* [PATCH 2/2] MIPS: o32: Get rid of useless wrapper for llseek @ 2009-03-25 0:15 Ralf Baechle 2009-03-25 17:29 ` Heiko Carstens 2009-03-25 19:29 ` dann frazier 0 siblings, 2 replies; 5+ messages in thread From: Ralf Baechle @ 2009-03-25 0:15 UTC (permalink / raw) To: linux-arch, linux-kernel; +Cc: dann frazier, linux-mips Signed-off-by: Ralf Baechle <ralf@linux-mips.org> arch/mips/kernel/linux32.c | 7 ------- arch/mips/kernel/scall64-o32.S | 2 +- 2 files changed, 1 insertions(+), 8 deletions(-) diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c index 49aac6e..ab2da41 100644 --- a/arch/mips/kernel/linux32.c +++ b/arch/mips/kernel/linux32.c @@ -133,13 +133,6 @@ SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy, return sys_ftruncate(fd, merge_64(a2, a3)); } -SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, - unsigned long, offset_low, loff_t __user *, result, - unsigned long, origin) -{ - return sys_llseek(fd, offset_high, offset_low, result, origin); -} - /* From the Single Unix Spec: pread & pwrite act like lseek to pos + op + lseek back to original location. They fail just like lseek does on non-seekable files. */ diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S index b0fef4f..d928614 100644 --- a/arch/mips/kernel/scall64-o32.S +++ b/arch/mips/kernel/scall64-o32.S @@ -343,7 +343,7 @@ sys_call_table: PTR sys_ni_syscall /* for afs_syscall */ PTR sys_setfsuid PTR sys_setfsgid - PTR sys_32_llseek /* 4140 */ + PTR sys_llseek /* 4140 */ PTR compat_sys_getdents PTR compat_sys_select PTR sys_flock ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] MIPS: o32: Get rid of useless wrapper for llseek 2009-03-25 0:15 [PATCH 2/2] MIPS: o32: Get rid of useless wrapper for llseek Ralf Baechle @ 2009-03-25 17:29 ` Heiko Carstens 2009-03-25 17:29 ` Heiko Carstens 2009-03-25 19:28 ` dann frazier 2009-03-25 19:29 ` dann frazier 1 sibling, 2 replies; 5+ messages in thread From: Heiko Carstens @ 2009-03-25 17:29 UTC (permalink / raw) To: Ralf Baechle; +Cc: linux-arch, linux-kernel, dann frazier, linux-mips On Wed, 25 Mar 2009 01:15:55 +0100 Ralf Baechle <ralf@linux-mips.org> wrote: > Signed-off-by: Ralf Baechle <ralf@linux-mips.org> > > arch/mips/kernel/linux32.c | 7 ------- > arch/mips/kernel/scall64-o32.S | 2 +- > 2 files changed, 1 insertions(+), 8 deletions(-) > > diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c > index 49aac6e..ab2da41 100644 > --- a/arch/mips/kernel/linux32.c > +++ b/arch/mips/kernel/linux32.c > @@ -133,13 +133,6 @@ SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy, > return sys_ftruncate(fd, merge_64(a2, a3)); > } > > -SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, > - unsigned long, offset_low, loff_t __user *, result, > - unsigned long, origin) > -{ > - return sys_llseek(fd, offset_high, offset_low, result, origin); > -} > - Ah.. this hunk seems to be the origin of the bug. git commit dbda6ac0897603f6c6dfadbbc37f9882177ec7ac "MIPS: CVE-2009-0029: Enable syscall wrappers." contains this: -asmlinkage int sys32_llseek(unsigned int fd, unsigned int offset_high, - unsigned int offset_low, loff_t __user * result, - unsigned int origin) +SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, + unsigned long, offset_low, loff_t __user *, result, + unsigned long, origin) Here you converted offset_low from unsigned int to unsigned long. Hence you lost the clearing of the upper 32 bits. That would explain the bug. Any chance the process where the bug was seen was a compat process? Patch below would probably fix it. Btw. there are a lot of int->long conversions in the git commit mentioned above. AFAICS all(?) of the conversions are wrong. diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c index 1a86f84..5abcc7f 100644 --- a/arch/mips/kernel/linux32.c +++ b/arch/mips/kernel/linux32.c @@ -134,9 +134,9 @@ SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy, return sys_ftruncate(fd, merge_64(a2, a3)); } -SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, - unsigned long, offset_low, loff_t __user *, result, - unsigned