linux-kernel - Re: [PATCH v4 2/2] riscv: selftests: Add a ptrace test to verify syscall parameter modification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2e09aedc-44ba-40e3-ae93-1d6dc21b5eb1@coelacanthus.name>
Date: Thu, 26 Dec 2024 23:21:59 +0800
From: Celeste Liu <uwu@...lacanthus.name>
To: "Dmitry V. Levin" <ldv@...ace.io>
Cc: Oleg Nesterov <oleg@...hat.com>, Paul Walmsley
 <paul.walmsley@...ive.com>, Palmer Dabbelt <palmer@...belt.com>,
 Eric Biederman <ebiederm@...ssion.com>, Kees Cook <kees@...nel.org>,
 Shuah Khan <shuah@...nel.org>, Albert Ou <aou@...s.berkeley.edu>,
 Alexandre Ghiti <alex@...ti.fr>, Andrea Bolognani <abologna@...hat.com>,
 Björn Töpel <bjorn@...nel.org>,
 Thomas Gleixner <tglx@...utronix.de>, Ron Economos <re@...z.net>,
 Charlie Jenkins <charlie@...osinc.com>,
 Andrew Jones <ajones@...tanamicro.com>, Quan Zhou <zhouquan@...as.ac.cn>,
 Felix Yan <felixonmars@...hlinux.org>, Ruizhe Pan <c141028@...il.com>,
 Guo Ren <guoren@...nel.org>, Yao Zi <ziyao@...root.org>,
 Eugene Syromyatnikov <evgsyr@...il.com>, linux-riscv@...ts.infradead.org,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 linux-kselftest@...r.kernel.org, Björn Töpel
 <bjorn@...osinc.com>
Subject: Re: [PATCH v4 2/2] riscv: selftests: Add a ptrace test to verify
 syscall parameter modification

On 2024-12-26 21:35, Dmitry V. Levin wrote:
> On Thu, Dec 26, 2024 at 06:52:52PM +0800, Celeste Liu wrote:
>> This test checks that orig_a0 allows a syscall argument to be modified,
>> and that changing a0 does not change the syscall argument.
>>
>> Co-developed-by: Quan Zhou <zhouquan@...as.ac.cn>
>> Signed-off-by: Quan Zhou <zhouquan@...as.ac.cn>
>> Co-developed-by: Charlie Jenkins <charlie@...osinc.com>
>> Signed-off-by: Charlie Jenkins <charlie@...osinc.com>
>> Reviewed-by: Björn Töpel <bjorn@...osinc.com>
>> Signed-off-by: Celeste Liu <uwu@...lacanthus.name>
> [...]
>> diff --git a/tools/testing/selftests/riscv/abi/ptrace.c b/tools/testing/selftests/riscv/abi/ptrace.c
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..023695352215bb5de3f91c1a6f5ea3b4f9373ff9
>> --- /dev/null
>> +++ b/tools/testing/selftests/riscv/abi/ptrace.c
> [...]
>> +	if (ptrace(PTRACE_GET_SYSCALL_INFO, pid, PTRACE_SYSCALL_INFO_ENTRY, &syscall_info_entry))
>> +		perr_and_exit("failed to get syscall info of entry\n");
>> +	result->orig_a0 = syscall_info_entry->entry.args[0];
>> +	if (ptrace(PTRACE_GET_SYSCALL_INFO, pid, PTRACE_SYSCALL_INFO_EXIT, &syscall_info_exit))
>> +		perr_and_exit("failed to get syscall info of exit\n");
>> +	result->a0 = syscall_info_exit->exit.rval;
> 
> I'm sorry but this is not how PTRACE_GET_SYSCALL_INFO should be used.
> 
> PTRACE_GET_SYSCALL_INFO operation takes a pointer and a size,
> and in this example instead of size you pass constants 1 and 2, which
> essentially means that both syscall_info_entry->entry.args[0] and
> syscall_info_exit->exit.rval are not going to be assigned
> and would just contain some garbage from the stack.
> 
> Also, PTRACE_GET_SYSCALL_INFO operation returns the number of bytes
> available to be written by the kernel, which is always nonzero on any
> PTRACE_GET_SYSCALL_INFO-capable kernel.  In other words, this example
> will always end up with perr_and_exit() call.
> 
> I wonder how this test was tested before the submission.

Oops... It seems I forget sync the code to test board so it runs with the old code...
The code is completely not tested...
I'm so sorry for my mistake.

I will correct it and test it carefully later...

> 
>