[PATCH v2 0/3] arm, arm64: check for number of arguments in syscall_get/set_arguments()

[PATCH v2 0/3] arm, arm64: check for number of arguments in syscall_get/set_arguments()

[AKASHI Takahiro]

# added Roland <mcgrathr@chromium> in CC for asm-generic/syscall.h

I modified my patch based on Will's comments.
Speaking of arm, i + n is checked against SYSCALL_MAX_ARGS (== 7),
but it seems that the kernel code assumes that the current max number of
arguments would be 6. For example, SYSCALL_DEFINEn are defined from 0 to 6.
Am i wrong?

Changes:
  * added a patch to arm as well
  * added a patch to asm-generic/syscall.h; corrected the description on
    syscall_get_arguments() and syscall_put_arguments()
  * removed portion of commit message which referred to asm-generic/syscall.h
    in arm64

AKASHI Takahiro (3):
  arm64: check for number of arguments in syscall_get/set_arguments()
  arm: check for number of arguments in syscall_get/set_arguments()
  asm-generic: syscall_get/set_arguments accept zero for number of
    arguments

 arch/arm/include/asm/syscall.h   |    6 ++++++
 arch/arm64/include/asm/syscall.h |    6 ++++++
 include/asm-generic/syscall.h    |    4 ++--
 3 files changed, 14 insertions(+), 2 deletions(-)

-- 
1.7.9.5

[PATCH v2 1/3] arm64: check for number of arguments in syscall_get/set_arguments()

[AKASHI Takahiro]

In ftrace_syscall_enter(),
    syscall_get_arguments(..., 0, n, ...)
        if (i == 0) { <handle orig_x0> ...; n--;}
        memcpy(..., n * sizeof(args[0]));
If 'number of arguments(n)' is zero and 'argument index(i)' is also zero in
syscall_get_arguments(), none of arguments should be copied by memcpy().
Otherwise 'n--' can be a big positive number and unexpected amount of data
will be copied. Tracing system calls which take no argument, say sync(void),
may hit this case and eventually make the system corrupted.
This patch fixes the issue both in syscall_get_arguments() and
syscall_set_arguments().

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
---
 arch/arm64/include/asm/syscall.h |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
index c89821f..01bb8cc 100644
--- a/arch/arm64/include/asm/syscall.h
+++ b/arch/arm64/include/asm/syscall.h
@@ -63,6 +63,9 @@ static inline void syscall_get_arguments(struct task_struct *task,
 					 unsigned int i, unsigned int n,
 					 unsigned long *args)
 {
+	if (n == 0)
+		return;
+
 	if (i + n > SYSCALL_MAX_ARGS) {
 		unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
 		unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
@@ -86,6 +89,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
 					 unsigned int i, unsigned int n,
 					 const unsigned long *args)
 {
+	if (n == 0)
+		return;
+
 	if (i + n > SYSCALL_MAX_ARGS) {
 		pr_warning("%s called with max args %d, handling only %d\n",
 			   __func__, i + n, SYSCALL_MAX_ARGS);
-- 
1.7.9.5

[PATCH v2 1/3] arm64: check for number of arguments in syscall_get/set_arguments()

[Will Deacon]

On Thu, Oct 03, 2013 at 06:47:44AM +0100, AKASHI Takahiro wrote:
> In ftrace_syscall_enter(),
>     syscall_get_arguments(..., 0, n, ...)
>         if (i == 0) { <handle orig_x0> ...; n--;}
>         memcpy(..., n * sizeof(args[0]));
> If 'number of arguments(n)' is zero and 'argument index(i)' is also zero in
> syscall_get_arguments(), none of arguments should be copied by memcpy().
> Otherwise 'n--' can be a big positive number and unexpected amount of data
> will be copied. Tracing system calls which take no argument, say sync(void),
> may hit this case and eventually make the system corrupted.
> This patch fixes the issue both in syscall_get_arguments() and
> syscall_set_arguments().
> 
> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>