long, origin) +SYSCALL_DEFINE5(32_llseek, unsigned int, fd, unsigned int, offset_high, + unsigned int, offset_low, loff_t __user *, result, + unsigned int, origin) { return sys_llseek(fd, offset_high, offset_low, result, origin); } ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] MIPS: o32: Get rid of useless wrapper for llseek 2009-03-25 17:29 ` Heiko Carstens @ 2009-03-25 17:29 ` Heiko Carstens 2009-03-25 19:28 ` dann frazier 1 sibling, 0 replies; 5+ messages in thread From: Heiko Carstens @ 2009-03-25 17:29 UTC (permalink / raw) To: Ralf Baechle; +Cc: linux-arch, linux-kernel, dann frazier, linux-mips On Wed, 25 Mar 2009 01:15:55 +0100 Ralf Baechle <ralf@linux-mips.org> wrote: > Signed-off-by: Ralf Baechle <ralf@linux-mips.org> > > arch/mips/kernel/linux32.c | 7 ------- > arch/mips/kernel/scall64-o32.S | 2 +- > 2 files changed, 1 insertions(+), 8 deletions(-) > > diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c > index 49aac6e..ab2da41 100644 > --- a/arch/mips/kernel/linux32.c > +++ b/arch/mips/kernel/linux32.c > @@ -133,13 +133,6 @@ SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy, > return sys_ftruncate(fd, merge_64(a2, a3)); > } > > -SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, > - unsigned long, offset_low, loff_t __user *, result, > - unsigned long, origin) > -{ > - return sys_llseek(fd, offset_high, offset_low, result, origin); > -} > - Ah.. this hunk seems to be the origin of the bug. git commit dbda6ac0897603f6c6dfadbbc37f9882177ec7ac "MIPS: CVE-2009-0029: Enable syscall wrappers." contains this: -asmlinkage int sys32_llseek(unsigned int fd, unsigned int offset_high, - unsigned int offset_low, loff_t __user * result, - unsigned int origin) +SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, + unsigned long, offset_low, loff_t __user *, result, + unsigned long, origin) Here you converted offset_low from unsigned int to unsigned long. Hence you lost the clearing of the upper 32 bits. That would explain the bug. Any chance the process where the bug was seen was a compat process? Patch below would probably fix it. Btw. there are a lot of int->long conversions in the git commit mentioned above. AFAICS all(?) of the conversions are wrong. diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c index 1a86f84..5abcc7f 100644 --- a/arch/mips/kernel/linux32.c +++ b/arch/mips/kernel/linux32.c @@ -134,9 +134,9 @@ SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy, return sys_ftruncate(fd, merge_64(a2, a3)); } -SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, - unsigned long, offset_low, loff_t __user *, result, - unsigned long, origin) +SYSCALL_DEFINE5(32_llseek, unsigned int, fd, unsigned int, offset_high, + unsigned int, offset_low, loff_t __user *, result, + unsigned int, origin) { return sys_llseek(fd, offset_high, offset_low, result, origin); } ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] MIPS: o32: Get rid of useless wrapper for llseek 2009-03-25 17:29 ` Heiko Carstens 2009-03-25 17:29 ` Heiko Carstens @ 2009-03-25 19:28 ` dann frazier 1 sibling, 0 replies; 5+ messages in thread From: dann frazier @ 2009-03-25 19:28 UTC (permalink / raw) To: Heiko Carstens; +Cc: Ralf Baechle, linux-arch, linux-kernel, linux-mips On Wed, Mar 25, 2009 at 06:29:05PM +0100, Heiko Carstens wrote: > On Wed, 25 Mar 2009 01:15:55 +0100 > Ralf Baechle <ralf@linux-mips.org> wrote: > > > Signed-off-by: Ralf Baechle <ralf@linux-mips.org> > > > > arch/mips/kernel/linux32.c | 7 ------- > > arch/mips/kernel/scall64-o32.S | 2 +- > > 2 files changed, 1 insertions(+), 8 deletions(-) > > > > diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c > > index 49aac6e..ab2da41 100644 > > --- a/arch/mips/kernel/linux32.c > > +++ b/arch/mips/kernel/linux32.c > > @@ -133,13 +133,6 @@ SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy, > > return sys_ftruncate(fd, merge_64(a2, a3)); > > } > > > > -SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, > > - unsigned long, offset_low, loff_t __user *, result, > > - unsigned long, origin) > > -{ > > - return