1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28#include <linux/kernel.h>
29#include <linux/timer.h>
30#include <linux/syscalls.h>
31#include <linux/ratelimit.h>
32
33#include <asm/vsyscall.h>
34#include <asm/unistd.h>
35#include <asm/fixmap.h>
36#include <asm/traps.h>
37
38#define CREATE_TRACE_POINTS
39#include "vsyscall_trace.h"
40
41static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
42
43static int __init vsyscall_setup(char *str)
44{
45 if (str) {
46 if (!strcmp("emulate", str))
47 vsyscall_mode = EMULATE;
48 else if (!strcmp("native", str))
49 vsyscall_mode = NATIVE;
50 else if (!strcmp("none", str))
51 vsyscall_mode = NONE;
52 else
53 return -EINVAL;
54
55 return 0;
56 }
57
58 return -EINVAL;
59}
60early_param("vsyscall", vsyscall_setup);
61
62static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
63 const char *message)
64{
65 if (!show_unhandled_signals)
66 return;
67
68 printk_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
69 level, current->comm, task_pid_nr(current),
70 message, regs->ip, regs->cs,
71 regs->sp, regs->ax, regs->si, regs->di);
72}
73
74static int addr_to_vsyscall_nr(unsigned long addr)
75{
76 int nr;
77
78 if ((addr & ~0xC00UL) != VSYSCALL_ADDR)
79 return -EINVAL;
80
81 nr = (addr & 0xC00UL) >> 10;
82 if (nr >= 3)
83 return -EINVAL;
84
85 return nr;
86}
87
88static bool write_ok_or_segv(unsigned long ptr, size_t size)
89{
90
91
92
93
94
95 if (!access_ok(VERIFY_WRITE, (void __user *)ptr, size)) {
96 siginfo_t info;
97 struct thread_struct *thread = ¤t->thread;
98
99 thread->error_code = 6;
100 thread->cr2 = ptr;
101 thread->trap_nr = X86_TRAP_PF;
102
103 memset(&info, 0, sizeof(info));
104 info.si_signo = SIGSEGV;
105 info.si_errno = 0;
106 info.si_code = SEGV_MAPERR;
107 info.si_addr = (void __user *)ptr;
108
109 force_sig_info(SIGSEGV, &info, current);
110 return false;
111 } else {
112 return true;
113 }
114}
115
116bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
117{
118 struct task_struct *tsk;
119 unsigned long caller;
120 int vsyscall_nr, syscall_nr, tmp;
121 int prev_sig_on_uaccess_error;
122 long ret;
123
124
125
126
127
128
129 WARN_ON_ONCE(address != regs->ip);
130
131 if (vsyscall_mode == NONE) {
132 warn_bad_vsyscall(KERN_INFO, regs,
133 "vsyscall attempted with vsyscall=none");
134 return false;
135 }
136
137 vsyscall_nr = addr_to_vsyscall_nr(address);
138
139 trace_emulate_vsyscall(vsyscall_nr);
140
141 if (vsyscall_nr < 0) {
142 warn_bad_vsyscall(KERN_WARNING, regs,
143 "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround");
144 goto sigsegv;
145 }
146
147 if (get_user(caller, (unsigned long __user *)regs->sp) != 0) {
148 warn_bad_vsyscall(KERN_WARNING, regs,
149 "vsyscall with bad stack (exploit attempt?)");
150 goto sigsegv;
151 }
152
153 tsk = current;
154
155
156
157
158
159
160
161
162
163 switch (vsyscall_nr) {
164 case 0:
165 if (!write_ok_or_segv(regs->di, sizeof(struct timeval)) ||
166 !write_ok_or_segv(regs->si, sizeof(struct timezone))) {
167 ret = -EFAULT;
168 goto check_fault;
169 }
170
171 syscall_nr = __NR_gettimeofday;
172 break;
173
174 case 1:
175 if (!write_ok_or_segv(regs->di, sizeof(time_t))) {
176 ret = -EFAULT;
177 goto check_fault;
