Commit 2d9ca267 authored by Denis Efremov's avatar Denis Efremov Committed by Kees Cook
Browse files

seccomp: Use current_pt_regs() instead of task_pt_regs(current) 



As described in commit a3460a59 ("new helper: current_pt_regs()"):
- arch versions are "optimized versions".
- some architectures have task_pt_regs() working only for traced tasks
  blocked on signal delivery. current_pt_regs() needs to work for *all*
  processes.

In preparation for adding a coccinelle rule for using current_*(), instead
of raw accesses to current members, modify seccomp_do_user_notification(),
__seccomp_filter(), __secure_computing() to use current_pt_regs().

Signed-off-by: default avatarDenis Efremov <efremov@linux.com>
Link: https://lore.kernel.org/r/20200824125921.488311-1-efremov@linux.com


[kees: Reworded commit log, add comment to populate_seccomp_data()]
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 3932fcec

kernel/seccomp.c

+11 −7
Original line number Diff line number Diff line
@@ -196,6 +196,10 @@ struct seccomp_filter { 
 */

static void populate_seccomp_data(struct seccomp_data *sd)

{

	/*

	 * Instead of using current_pt_reg(), we're already doing the work

	 * to safely fetch "current", so just use "task" everywhere below.

	 */

	struct task_struct *task = current;

	struct pt_regs *regs = task_pt_regs(task);

	unsigned long args[6];
@@ -910,7 +914,7 @@ out: 
	if (flags & SECCOMP_USER_NOTIF_FLAG_CONTINUE)

		return 0;



	syscall_set_return_value(current, task_pt_regs(current),

	syscall_set_return_value(current, current_pt_regs(),

				 err, ret);

	return -1;

}
@@ -943,13 +947,13 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 
		/* Set low-order bits as an errno, capped at MAX_ERRNO. */

		if (data > MAX_ERRNO)

			data = MAX_ERRNO;

		syscall_set_return_value(current, task_pt_regs(current),

		syscall_set_return_value(current, current_pt_regs(),

					 -data, 0);

		goto skip;



	case SECCOMP_RET_TRAP:

		/* Show the handler the original registers. */

		syscall_rollback(current, task_pt_regs(current));

		syscall_rollback(current, current_pt_regs());

		/* Let the filter pass back 16 bits of data. */

		seccomp_send_sigsys(this_syscall, data);

		goto skip;
@@ -962,7 +966,7 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 
		/* ENOSYS these calls if there is no tracer attached. */

		if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {

			syscall_set_return_value(current,

						 task_pt_regs(current),

						 current_pt_regs(),

						 -ENOSYS, 0);

			goto skip;

		}
@@ -982,7 +986,7 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 
		if (fatal_signal_pending(current))

			goto skip;

		/* Check if the tracer forced the syscall to be skipped. */

		this_syscall = syscall_get_nr(current, task_pt_regs(current));

		this_syscall = syscall_get_nr(current, current_pt_regs());

		if (this_syscall < 0)

			goto skip;
@@ -1025,7 +1029,7 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd, 
			kernel_siginfo_t info;



			/* Show the original registers in the dump. */

			syscall_rollback(current, task_pt_regs(current));

			syscall_rollback(current, current_pt_regs());

			/* Trigger a manual coredump since do_exit skips it. */

			seccomp_init_siginfo(&info, this_syscall, data);

			do_coredump(&info);
@@ -1060,7 +1064,7 @@ int __secure_computing(const struct seccomp_data *sd) 
		return 0;



	this_syscall = sd ? sd->nr :

		syscall_get_nr(current, task_pt_regs(current));

		syscall_get_nr(current, current_pt_regs());



	switch (mode) {

	case SECCOMP_MODE_STRICT:

CRA Git | Maintained and supported by SUSTech CRA and CCSE