Commit f48f01a9 authored by Sami Tolvanen's avatar Sami Tolvanen Committed by Ingo Molnar
Browse files

syscalls/x86: Use the correct function type for sys_ni_syscall 



Use the correct function type for sys_ni_syscall() in system
call tables to fix indirect call mismatches with Control-Flow
Integrity (CFI) checking.

Signed-off-by: default avatarSami Tolvanen <samitolvanen@google.com>
Acked-by: default avatarAndy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: H . Peter Anvin <hpa@zytor.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20191008224049.115427-5-samitolvanen@google.com


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 00198a6e

arch/x86/entry/syscall_32.c

+3 −5
Original line number Diff line number Diff line
@@ -10,13 +10,11 @@ 
#ifdef CONFIG_IA32_EMULATION

/* On X86_64, we use struct pt_regs * to pass parameters to syscalls */

#define __SYSCALL_I386(nr, sym, qual) extern asmlinkage long sym(const struct pt_regs *);



/* this is a lie, but it does not hurt as sys_ni_syscall just returns -EINVAL */

extern asmlinkage long sys_ni_syscall(const struct pt_regs *);



#define __sys_ni_syscall __ia32_sys_ni_syscall

#else /* CONFIG_IA32_EMULATION */

#define __SYSCALL_I386(nr, sym, qual) extern asmlinkage long sym(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);

extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);

#define __sys_ni_syscall sys_ni_syscall

#endif /* CONFIG_IA32_EMULATION */



#include <asm/syscalls_32.h>
@@ -29,6 +27,6 @@ __visible const sys_call_ptr_t ia32_sys_call_table[__NR_syscall_compat_max+1] = 
	 * Smells like a compiler bug -- it doesn't work

	 * when the & below is removed.

	 */

	[0 ... __NR_syscall_compat_max] = &sys_ni_syscall,

	[0 ... __NR_syscall_compat_max] = &__sys_ni_syscall,

#include <asm/syscalls_32.h>

};

arch/x86/entry/syscall_64.c

+10 −4
Original line number Diff line number Diff line
@@ -4,11 +4,17 @@ 
#include <linux/linkage.h>

#include <linux/sys.h>

#include <linux/cache.h>

#include <linux/syscalls.h>

#include <asm/asm-offsets.h>

#include <asm/syscall.h>



/* this is a lie, but it does not hurt as sys_ni_syscall just returns -EINVAL */

extern asmlinkage long sys_ni_syscall(const struct pt_regs *);

extern asmlinkage long sys_ni_syscall(void);



SYSCALL_DEFINE0(ni_syscall)

{

	return sys_ni_syscall();

}



#define __SYSCALL_64(nr, sym, qual) extern asmlinkage long sym(const struct pt_regs *);

#define __SYSCALL_X32(nr, sym, qual) __SYSCALL_64(nr, sym, qual)

#include <asm/syscalls_64.h>
@@ -23,7 +29,7 @@ asmlinkage const sys_call_ptr_t sys_call_table[__NR_syscall_max+1] = { 
	 * Smells like a compiler bug -- it doesn't work

	 * when the & below is removed.

	 */

	[0 ... __NR_syscall_max] = &sys_ni_syscall,

	[0 ... __NR_syscall_max] = &__x64_sys_ni_syscall,

#include <asm/syscalls_64.h>

};
@@ -40,7 +46,7 @@ asmlinkage const sys_call_ptr_t x32_sys_call_table[__NR_syscall_x32_max+1] = { 
	 * Smells like a compiler bug -- it doesn't work

	 * when the & below is removed.

	 */

	[0 ... __NR_syscall_x32_max] = &sys_ni_syscall,

	[0 ... __NR_syscall_x32_max] = &__x64_sys_ni_syscall,

#include <asm/syscalls_64.h>

};

arch/x86/entry/syscalls/syscall_32.tbl

+2 −2
Original line number Diff line number Diff line
@@ -124,7 +124,7 @@ 
110	i386	iopl			sys_iopl			__ia32_sys_iopl

111	i386	vhangup			sys_vhangup			__ia32_sys_vhangup

112	i386	idle

113	i386	vm86old			sys_vm86old			sys_ni_syscall

113	i386	vm86old			sys_vm86old			__ia32_sys_ni_syscall

114	i386	wait4			sys_wait4			__ia32_compat_sys_wait4

115	i386	swapoff			sys_swapoff			__ia32_sys_swapoff

116	i386	sysinfo			sys_sysinfo			__ia32_compat_sys_sysinfo
@@ -177,7 +177,7 @@ 
163	i386	mremap			sys_mremap			__ia32_sys_mremap

164	i386	setresuid		sys_setresuid16			__ia32_sys_setresuid16

165	i386	getresuid		sys_getresuid16			__ia32_sys_getresuid16

166	i386	vm86			sys_vm86			sys_ni_syscall

166	i386	vm86			sys_vm86			__ia32_sys_ni_syscall

167	i386	query_module

168	i386	poll			sys_poll			__ia32_sys_poll

169	i386	nfsservctl

CRA Git | Maintained and supported by SUSTech CRA and CCSE