sys_llseek(fd, offset_high, offset_low, result, origin); > > -} > > - > > Ah.. this hunk seems to be the origin of the bug. git commit > dbda6ac0897603f6c6dfadbbc37f9882177ec7ac "MIPS: CVE-2009-0029: Enable > syscall wrappers." contains this: > > -asmlinkage int sys32_llseek(unsigned int fd, unsigned int offset_high, > - unsigned int offset_low, loff_t __user * result, > - unsigned int origin) > +SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, > + unsigned long, offset_low, loff_t __user *, result, > + unsigned long, origin) > > Here you converted offset_low from unsigned int to unsigned long. Hence > you lost the clearing of the upper 32 bits. That would explain the bug. > Any chance the process where the bug was seen was a compat process? $ file /sbin/e2fsck /sbin/e2fsck: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.8, with unknown capability 0x41000000 = 0xf676e75, stripped > Patch below would probably fix it. This patch works for me on the aforementioned Debian system. > Btw. there are a lot of int->long conversions in the git commit > mentioned above. AFAICS all(?) of the conversions are wrong. > diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c > index 1a86f84..5abcc7f 100644 > --- a/arch/mips/kernel/linux32.c > +++ b/arch/mips/kernel/linux32.c > @@ -134,9 +134,9 @@ SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy, > return sys_ftruncate(fd, merge_64(a2, a3)); > } > > -SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, > - unsigned long, offset_low, loff_t __user *, result, > - unsigned long, origin) > +SYSCALL_DEFINE5(32_llseek, unsigned int, fd, unsigned int, offset_high, > + unsigned int, offset_low, loff_t __user *, result, > + unsigned int, origin) > { > return sys_llseek(fd, offset_high, offset_low, result, origin); > } > -- dann frazier ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] MIPS: o32: Get rid of useless wrapper for llseek 2009-03-25 0:15 [PATCH 2/2] MIPS: o32: Get rid of useless wrapper for llseek Ralf Baechle 2009-03-25 17:29 ` Heiko Carstens @ 2009-03-25 19:29 ` dann frazier 1 sibling, 0 replies; 5+ messages in thread From: dann frazier @ 2009-03-25 19:29 UTC (permalink / raw) To: Ralf Baechle; +Cc: linux-arch, linux-kernel, linux-mips On Wed, Mar 25, 2009 at 01:15:55AM +0100, Ralf Baechle wrote: > Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Tested-by: dann frazier <dannf@debian.org> > arch/mips/kernel/linux32.c | 7 ------- > arch/mips/kernel/scall64-o32.S | 2 +- > 2 files changed, 1 insertions(+), 8 deletions(-) > > diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c > index 49aac6e..ab2da41 100644 > --- a/arch/mips/kernel/linux32.c > +++ b/arch/mips/kernel/linux32.c > @@ -133,13 +133,6 @@ SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy, > return sys_ftruncate(fd, merge_64(a2, a3)); > } > > -SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high, > - unsigned long, offset_low, loff_t __user *, result, > - unsigned long, origin) > -{ > - return sys_llseek(fd, offset_high, offset_low, result, origin); > -} > - > /* From the Single Unix Spec: pread & pwrite act like lseek to pos + op + > lseek back to original location. They fail just like lseek does on > non-seekable files. */ > diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S > index b0fef4f..d928614 100644 > --- a/arch/mips/kernel/scall64-o32.S > +++ b/arch/mips/kernel/scall64-o32.S > @@ -343,7 +343,7 @@ sys_call_table: > PTR sys_ni_syscall /* for afs_syscall */ > PTR sys_setfsuid > PTR sys_setfsgid > - PTR sys_32_llseek /* 4140 */ > + PTR sys_llseek /* 4140 */ > PTR compat_sys_getdents > PTR compat_sys_select > PTR sys_flock > -- dann frazier ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2009-03-25 19:29 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2009-03-25 0:15 [PATCH 2/2] MIPS: o32: Get rid of useless wrapper for llseek Ralf Baechle 2009-03-25 17:29 ` Heiko Carstens 2009-03-25 17:29 ` Heiko Carstens 2009-03-25 19:28 ` dann frazier 2009-03-25 19:29 ` dann frazier
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox