| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <6cbe7389d6f8250a22afe2213c90a6ceaf721a97.1770170302.git.thehajime@gmail.com>
Date: Wed, 4 Feb 2026 11:28:05 +0900
From: Hajime Tazaki <thehajime@...il.com>
To: linux-um@...ts.infradead.org
Cc: thehajime@...il.com,
ricarkol@...gle.com,
Liam.Howlett@...cle.com,
linux-kernel@...r.kernel.org
Subject: [PATCH v14 07/13] um: nommu: configure fs register on host syscall invocation
As userspace on UML/!MMU also need to configure %fs register when it is
running to correctly access thread structure, host syscalls implemented
in os-Linux drivers may be puzzled when they are called. Thus it has to
configure %fs register via arch_prctl(SET_FS) on every host syscalls.
Signed-off-by: Hajime Tazaki <thehajime@...il.com>
Signed-off-by: Ricardo Koller <ricarkol@...gle.com>
---
arch/um/include/shared/os.h | 6 ++++
arch/um/os-Linux/process.c | 6 ++++
arch/um/os-Linux/start_up.c | 21 ++++++++++++++
arch/x86/um/nommu/do_syscall_64.c | 11 +++++++
arch/x86/um/nommu/syscalls.h | 1 +
arch/x86/um/nommu/syscalls_64.c | 48 ++++++++++++++++++++++++++++++-
6 files changed, 92 insertions(+), 1 deletion(-)
diff --git a/arch/um/include/shared/os.h b/arch/um/include/shared/os.h
index 5451f9b1f41e..0ac87507e05e 100644
--- a/arch/um/include/shared/os.h
+++ b/arch/um/include/shared/os.h
@@ -189,6 +189,7 @@ extern void check_host_supports_tls(int *supports_tls, int *tls_min);
extern void get_host_cpu_features(
void (*flags_helper_func)(char *line),
void (*cache_helper_func)(char *line));
+extern int host_has_fsgsbase;
/* mem.c */
extern int create_mem_file(unsigned long long len);
@@ -213,6 +214,11 @@ extern int os_protect_memory(void *addr, unsigned long len,
extern int os_unmap_memory(void *addr, int len);
extern int os_drop_memory(void *addr, int length);
extern int can_drop_memory(void);
+extern int os_arch_prctl(int pid, int option, unsigned long *arg);
+#ifndef CONFIG_MMU
+extern long long host_fs;
+#endif
+
void os_set_pdeathsig(void);
diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
index b338a89ecf1e..4f30a389c530 100644
--- a/arch/um/os-Linux/process.c
+++ b/arch/um/os-Linux/process.c
@@ -18,6 +18,7 @@
#include <sys/prctl.h>
#include <sys/wait.h>
#include <asm/unistd.h>
+#include <sys/syscall.h> /* For SYS_xxx definitions */
#include <linux/threads.h>
#include <init.h>
#include <longjmp.h>
@@ -179,6 +180,11 @@ int __init can_drop_memory(void)
return ok;
}
+int os_arch_prctl(int pid, int option, unsigned long *arg2)
+{
+ return syscall(SYS_arch_prctl, option, arg2);
+}
+
void init_new_thread_signals(void)
{
set_handler(SIGSEGV);
diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
index 33e039d2c1bf..c0afe5d8b559 100644
--- a/arch/um/os-Linux/start_up.c
+++ b/arch/um/os-Linux/start_up.c
@@ -20,6 +20,8 @@
#include <sys/resource.h>
#include <asm/ldt.h>
#include <asm/unistd.h>
+#include <sys/auxv.h>
+#include <asm/hwcap2.h>
#include <init.h>
#include <os.h>
#include <smp.h>
@@ -37,6 +39,8 @@
#include <skas.h>
#include "internal.h"
+int host_has_fsgsbase;
+
static void ptrace_child(void)
{
int ret;
@@ -460,6 +464,20 @@ __uml_setup("seccomp=", uml_seccomp_config,
" This is insecure and should only be used with a trusted userspace\n\n"
);
+static void __init check_fsgsbase(void)
+{
+ unsigned long auxv = getauxval(AT_HWCAP2);
+
+ os_info("Checking FSGSBASE instructions...");
+ if (auxv & HWCAP2_FSGSBASE) {
+ host_has_fsgsbase = 1;
+ os_info("OK\n");
+ } else {
+ host_has_fsgsbase = 0;
+ os_info("disabled\n");
+ }
+}
+
void __init os_early_checks(void)
