2019-06-03 07:44:50 +02:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0-only */
|
2012-03-05 11:49:33 +00:00
|
|
|
/*
|
|
|
|
|
* Copyright (C) 2012 ARM Ltd.
|
|
|
|
|
*/
|
|
|
|
|
#ifndef __ASM_SYSCALL_H
|
|
|
|
|
#define __ASM_SYSCALL_H
|
|
|
|
|
|
2014-07-04 08:28:30 +01:00
|
|
|
#include <uapi/linux/audit.h>
|
|
|
|
|
#include <linux/compat.h>
|
2012-03-05 11:49:33 +00:00
|
|
|
#include <linux/err.h>
|
|
|
|
|
|
2019-05-24 15:11:16 -07:00
|
|
|
typedef long (*syscall_fn_t)(const struct pt_regs *regs);
|
2018-07-11 14:56:42 +01:00
|
|
|
|
|
|
|
|
extern const syscall_fn_t sys_call_table[];
|
2012-03-05 11:49:33 +00:00
|
|
|
|
2018-07-11 14:56:45 +01:00
|
|
|
#ifdef CONFIG_COMPAT
|
|
|
|
|
extern const syscall_fn_t compat_sys_call_table[];
|
|
|
|
|
#endif
|
|
|
|
|
|
2012-03-05 11:49:33 +00:00
|
|
|
static inline int syscall_get_nr(struct task_struct *task,
|
|
|
|
|
struct pt_regs *regs)
|
|
|
|
|
{
|
|
|
|
|
return regs->syscallno;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline void syscall_rollback(struct task_struct *task,
|
|
|
|
|
struct pt_regs *regs)
|
|
|
|
|
{
|
|
|
|
|
regs->regs[0] = regs->orig_x0;
|
|
|
|
|
}
|
|
|
|
|
|
arm64: fix compat syscall return truncation
Due to inconsistencies in the way we manipulate compat GPRs, we have a
few issues today:
* For audit and tracing, where error codes are handled as a (native)
long, negative error codes are expected to be sign-extended to the
native 64-bits, or they may fail to be matched correctly. Thus a
syscall which fails with an error may erroneously be identified as
failing.
* For ptrace, *all* compat return values should be sign-extended for
consistency with 32-bit arm, but we currently only do this for
negative return codes.
* As we may transiently set the upper 32 bits of some compat GPRs while
in the kernel, these can be sampled by perf, which is somewhat
confusing. This means that where a syscall returns a pointer above 2G,
this will be sign-extended, but will not be mistaken for an error as
error codes are constrained to the inclusive range [-4096, -1] where
no user pointer can exist.
To fix all of these, we must consistently use helpers to get/set the
compat GPRs, ensuring that we never write the upper 32 bits of the
return code, and always sign-extend when reading the return code. This
patch does so, with the following changes:
* We re-organise syscall_get_return_value() to always sign-extend for
compat tasks, and reimplement syscall_get_error() atop. We update
syscall_trace_exit() to use syscall_get_return_value().
* We consistently use syscall_set_return_value() to set the return
value, ensureing the upper 32 bits are never set unexpectedly.
* As the core audit code currently uses regs_return_value() rather than
syscall_get_return_value(), we special-case this for
compat_user_mode(regs) such that this will do the right thing. Going
forward, we should try to move the core audit code over to
syscall_get_return_value().
Cc: <stable@vger.kernel.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Reported-by: weiyuchen <weiyuchen3@huawei.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20210802104200.21390-1-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
2021-08-02 11:42:00 +01:00
|
|
|
static inline long syscall_get_return_value(struct task_struct *task,
|
|
|
|
|
struct pt_regs *regs)
|
2012-03-05 11:49:33 +00:00
|
|
|
{
|
arm64: fix compat syscall return truncation
Due to inconsistencies in the way we manipulate compat GPRs, we have a
few issues today:
* For audit and tracing, where error codes are handled as a (native)
long, negative error codes are expected to be sign-extended to the
native 64-bits, or they may fail to be matched correctly. Thus a
syscall which fails with an error may erroneously be identified as
failing.
* For ptrace, *all* compat return values should be sign-extended for
consistency with 32-bit arm, but we currently only do this for
negative return codes.
