linux-kernel - [PATCH] ARM: ptrace: fix scno of -1 cause SIGILL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230724121655.7894-1-lecopzer.chen@mediatek.com>
Date:   Mon, 24 Jul 2023 20:16:55 +0800
From:   Lecopzer Chen <lecopzer.chen@...iatek.com>
To:     <arnd@...db.de>, <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>
CC:     <linux@...linux.org.uk>, <linus.walleij@...aro.org>,
        <yj.chiang@...iatek.com>,
        Lecopzer Chen <lecopzer.chen@...iatek.com>
Subject: [PATCH] ARM: ptrace: fix scno of -1 cause SIGILL

In commit [1], the -1 scno is used as a special scno when the task's
syscall is traced.

After commit [2], PTRACE_SET_SYSCALL will always mask syscall with
__NR_SYSCALL_MASK, this makes the condition `cmp scno, #-1` broken,
and some test like Android VTS[3] is also failed because SIGILL
interrupt the test program.

Let's test with `and` logic with #0x0ff000. Instead of #__NR_SYSCALL_MASK
because of the constraint of ARM Operand2 rules and avoid conflicting
with ARM private syscall.

[1] commit ad75b51459ae ("ARM: 7579/1: arch/allow a scno of -1 to not cause a SIGILL")
[2] commit 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
[3] vts_linux_kselftest_arm_32 seccomp_seccomp_bpf_arm_32#seccomp_seccomp_bpf_arm_32

Fixes: 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
Signed-off-by: Lecopzer Chen <lecopzer.chen@...iatek.com>
---
 arch/arm/kernel/entry-common.S | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index bcc4c9ec3aa4..8ff3ff476266 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -298,8 +298,15 @@ __sys_trace:
 	bl	syscall_trace_enter
 	mov	scno, r0
 	invoke_syscall tbl, scno, r10, __sys_trace_return, reload=1
-	cmp	scno, #-1			@ skip the syscall?
-	bne	2b
+	/*
+	 * We'd like to skip scno=-1 for avoiding SIGILL for tracer,
+	 * however, tracer or seccomp may have changed syscall and masked
+	 * with __NR_SYSCALL_MASK, make sure -1 is compared with correct
+	 * masked syscall number.
+	 */
+	and r10, scno, #0x0ff000
+	cmp r10, #0x0ff000
+	bne 2b
 	add	sp, sp, #S_OFF			@ restore stack
 
 __sys_trace_return_nosave:
-- 
2.18.0