{
int pid;
@@ -488,6 +506,9 @@ void __init os_early_checks(void)
using_seccomp = 0;
check_ptrace();
+ /* probe fsgsbase instruction */
+ check_fsgsbase();
+
pid = start_ptraced_child();
if (init_pid_registers(pid))
fatal("Failed to initialize default registers");
diff --git a/arch/x86/um/nommu/do_syscall_64.c b/arch/x86/um/nommu/do_syscall_64.c
index 292d7c578622..c08ae4e0edec 100644
--- a/arch/x86/um/nommu/do_syscall_64.c
+++ b/arch/x86/um/nommu/do_syscall_64.c
@@ -4,7 +4,9 @@
#include <linux/ptrace.h>
#include <kern_util.h>
#include <asm/syscall.h>
+#include <asm/prctl.h>
#include <os.h>
+#include "syscalls.h"
__visible void do_syscall_64(struct pt_regs *regs)
{
@@ -13,6 +15,9 @@ __visible void do_syscall_64(struct pt_regs *regs)
syscall = PT_SYSCALL_NR(regs->regs.gp);
UPT_SYSCALL_NR(®s->regs) = syscall;
+ /* set fs register to the original host one */
+ os_x86_arch_prctl(0, ARCH_SET_FS, (void *)host_fs);
+
if (likely(syscall < NR_syscalls)) {
unsigned long ret;
@@ -29,4 +34,10 @@ __visible void do_syscall_64(struct pt_regs *regs)
/* handle tasks and signals at the end */
interrupt_end();
+
+ /* restore back fs register to userspace configured one */
+ os_x86_arch_prctl(0, ARCH_SET_FS,
+ (void *)(current->thread.regs.regs.gp[FS_BASE
+ / sizeof(unsigned long)]));
+
}
diff --git a/arch/x86/um/nommu/syscalls.h b/arch/x86/um/nommu/syscalls.h
index ce16bf8abd59..4b9e3c85cf3a 100644
--- a/arch/x86/um/nommu/syscalls.h
+++ b/arch/x86/um/nommu/syscalls.h
@@ -13,6 +13,7 @@
extern long current_top_of_stack;
extern long current_ptregs;
+int os_x86_arch_prctl(int pid, int option, unsigned long *arg2);
void arch_set_stack_to_current(void);
#endif
diff --git a/arch/x86/um/nommu/syscalls_64.c b/arch/x86/um/nommu/syscalls_64.c
index 3b1610280110..25fb11a8b7a4 100644
--- a/arch/x86/um/nommu/syscalls_64.c
+++ b/arch/x86/um/nommu/syscalls_64.c
@@ -10,11 +10,48 @@
#include <linux/sched/mm.h>
#include <linux/syscalls.h>
#include <linux/uaccess.h>
+#include <asm/fsgsbase.h>
#include <asm/prctl.h> /* XXX This should get the constants from libc */
#include <registers.h>
#include <os.h>
#include "syscalls.h"
+/*
+ * The guest libc can change FS, which confuses the host libc.
+ * In fact, changing FS directly is not supported (check
+ * man arch_prctl). So, whenever we make a host syscall,
+ * we should be changing FS to the original FS (not the
+ * one set by the guest libc). This original FS is stored
+ * in host_fs.
+ */
+long long host_fs = -1;
+
+int os_x86_arch_prctl(int pid, int option, unsigned long *arg2)
+{
+ if (!host_has_fsgsbase)
+ return os_arch_prctl(pid, option, arg2);
+
+ switch (option) {
+ case ARCH_SET_FS:
+ wrfsbase(*arg2);
+ break;
+ case ARCH_SET_GS:
+ wrgsbase(*arg2);
+ break;
+ case ARCH_GET_FS:
+ *arg2 = rdfsbase();
+ break;
+ case ARCH_GET_GS:
+ *arg2 = rdgsbase();
+ break;
+ default:
+ pr_warn("%s: unsupported option: 0x%x", __func__, option);
+ break;
+ }
+
+ return 0;
+}
+
void arch_set_stack_to_current(void)
{
current_top_of_stack = task_top_of_stack(current);
@@ -35,6 +72,15 @@ void arch_switch_to(struct task_struct *to)
return;
/* this changes the FS on every context switch */
- arch_prctl(to, ARCH_SET_FS,
+ os_x86_arch_prctl(0, ARCH_SET_FS,
(void __user *) to->thread.regs.regs.gp[FS_BASE / sizeof(unsigned long)]);
}
+
+static int __init um_nommu_setup_hostfs(void)
+{
+ /* initialize the host_fs value at boottime */
+ os_x86_arch_prctl(0, ARCH_GET_FS, (void *)&host_fs);
+
+ return 0;
+}
+arch_initcall(um_nommu_setup_hostfs);
--
2.43.0
Powered by blists - more mailing lists