linux-kernel - Re: ptrace: seccomp: Return value when the call was already invalid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200704123355.GA21185@willie-the-truck>
Date:   Sat, 4 Jul 2020 13:33:56 +0100
From:   Will Deacon <will@...nel.org>
To:     Kees Cook <keescook@...omium.org>
Cc:     Keno Fischer <keno@...iacomputing.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Oleg Nesterov <oleg@...hat.com>,
        Andy Lutomirski <luto@...capital.net>,
        Will Drewry <wad@...omium.org>
Subject: Re: ptrace: seccomp: Return value when the call was already invalid

On Fri, Jul 03, 2020 at 08:52:05AM -0700, Kees Cook wrote:
> On Fri, Jul 03, 2020 at 04:44:27PM +0100, Will Deacon wrote:
> > On Fri, Jul 03, 2020 at 08:17:19AM -0700, Kees Cook wrote:
> > > On Fri, Jul 03, 2020 at 09:39:14AM +0100, Will Deacon wrote:
> > > > diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
> > > > index 5f5b868292f5..a13661f44818 100644
> > > > --- a/arch/arm64/kernel/syscall.c
> > > > +++ b/arch/arm64/kernel/syscall.c
> > > > @@ -121,12 +121,10 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
> > > >  	user_exit();
> > > >  
> > > >  	if (has_syscall_work(flags)) {
> > > > -		/* set default errno for user-issued syscall(-1) */
> > > > -		if (scno == NO_SYSCALL)
> > > > -			regs->regs[0] = -ENOSYS;
> > > > -		scno = syscall_trace_enter(regs);
> > > > -		if (scno == NO_SYSCALL)
> > > > +		if (syscall_trace_enter(regs))
> > > >  			goto trace_exit;
> > > > +
> > > > +		scno = regs->syscallno;
> > > >  	}
> > > >  
> > > >  	invoke_syscall(regs, scno, sc_nr, syscall_table);
> > > 
> > > What effect do either of these patches have on the existing seccomp
> > > selftests: tools/testing/selftests/seccomp/seccomp_bpf ?
> > 
> > Tests! Thanks, I'll have a look.
> 
> Thanks!
> 
> (And either way, that this behavioral difference went unnoticed means we
> need to add a test to the selftests for this patch.)

Unsurprisingly, I don't think the tests go near this. I get 75/77 passes
on arm64 defconfig with or without these changes.

We could add a test, but then we'd have to agree on what it's supposed to
be doing ;)

Will