* As we may transiently set the upper 32 bits of some compat GPRs while
in the kernel, these can be sampled by perf, which is somewhat
confusing. This means that where a syscall returns a pointer above 2G,
this will be sign-extended, but will not be mistaken for an error as
error codes are constrained to the inclusive range [-4096, -1] where
no user pointer can exist.
To fix all of these, we must consistently use helpers to get/set the
compat GPRs, ensuring that we never write the upper 32 bits of the
return code, and always sign-extend when reading the return code. This
patch does so, with the following changes:
* We re-organise syscall_get_return_value() to always sign-extend for
compat tasks, and reimplement syscall_get_error() atop. We update
syscall_trace_exit() to use syscall_get_return_value().
* We consistently use syscall_set_return_value() to set the return
value, ensureing the upper 32 bits are never set unexpectedly.
* As the core audit code currently uses regs_return_value() rather than
syscall_get_return_value(), we special-case this for
compat_user_mode(regs) such that this will do the right thing. Going
forward, we should try to move the core audit code over to
syscall_get_return_value().
Cc: <stable@vger.kernel.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Reported-by: weiyuchen <weiyuchen3@huawei.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20210802104200.21390-1-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
2021-08-02 11:42:00 +01:00
|
|
|
unsigned long val = regs->regs[0];
|
2020-07-03 12:08:42 +01:00
|
|
|
|
|
|
|
|
if (is_compat_thread(task_thread_info(task)))
|
arm64: fix compat syscall return truncation
Due to inconsistencies in the way we manipulate compat GPRs, we have a
few issues today:
* For audit and tracing, where error codes are handled as a (native)
long, negative error codes are expected to be sign-extended to the
native 64-bits, or they may fail to be matched correctly. Thus a
syscall which fails with an error may erroneously be identified as
failing.
* For ptrace, *all* compat return values should be sign-extended for
consistency with 32-bit arm, but we currently only do this for
negative return codes.
* As we may transiently set the upper 32 bits of some compat GPRs while
in the kernel, these can be sampled by perf, which is somewhat
confusing. This means that where a syscall returns a pointer above 2G,
this will be sign-extended, but will not be mistaken for an error as
error codes are constrained to the inclusive range [-4096, -1] where
no user pointer can exist.
To fix all of these, we must consistently use helpers to get/set the
compat GPRs, ensuring that we never write the upper 32 bits of the
return code, and always sign-extend when reading the return code. This
patch does so, with the following changes:
* We re-organise syscall_get_return_value() to always sign-extend for
compat tasks, and reimplement syscall_get_error() atop. We update
syscall_trace_exit() to use syscall_get_return_value().
* We consistently use syscall_set_return_value() to set the return
value, ensureing the upper 32 bits are never set unexpectedly.
* As the core audit code currently uses regs_return_value() rather than
syscall_get_return_value(), we special-case this for
compat_user_mode(regs) such that this will do the right thing. Going
forward, we should try to move the core audit code over to
syscall_get_return_value().
Cc: <stable@vger.kernel.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Reported-by: weiyuchen <weiyuchen3@huawei.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20210802104200.21390-1-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
2021-08-02 11:42:00 +01:00
|
|
|
val = sign_extend64(val, 31);
|
2020-07-03 12:08:42 +01:00
|
|
|
|
arm64: fix compat syscall return truncation
Due to inconsistencies in the way we manipulate compat GPRs, we have a
few issues today:
* For audit and tracing, where error codes are handled as a (native)
long, negative error codes are expected to be sign-extended to the
native 64-bits, or they may fail to be matched correctly. Thus a
syscall which fails with an error may erroneously be identified as
failing.
* For ptrace, *all* compat return values should be sign-extended for
consistency with 32-bit arm, but we currently only do this for
negative return codes.
* As we may transiently set the upper 32 bits of some compat GPRs while
in the kernel, these can be sampled by perf, which is somewhat
confusing. This means that where a syscall returns a pointer above 2G,
this will be sign-extended, but will not be mistaken for an error as
error codes are constrained to the inclusive range [-4096, -1] where
no user pointer can exist.
To fix all of these, we must consistently use helpers to get/set the
compat GPRs, ensuring that we never write the upper 32 bits of the
return code, and always sign-extend when reading the return code. This
patch does so, with the following changes:
* We re-organise syscall_get_return_value() to always sign-extend for
compat tasks, and reimplement syscall_get_error() atop. We update
syscall_trace_exit() to use syscall_get_return_value().
