linux-kernel - Re: [PATCH v4 2/2] riscv: selftests: Add a ptrace test to verify syscall parameter modification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0b538b70-bc14-4038-a1b2-428192d6f51b@coelacanthus.name>
Date: Sun, 12 Jan 2025 18:41:48 +0800
From: Celeste Liu <uwu@...lacanthus.name>
To: Charlie Jenkins <charlie@...osinc.com>
Cc: "Dmitry V. Levin" <ldv@...ace.io>, Oleg Nesterov <oleg@...hat.com>,
 Paul Walmsley <paul.walmsley@...ive.com>, Palmer Dabbelt
 <palmer@...belt.com>, Eric Biederman <ebiederm@...ssion.com>,
 Kees Cook <kees@...nel.org>, Shuah Khan <shuah@...nel.org>,
 Albert Ou <aou@...s.berkeley.edu>, Alexandre Ghiti <alex@...ti.fr>,
 Andrea Bolognani <abologna@...hat.com>, Björn Töpel
 <bjorn@...nel.org>, Thomas Gleixner <tglx@...utronix.de>,
 Ron Economos <re@...z.net>, Andrew Jones <ajones@...tanamicro.com>,
 Quan Zhou <zhouquan@...as.ac.cn>, Guo Ren <guoren@...nel.org>,
 Eugene Syromyatnikov <evgsyr@...il.com>, linux-riscv@...ts.infradead.org,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 linux-kselftest@...r.kernel.org, Björn Töpel
 <bjorn@...osinc.com>
Subject: Re: [PATCH v4 2/2] riscv: selftests: Add a ptrace test to verify
 syscall parameter modification

On 2025-01-10 11:34, Charlie Jenkins wrote:
> On Thu, Dec 26, 2024 at 11:21:59PM +0800, Celeste Liu wrote:
>>
>> On 2024-12-26 21:35, Dmitry V. Levin wrote:
>>> On Thu, Dec 26, 2024 at 06:52:52PM +0800, Celeste Liu wrote:
>>>> This test checks that orig_a0 allows a syscall argument to be modified,
>>>> and that changing a0 does not change the syscall argument.
>>>>
>>>> Co-developed-by: Quan Zhou <zhouquan@...as.ac.cn>
>>>> Signed-off-by: Quan Zhou <zhouquan@...as.ac.cn>
>>>> Co-developed-by: Charlie Jenkins <charlie@...osinc.com>
>>>> Signed-off-by: Charlie Jenkins <charlie@...osinc.com>
>>>> Reviewed-by: Björn Töpel <bjorn@...osinc.com>
>>>> Signed-off-by: Celeste Liu <uwu@...lacanthus.name>
>>> [...]
>>>> diff --git a/tools/testing/selftests/riscv/abi/ptrace.c b/tools/testing/selftests/riscv/abi/ptrace.c
>>>> new file mode 100644
>>>> index 0000000000000000000000000000000000000000..023695352215bb5de3f91c1a6f5ea3b4f9373ff9
>>>> --- /dev/null
>>>> +++ b/tools/testing/selftests/riscv/abi/ptrace.c
>>> [...]
>>>> +	if (ptrace(PTRACE_GET_SYSCALL_INFO, pid, PTRACE_SYSCALL_INFO_ENTRY, &syscall_info_entry))
>>>> +		perr_and_exit("failed to get syscall info of entry\n");
>>>> +	result->orig_a0 = syscall_info_entry->entry.args[0];
>>>> +	if (ptrace(PTRACE_GET_SYSCALL_INFO, pid, PTRACE_SYSCALL_INFO_EXIT, &syscall_info_exit))
>>>> +		perr_and_exit("failed to get syscall info of exit\n");
>>>> +	result->a0 = syscall_info_exit->exit.rval;
>>>
>>> I'm sorry but this is not how PTRACE_GET_SYSCALL_INFO should be used.
>>>
>>> PTRACE_GET_SYSCALL_INFO operation takes a pointer and a size,
>>> and in this example instead of size you pass constants 1 and 2, which
>>> essentially means that both syscall_info_entry->entry.args[0] and
>>> syscall_info_exit->exit.rval are not going to be assigned
>>> and would just contain some garbage from the stack.
>>>
>>> Also, PTRACE_GET_SYSCALL_INFO operation returns the number of bytes
>>> available to be written by the kernel, which is always nonzero on any
>>> PTRACE_GET_SYSCALL_INFO-capable kernel.  In other words, this example
>>> will always end up with perr_and_exit() call.
>>>
>>> I wonder how this test was tested before the submission.
>>
>> Oops... It seems I forget sync the code to test board so it runs with the old code...
>> The code is completely not tested...
>> I'm so sorry for my mistake.
>>
>> I will correct it and test it carefully later...
> 
> It would be great to get this into 6.14. Let me know if you would like
> any help!

Sorry, delayed due to personal reasons. I have returned to this job recently.
The update patchset will be sent tomorrow.

> 
> - Charlie
> 
>>
>>>
>>>
>>