linux-kernel - Re: [PATCH v4 2/2] riscv: selftests: Add a ptrace test to verify syscall parameter modification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z4CVQKkViqJycnaq@ghost>
Date: Thu, 9 Jan 2025 19:34:24 -0800
From: Charlie Jenkins <charlie@...osinc.com>
To: Celeste Liu <uwu@...lacanthus.name>
Cc: "Dmitry V. Levin" <ldv@...ace.io>, Oleg Nesterov <oleg@...hat.com>,
	Paul Walmsley <paul.walmsley@...ive.com>,
	Palmer Dabbelt <palmer@...belt.com>,
	Eric Biederman <ebiederm@...ssion.com>, Kees Cook <kees@...nel.org>,
	Shuah Khan <shuah@...nel.org>, Albert Ou <aou@...s.berkeley.edu>,
	Alexandre Ghiti <alex@...ti.fr>,
	Andrea Bolognani <abologna@...hat.com>,
	Björn Töpel <bjorn@...nel.org>,
	Thomas Gleixner <tglx@...utronix.de>, Ron Economos <re@...z.net>,
	Andrew Jones <ajones@...tanamicro.com>,
	Quan Zhou <zhouquan@...as.ac.cn>,
	Felix Yan <felixonmars@...hlinux.org>,
	Ruizhe Pan <c141028@...il.com>, Guo Ren <guoren@...nel.org>,
	Yao Zi <ziyao@...root.org>, Eugene Syromyatnikov <evgsyr@...il.com>,
	linux-riscv@...ts.infradead.org, linux-kernel@...r.kernel.org,
	linux-mm@...ck.org, linux-kselftest@...r.kernel.org,
	Björn Töpel <bjorn@...osinc.com>
Subject: Re: [PATCH v4 2/2] riscv: selftests: Add a ptrace test to verify
 syscall parameter modification

On Thu, Dec 26, 2024 at 11:21:59PM +0800, Celeste Liu wrote:
> 
> On 2024-12-26 21:35, Dmitry V. Levin wrote:
> > On Thu, Dec 26, 2024 at 06:52:52PM +0800, Celeste Liu wrote:
> >> This test checks that orig_a0 allows a syscall argument to be modified,
> >> and that changing a0 does not change the syscall argument.
> >>
> >> Co-developed-by: Quan Zhou <zhouquan@...as.ac.cn>
> >> Signed-off-by: Quan Zhou <zhouquan@...as.ac.cn>
> >> Co-developed-by: Charlie Jenkins <charlie@...osinc.com>
> >> Signed-off-by: Charlie Jenkins <charlie@...osinc.com>
> >> Reviewed-by: Björn Töpel <bjorn@...osinc.com>
> >> Signed-off-by: Celeste Liu <uwu@...lacanthus.name>
> > [...]
> >> diff --git a/tools/testing/selftests/riscv/abi/ptrace.c b/tools/testing/selftests/riscv/abi/ptrace.c
> >> new file mode 100644
> >> index 0000000000000000000000000000000000000000..023695352215bb5de3f91c1a6f5ea3b4f9373ff9
> >> --- /dev/null
> >> +++ b/tools/testing/selftests/riscv/abi/ptrace.c
> > [...]
> >> +	if (ptrace(PTRACE_GET_SYSCALL_INFO, pid, PTRACE_SYSCALL_INFO_ENTRY, &syscall_info_entry))
> >> +		perr_and_exit("failed to get syscall info of entry\n");
> >> +	result->orig_a0 = syscall_info_entry->entry.args[0];
> >> +	if (ptrace(PTRACE_GET_SYSCALL_INFO, pid, PTRACE_SYSCALL_INFO_EXIT, &syscall_info_exit))
> >> +		perr_and_exit("failed to get syscall info of exit\n");
> >> +	result->a0 = syscall_info_exit->exit.rval;
> > 
> > I'm sorry but this is not how PTRACE_GET_SYSCALL_INFO should be used.
> > 
> > PTRACE_GET_SYSCALL_INFO operation takes a pointer and a size,
> > and in this example instead of size you pass constants 1 and 2, which
> > essentially means that both syscall_info_entry->entry.args[0] and
> > syscall_info_exit->exit.rval are not going to be assigned
> > and would just contain some garbage from the stack.
> > 
> > Also, PTRACE_GET_SYSCALL_INFO operation returns the number of bytes
> > available to be written by the kernel, which is always nonzero on any
> > PTRACE_GET_SYSCALL_INFO-capable kernel.  In other words, this example
> > will always end up with perr_and_exit() call.
> > 
> > I wonder how this test was tested before the submission.
> 
> Oops... It seems I forget sync the code to test board so it runs with the old code...
> The code is completely not tested...
> I'm so sorry for my mistake.
> 
> I will correct it and test it carefully later...

It would be great to get this into 6.14. Let me know if you would like
any help!

- Charlie

> 
> > 
> > 
>