178 }
179
180 syscall_nr = __NR_time;
181 break;
182
183 case 2:
184 if (!write_ok_or_segv(regs->di, sizeof(unsigned)) ||
185 !write_ok_or_segv(regs->si, sizeof(unsigned))) {
186 ret = -EFAULT;
187 goto check_fault;
188 }
189
190 syscall_nr = __NR_getcpu;
191 break;
192 }
193
194
195
196
197
198
199
200
201 regs->orig_ax = syscall_nr;
202 regs->ax = -ENOSYS;
203 tmp = secure_computing();
204 if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
205 warn_bad_vsyscall(KERN_DEBUG, regs,
206 "seccomp tried to change syscall nr or ip");
207 do_exit(SIGSYS);
208 }
209 regs->orig_ax = -1;
210 if (tmp)
211 goto do_ret;
212
213
214
215
216
217 prev_sig_on_uaccess_error = current_thread_info()->sig_on_uaccess_error;
218 current_thread_info()->sig_on_uaccess_error = 1;
219
220 ret = -EFAULT;
221 switch (vsyscall_nr) {
222 case 0:
223 ret = sys_gettimeofday(
224 (struct timeval __user *)regs->di,
225 (struct timezone __user *)regs->si);
226 break;
227
228 case 1:
229 ret = sys_time((time_t __user *)regs->di);
230 break;
231
232 case 2:
233 ret = sys_getcpu((unsigned __user *)regs->di,
234 (unsigned __user *)regs->si,
235 NULL);
236 break;
237 }
238
239 current_thread_info()->sig_on_uaccess_error = prev_sig_on_uaccess_error;
240
241check_fault:
242 if (ret == -EFAULT) {
243
244 warn_bad_vsyscall(KERN_INFO, regs,
245 "vsyscall fault (exploit attempt?)");
246
247
248
249
250
251 if (WARN_ON_ONCE(!sigismember(&tsk->pending.signal, SIGBUS) &&
252 !sigismember(&tsk->pending.signal, SIGSEGV)))
253 goto sigsegv;
254
255 return true;
256 }
257
258 regs->ax = ret;
259
260do_ret:
261
262 regs->ip = caller;
263 regs->sp += 8;
264 return true;
265
266sigsegv:
267 force_sig(SIGSEGV, current);
268 return true;
269}
270
271
272
273
274
275
276static const char *gate_vma_name(struct vm_area_struct *vma)
277{
278 return "[vsyscall]";
279}
280static const struct vm_operations_struct gate_vma_ops = {
281 .name = gate_vma_name,
282};
283static struct vm_area_struct gate_vma = {
284 .vm_start = VSYSCALL_ADDR,
285 .vm_end = VSYSCALL_ADDR + PAGE_SIZE,
286 .vm_page_prot = PAGE_READONLY_EXEC,
287 .vm_flags = VM_READ | VM_EXEC,
288 .vm_ops = &gate_vma_ops,
289};
290
291struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
292{
293#ifdef CONFIG_COMPAT
294 if (!mm || mm->context.ia32_compat)
295 return NULL;
296#endif
297 if (vsyscall_mode == NONE)
298 return NULL;
299 return &gate_vma;
300}
301
302int in_gate_area(struct mm_struct *mm, unsigned long addr)
303{
304 struct vm_area_struct *vma = get_gate_vma(mm);
305
306 if (!vma)
307 return 0;
308
309 return (addr >= vma->vm_start) && (addr < vma->vm_end);
310}
311
312
313
314
315
316
317int in_gate_area_no_mm(unsigned long addr)
318{
319 return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR;
320}
321
322void __init map_vsyscall(void)
323{
324 extern char __vsyscall_page;
325 unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
326
327 if (vsyscall_mode != NONE)
328 __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
329 vsyscall_mode == NATIVE
330 ? PAGE_KERNEL_VSYSCALL
331 : PAGE_KERNEL_VVAR);
332
333 BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
334 (unsigned long)VSYSCALL_ADDR);
335}
336