linux-kernel - Re: [PATCH] MIPS: scall64-o32: Fix indirect syscall number load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 14 Apr 2019 22:31:16 +0200
From:   Philippe Mathieu-Daudé <f4bug@...at.org>
To:     Aurelien Jarno <aurelien@...el32.net>,
        Ralf Baechle <ralf@...ux-mips.org>,
        Paul Burton <paul.burton@...s.com>,
        James Hogan <jhogan@...nel.org>
Cc:     linux-mips@...r.kernel.org, linux-kernel@...r.kernel.org,
        stable@...r.kernel.org
Subject: Re: [PATCH] MIPS: scall64-o32: Fix indirect syscall number load

On 4/9/19 4:53 PM, Aurelien Jarno wrote:
> Commit 4c21b8fd8f14 (MIPS: seccomp: Handle indirect system calls (o32))
> added indirect syscall detection for O32 processes running on MIPS64,
> but it did not work correctly for big endian kernel/processes. The
> reason is that the syscall number is loaded from ARG1 using the lw
> instruction while this is a 64-bit value, so zero is loaded instead of
> the syscall number.
> 
> Fix the code by using the ld instruction instead. When running a 32-bit
> processes on a 64 bit CPU, the values are properly sign-extended, so it
> ensures the value passed to syscall_trace_enter is correct.
> 
> Recent systemd versions with seccomp enabled whitelist the getpid
> syscall for their internal  processes (e.g. systemd-journald), but call
> it through syscall(SYS_getpid). This fix therefore allows O32 big endian
> systems with a 64-bit kernel to run recent systemd versions.
> 
> Signed-off-by: Aurelien Jarno <aurelien@...el32.net>
> Cc: <stable@...r.kernel.org> # v3.15+
> ---
>  arch/mips/kernel/scall64-o32.S | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
> index f158c5894a9a..feb2653490df 100644
> --- a/arch/mips/kernel/scall64-o32.S
> +++ b/arch/mips/kernel/scall64-o32.S
> @@ -125,7 +125,7 @@ trace_a_syscall:
>  	subu	t1, v0,  __NR_O32_Linux
>  	move	a1, v0
>  	bnez	t1, 1f /* __NR_syscall at offset 0 */
> -	lw	a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
> +	ld	a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
>  	.set	pop
>  
>  1:	jal	syscall_trace_enter
> 
> 

Reviewed-by: Philippe Mathieu-Daudé <f4bug@...at.org>