        <gregkh@...uxfoundation.org>, <jslaby@...e.com>,
        <davem@...emloft.net>, <mchehab@...nel.org>,
        <sfr@...b.auug.org.au>, <fweisbec@...il.com>,
        <viro@...iv.linux.org.uk>, <mcgrof@...nel.org>,
        <dledford@...hat.com>, <bart.vanassche@...disk.com>,
        <sstabellini@...nel.org>, <daniel.vetter@...ll.ch>,
        <mpe@...erman.id.au>, <msalter@...hat.com>,
        <nicolas.dichtel@...nd.com>, <paul.gortmaker@...driver.com>,
        <linux@...ck-us.net>, <heiko.carstens@...ibm.com>,
        <schwidefsky@...ibm.com>, <linux-kernel@...r.kernel.org>,
        <patches@...ups.riscv.org>
Subject: Re: [PATCH 16/17] RISC-V: User-facing API

On Tue, Jul 11, 2017 at 06:31:29PM -0700, Palmer Dabbelt wrote:
> diff --git a/arch/riscv/include/asm/unistd.h b/arch/riscv/include/asm/unistd.h
> new file mode 100644
> index 000000000000..9f250ed007cd
> --- /dev/null
> +++ b/arch/riscv/include/asm/unistd.h
> @@ -0,0 +1,16 @@
> +/*
> + * Copyright (C) 2012 Regents of the University of California
> + *
> + *   This program is free software; you can redistribute it and/or
> + *   modify it under the terms of the GNU General Public License
> + *   as published by the Free Software Foundation, version 2.
> + *
> + *   This program is distributed in the hope that it will be useful,
> + *   but WITHOUT ANY WARRANTY; without even the implied warranty of
> + *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + *   GNU General Public License for more details.
> + */
> +
> +#define __ARCH_HAVE_MMU
> +#define __ARCH_WANT_SYS_CLONE
> +#include <uapi/asm/unistd.h>

It might be worth keeping arch/risc/include/uapi/asm/unistd.h around,
even if it only includes asm-generic/unistd.h, as it'll only get added
again the next time a syscall is deprecated from the default list in
order to add the appropriate __ARCH_WANT_RENAMEAT-like define, but yeh
no big deal.

> diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c
> new file mode 100644
> index 000000000000..ba3e80712797
> --- /dev/null
> +++ b/arch/riscv/kernel/ptrace.c
> @@ -0,0 +1,125 @@

> +static int riscv_gpr_get(struct task_struct *target,
> +			 const struct user_regset *regset,
> +			 unsigned int pos, unsigned int count,
> +			 void *kbuf, void __user *ubuf)
> +{
> +	struct pt_regs *regs;
> +
> +	regs = task_pt_regs(target);
> +	return user_regset_copyout(&pos, &count, &kbuf, &ubuf, regs, 0, -1);
> +}
> +
> +static int riscv_gpr_set(struct task_struct *target,
> +			 const struct user_regset *regset,
> +			 unsigned int pos, unsigned int count,
> +			 const void *kbuf, const void __user *ubuf)
> +{
> +	int ret;
> +	struct pt_regs *regs;
> +
> +	regs = task_pt_regs(target);
> +	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &regs, 0, -1);
> +	return ret;
> +}

This is looking much safer now (the caller at least seems to always
check pos + count is in range).

> diff --git a/arch/riscv/kernel/signal.c b/arch/riscv/kernel/signal.c
> new file mode 100644
> index 000000000000..e0a1b89583ef
> --- /dev/null
> +++ b/arch/riscv/kernel/signal.c
> @@ -0,0 +1,289 @@

> +static long setup_sigcontext(struct rt_sigframe __user *frame,
> +	struct pt_regs *regs)
> +{
> +	struct sigcontext __user *sc = &frame->uc.uc_mcontext;
> +	long err;
> +	size_t i;
> +	/* sc_regs is structured the same as the start of pt_regs */
> +	err = __copy_to_user(&sc->sc_regs, regs, sizeof(sc->sc_regs));
> +	/* Save the floating-point state. */
> +	err |= save_d_state(regs, &sc->sc_fpregs.d);
> +	/* We support no other extension state at this time. */
> +	for (i = 0; i < ARRAY_SIZE(sc->sc_fpregs.q.reserved); i++)
> +		err |= __put_user(0, &sc->sc_fpregs.q.reserved[i]);

How should userland determine how to interpret sc_fpregs? It looks like
you couldn't add f or q state without using one of these reserved
fields, so why not just specify a field up front to say which fp format
(if any) to interpret?

That would allow userland wanting to interpret it to safely check that
field in a forward and backward compatible way without assuming a
specific format is in use.

Cheers
James

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)