Acked-by: Will Deacon <will.deacon@arm.com>

Cheers,

Will

[PATCH v2 2/3] arm: check for number of arguments in syscall_get/set_arguments()

[AKASHI Takahiro]

In ftrace_syscall_enter(),
    syscall_get_arguments(..., 0, n, ...)
        if (i == 0) { <handle ORIG_r0> ...; n--;}
        memcpy(..., n * sizeof(args[0]));
If 'number of arguments(n)' is zero and 'argument index(i)' is also zero in
syscall_get_arguments(), none of arguments should be copied by memcpy().
Otherwise 'n--' can be a big positive number and unexpected amount of data
will be copied. Tracing system calls which take no argument, say sync(void),
may hit this case and eventually make the system corrupted.
This patch fixes the issue both in syscall_get_arguments() and
syscall_set_arguments().

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
---
 arch/arm/include/asm/syscall.h |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h
index f1d96d4..73ddd72 100644
--- a/arch/arm/include/asm/syscall.h
+++ b/arch/arm/include/asm/syscall.h
@@ -57,6 +57,9 @@ static inline void syscall_get_arguments(struct task_struct *task,
 					 unsigned int i, unsigned int n,
 					 unsigned long *args)
 {
+	if (n == 0)
+		return;
+
 	if (i + n > SYSCALL_MAX_ARGS) {
 		unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
 		unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
@@ -81,6 +84,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
 					 unsigned int i, unsigned int n,
 					 const unsigned long *args)
 {
+	if (n == 0)
+		return;
+
 	if (i + n > SYSCALL_MAX_ARGS) {
 		pr_warning("%s called with max args %d, handling only %d\n",
 			   __func__, i + n, SYSCALL_MAX_ARGS);
-- 
1.7.9.5

[PATCH v2 2/3] arm: check for number of arguments in syscall_get/set_arguments()

[Will Deacon]

On Thu, Oct 03, 2013 at 06:47:45AM +0100, AKASHI Takahiro wrote:
> In ftrace_syscall_enter(),
>     syscall_get_arguments(..., 0, n, ...)
>         if (i == 0) { <handle ORIG_r0> ...; n--;}
>         memcpy(..., n * sizeof(args[0]));
> If 'number of arguments(n)' is zero and 'argument index(i)' is also zero in
> syscall_get_arguments(), none of arguments should be copied by memcpy().
> Otherwise 'n--' can be a big positive number and unexpected amount of data
> will be copied. Tracing system calls which take no argument, say sync(void),
> may hit this case and eventually make the system corrupted.
> This patch fixes the issue both in syscall_get_arguments() and
> syscall_set_arguments().
> 
> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
> ---
>  arch/arm/include/asm/syscall.h |    6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h
> index f1d96d4..73ddd72 100644
> --- a/arch/arm/include/asm/syscall.h
> +++ b/arch/arm/include/asm/syscall.h
> @@ -57,6 +57,9 @@ static inline void syscall_get_arguments(struct task_struct *task,
>  					 unsigned int i, unsigned int n,
>  					 unsigned long *args)
>  {
> +	if (n == 0)
> +		return;
> +
>  	if (i + n > SYSCALL_MAX_ARGS) {
>  		unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
>  		unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
> @@ -81,6 +84,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
>  					 unsigned int i, unsigned int n,
>  					 const unsigned long *args)
>  {
> +	if (n == 0)
> +		return;
> +
>  	if (i + n > SYSCALL_MAX_ARGS) {
>  		pr_warning("%s called with max args %d, handling only %d\n",
>  			   __func__, i + n, SYSCALL_MAX_ARGS);

  Acked-by: Will Deacon <will.deacon@arm.com>

Please can you put this into the patch system, with a CC stable tag?