* We consistently use syscall_set_return_value() to set the return
value, ensureing the upper 32 bits are never set unexpectedly.
* As the core audit code currently uses regs_return_value() rather than
syscall_get_return_value(), we special-case this for
compat_user_mode(regs) such that this will do the right thing. Going
forward, we should try to move the core audit code over to
syscall_get_return_value().
Cc: <stable@vger.kernel.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Reported-by: weiyuchen <weiyuchen3@huawei.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20210802104200.21390-1-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
2021-08-02 11:42:00 +01:00
|
|
|
return val;
|
2012-03-05 11:49:33 +00:00
|
|
|
}
|
|
|
|
|
|
arm64: fix compat syscall return truncation
Due to inconsistencies in the way we manipulate compat GPRs, we have a
few issues today:
* For audit and tracing, where error codes are handled as a (native)
long, negative error codes are expected to be sign-extended to the
native 64-bits, or they may fail to be matched correctly. Thus a
syscall which fails with an error may erroneously be identified as
failing.
* For ptrace, *all* compat return values should be sign-extended for
consistency with 32-bit arm, but we currently only do this for
negative return codes.
* As we may transiently set the upper 32 bits of some compat GPRs while
in the kernel, these can be sampled by perf, which is somewhat
confusing. This means that where a syscall returns a pointer above 2G,
this will be sign-extended, but will not be mistaken for an error as
error codes are constrained to the inclusive range [-4096, -1] where
no user pointer can exist.
To fix all of these, we must consistently use helpers to get/set the
compat GPRs, ensuring that we never write the upper 32 bits of the
return code, and always sign-extend when reading the return code. This
patch does so, with the following changes:
* We re-organise syscall_get_return_value() to always sign-extend for
compat tasks, and reimplement syscall_get_error() atop. We update
syscall_trace_exit() to use syscall_get_return_value().
* We consistently use syscall_set_return_value() to set the return
value, ensureing the upper 32 bits are never set unexpectedly.
* As the core audit code currently uses regs_return_value() rather than
syscall_get_return_value(), we special-case this for
compat_user_mode(regs) such that this will do the right thing. Going
forward, we should try to move the core audit code over to
syscall_get_return_value().
Cc: <stable@vger.kernel.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Reported-by: weiyuchen <weiyuchen3@huawei.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20210802104200.21390-1-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
2021-08-02 11:42:00 +01:00
|
|
|
static inline long syscall_get_error(struct task_struct *task,
|
|
|
|
|
struct pt_regs *regs)
|
2012-03-05 11:49:33 +00:00
|
|
|
{
|
arm64: fix compat syscall return truncation
Due to inconsistencies in the way we manipulate compat GPRs, we have a
few issues today:
* For audit and tracing, where error codes are handled as a (native)
long, negative error codes are expected to be sign-extended to the
native 64-bits, or they may fail to be matched correctly. Thus a
syscall which fails with an error may erroneously be identified as
failing.
* For ptrace, *all* compat return values should be sign-extended for
consistency with 32-bit arm, but we currently only do this for
negative return codes.
* As we may transiently set the upper 32 bits of some compat GPRs while
in the kernel, these can be sampled by perf, which is somewhat
confusing. This means that where a syscall returns a pointer above 2G,
this will be sign-extended, but will not be mistaken for an error as
error codes are constrained to the inclusive range [-4096, -1] where
no user pointer can exist.
To fix all of these, we must consistently use helpers to get/set the
compat GPRs, ensuring that we never write the upper 32 bits of the
return code, and always sign-extend when reading the return code. This
patch does so, with the following changes:
* We re-organise syscall_get_return_value() to always sign-extend for
compat tasks, and reimplement syscall_get_error() atop. We update
syscall_trace_exit() to use syscall_get_return_value().
* We consistently use syscall_set_return_value() to set the return
value, ensureing the upper 32 bits are never set unexpectedly.
* As the core audit code currently uses regs_return_value() rather than
syscall_get_return_value(), we special-case this for
compat_user_mode(regs) such that this will do the right thing. Going
forward, we should try to move the core audit code over to
syscall_get_return_value().