Will

[PATCH v2 3/3] asm-generic: syscall_get/set_arguments accept zero for number of arguments

[AKASHI Takahiro]

There is a possibility of calling syscall_get_arguments() with zero as
'number of arguments(n)' in ftrace_syscall_enter().
The comments in syscall_get_argumets() as well as syscall_set_arugments()
are corrected to clarify that.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
---
 include/asm-generic/syscall.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/asm-generic/syscall.h b/include/asm-generic/syscall.h
index 5b09392..49b35ab 100644
--- a/include/asm-generic/syscall.h
+++ b/include/asm-generic/syscall.h
@@ -106,7 +106,7 @@ void syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
  * @task:	task of interest, must be blocked
  * @regs:	task_pt_regs() of @task
  * @i:		argument index [0,5]
- * @n:		number of arguments; n+i must be [1,6].
+ * @n:		number of arguments; n+i must be [0,6].
  * @args:	array filled with argument values
  *
  * Fetches @n arguments to the system call starting with the @i'th argument
@@ -126,7 +126,7 @@ void syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
  * @task:	task of interest, must be in system call entry tracing
  * @regs:	task_pt_regs() of @task
  * @i:		argument index [0,5]
- * @n:		number of arguments; n+i must be [1,6].
+ * @n:		number of arguments; n+i must be [0,6].
  * @args:	array of argument values to store
  *
  * Changes @n arguments to the system call starting with the @i'th argument.
-- 
1.7.9.5

[PATCH v2 3/3] asm-generic: syscall_get/set_arguments accept zero for number of arguments

[Will Deacon]

[extending CC list to add the ftrace guys]

On Thu, Oct 03, 2013 at 06:47:46AM +0100, AKASHI Takahiro wrote:
> There is a possibility of calling syscall_get_arguments() with zero as
> 'number of arguments(n)' in ftrace_syscall_enter().
> The comments in syscall_get_argumets() as well as syscall_set_arugments()
> are corrected to clarify that.

Probably also worth mentioning that all architectures deal with n + i == 0
(after your first two patches fixing up arm and arm64, anyway).

> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
> ---
>  include/asm-generic/syscall.h |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/include/asm-generic/syscall.h b/include/asm-generic/syscall.h
> index 5b09392..49b35ab 100644
> --- a/include/asm-generic/syscall.h
> +++ b/include/asm-generic/syscall.h
> @@ -106,7 +106,7 @@ void syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
>   * @task:	task of interest, must be blocked
>   * @regs:	task_pt_regs() of @task
>   * @i:		argument index [0,5]
> - * @n:		number of arguments; n+i must be [1,6].
> + * @n:		number of arguments; n+i must be [0,6].
>   * @args:	array filled with argument values
>   *
>   * Fetches @n arguments to the system call starting with the @i'th argument
> @@ -126,7 +126,7 @@ void syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
>   * @task:	task of interest, must be in system call entry tracing
>   * @regs:	task_pt_regs() of @task
>   * @i:		argument index [0,5]
> - * @n:		number of arguments; n+i must be [1,6].
> + * @n:		number of arguments; n+i must be [0,6].
>   * @args:	array of argument values to store
>   *
>   * Changes @n arguments to the system call starting with the @i'th argument.

Acked-by: Will Deacon <will.deacon@arm.com>

Will

[PATCH v2 0/3] arm, arm64: check for number of arguments in syscall_get/set_arguments()

[Will Deacon]

On Thu, Oct 03, 2013 at 06:47:43AM +0100, AKASHI Takahiro wrote:
> # added Roland <mcgrathr@chromium> in CC for asm-generic/syscall.h
> 
> I modified my patch based on Will's comments.
> Speaking of arm, i + n is checked against SYSCALL_MAX_ARGS (== 7),
> but it seems that the kernel code assumes that the current max number of
> arguments would be 6. For example, SYSCALL_DEFINEn are defined from 0 to 6.
> Am i wrong?

We do have a 7 argument syscall on OABI ARM. See the original thread:

  http://lists.infradead.org/pipermail/linux-arm-kernel/2012-February/085509.html

Will