Cc: <stable@vger.kernel.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Reported-by: weiyuchen <weiyuchen3@huawei.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20210802104200.21390-1-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
2021-08-02 11:42:00 +01:00
|
|
|
unsigned long error = syscall_get_return_value(task, regs);
|
|
|
|
|
|
|
|
|
|
return IS_ERR_VALUE(error) ? error : 0;
|
2012-03-05 11:49:33 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline void syscall_set_return_value(struct task_struct *task,
|
|
|
|
|
struct pt_regs *regs,
|
|
|
|
|
int error, long val)
|
|
|
|
|
{
|
2020-07-03 12:08:42 +01:00
|
|
|
if (error)
|
|
|
|
|
val = error;
|
|
|
|
|
|
|
|
|
|
if (is_compat_thread(task_thread_info(task)))
|
|
|
|
|
val = lower_32_bits(val);
|
|
|
|
|
|
|
|
|
|
regs->regs[0] = val;
|
2012-03-05 11:49:33 +00:00
|
|
|
}
|
|
|
|
|
|
2025-03-03 13:20:20 +02:00
|
|
|
static inline void syscall_set_nr(struct task_struct *task,
|
|
|
|
|
struct pt_regs *regs,
|
|
|
|
|
int nr)
|
|
|
|
|
{
|
|
|
|
|
regs->syscallno = nr;
|
|
|
|
|
if (nr == -1) {
|
|
|
|
|
/*
|
|
|
|
|
* When the syscall number is set to -1, the syscall will be
|
|
|
|
|
* skipped. In this case the syscall return value has to be
|
|
|
|
|
* set explicitly, otherwise the first syscall argument is
|
|
|
|
|
* returned as the syscall return value.
|
|
|
|
|
*/
|
|
|
|
|
syscall_set_return_value(task, regs, -ENOSYS, 0);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2012-03-05 11:49:33 +00:00
|
|
|
#define SYSCALL_MAX_ARGS 6
|
|
|
|
|
|
|
|
|
|
static inline void syscall_get_arguments(struct task_struct *task,
|
|
|
|
|
struct pt_regs *regs,
|
|
|
|
|
unsigned long *args)
|
|
|
|
|
{
|
2016-11-07 16:26:37 -05:00
|
|
|
args[0] = regs->orig_x0;
|
|
|
|
|
args++;
|
2012-03-05 11:49:33 +00:00
|
|
|
|
2016-11-07 16:26:37 -05:00
|
|
|
memcpy(args, ®s->regs[1], 5 * sizeof(args[0]));
|
2012-03-05 11:49:33 +00:00
|
|
|
}
|
|
|
|
|
|
2025-03-03 13:20:09 +02:00
|
|
|
static inline void syscall_set_arguments(struct task_struct *task,
|
|
|
|
|
struct pt_regs *regs,
|
|
|
|
|
const unsigned long *args)
|
|
|
|
|
{
|
|
|
|
|
memcpy(®s->regs[0], args, 6 * sizeof(args[0]));
|
|
|
|
|
/*
|
|
|
|
|
* Also copy the first argument into orig_x0
|
|
|
|
|
* so that syscall_get_arguments() would return it
|
|
|
|
|
* instead of the previous value.
|
|
|
|
|
*/
|
|
|
|
|
regs->orig_x0 = regs->regs[0];
|
|
|
|
|
}
|
|
|
|
|
|
2014-07-04 08:28:30 +01:00
|
|
|
/*
|
|
|
|
|
* We don't care about endianness (__AUDIT_ARCH_LE bit) here because
|
|
|
|
|
* AArch64 has the same system calls both on little- and big- endian.
|
|
|
|
|
*/
|
2019-03-18 02:30:18 +03:00
|
|
|
static inline int syscall_get_arch(struct task_struct *task)
|
2014-07-04 08:28:30 +01:00
|
|
|
{
|
2019-03-18 02:30:18 +03:00
|
|
|
if (is_compat_thread(task_thread_info(task)))
|
2014-07-04 08:28:30 +01:00
|
|
|
return AUDIT_ARCH_ARM;
|
|
|
|
|
|
|
|
|
|
return AUDIT_ARCH_AARCH64;
|
|
|
|
|
}
|
|
|
|
|
|
2023-05-17 14:51:48 +02:00
|
|
|
int syscall_trace_enter(struct pt_regs *regs);
|
|
|
|
|
void syscall_trace_exit(struct pt_regs *regs);
|
|
|
|
|
|
2012-03-05 11:49:33 +00:00
|
|
|
#endif /* __ASM_SYSCALL_H */
|