From: "H. Peter Anvin" <h...@linux.intel.com>
Provide ptrace/regset access to the LDT, if one exists. This
interface provides both read and write access. The write code is
unified with modify_ldt(); the read code doesn't have enough
similarity so it has been kept made separate.
Signed-off-by: H. Peter Anvin (Intel) <h...@zytor.com>
Cc: Ingo Molnar <mi...@kernel.org>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Andy Lutomirski <l...@kernel.org>
Cc: Chang S. Bae <chang.seok....@intel.com>
Cc: Markus T. Metzger <markus.t.metz...@intel.com>
---
arch/x86/include/asm/desc.h | 2 +-
arch/x86/include/asm/ldt.h | 16 ++++
arch/x86/kernel/ldt.c | 209 +++++++++++++++++++++++++++++++++++---------
arch/x86/kernel/ptrace.c | 20 +++++
include/uapi/linux/elf.h | 1 +
5 files changed, 204 insertions(+), 44 deletions(-)
create mode 100644 arch/x86/include/asm/ldt.h
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index 5e69f993c9ff..12a759d76314 100644
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -3,7 +3,7 @@
#define _ASM_X86_DESC_H
#include <asm/desc_defs.h>
-#include <asm/ldt.h>
+#include <uapi/asm/ldt.h>
#include <asm/mmu.h>
#include <asm/fixmap.h>
#include <asm/irq_vectors.h>
diff --git a/arch/x86/include/asm/ldt.h b/arch/x86/include/asm/ldt.h
new file mode 100644
index 000000000000..302ec2d6d45d
--- /dev/null
+++ b/arch/x86/include/asm/ldt.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Ptrace interface to the LDT
+ *
+ */
+
+#ifndef _ARCH_X86_INCLUDE_ASM_LDT_H
+
+#include <linux/regset.h>
+#include <uapi/asm/ldt.h>
+
+extern user_regset_active_fn regset_ldt_active;
+extern user_regset_get_fn regset_ldt_get;
+extern user_regset_set_fn regset_ldt_set;
+
+#endif /* _ARCH_X86_INCLUDE_ASM_LDT_H */
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index 601d24268a99..e80dfde1f82f 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -392,53 +392,39 @@ static int read_default_ldt(void __user *ptr, unsigned
long bytecount)
return bytecount;
}
-static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+
+static int do_write_ldt(const struct task_struct *target,
+ const void *kbuf, const void __user *ubuf,
+ unsigned long bytecount, unsigned int index,
+ bool oldmode)
{
- struct mm_struct *mm = current->mm;
+ struct mm_struct *mm = target->mm;
struct ldt_struct *new_ldt, *old_ldt;
- unsigned int old_nr_entries, new_nr_entries;
+ unsigned int count, old_nr_entries, new_nr_entries;
struct user_desc ldt_info;
+ const struct user_desc *kptr = kbuf;
+ const struct user_desc __user *uptr = ubuf;
struct desc_struct ldt;
+ unsigned short first_index, last_index;
int error;
- error = -EINVAL;
- if (bytecount != sizeof(ldt_info))
- goto out;
- error = -EFAULT;
- if (copy_from_user(&ldt_info, ptr, sizeof(ldt_info)))
- goto out;
+ if (bytecount % sizeof(ldt_info) ||
+ bytecount >= LDT_ENTRY_SIZE*LDT_ENTRIES)
+ return -EINVAL;
- error = -EINVAL;
- if (ldt_info.entry_number >= LDT_ENTRIES)
- goto out;
- if (ldt_info.contents == 3) {
- if (oldmode)
- goto out;
- if (ldt_info.seg_not_present == 0)
- goto out;
- }
+ count = bytecount/sizeof(ldt_info);
+ if (index >= LDT_ENTRIES || index + count > LDT_ENTRIES)
+ return -EINVAL;
- if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) ||
- LDT_empty(&ldt_info)) {
- /* The user wants to clear the entry. */
- memset(&ldt, 0, sizeof(ldt));
- } else {
- if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
- error = -EINVAL;
- goto out;
- }
-
- fill_ldt(&ldt, &ldt_info);
- if (oldmode)
- ldt.avl = 0;
- }
+ first_index = index;
+ last_index = index + count - 1;
if (down_write_killable(&mm->context.ldt_usr_sem))
return -EINTR;
- old_ldt = mm->context.ldt;
+ old_ldt = mm->context.ldt;
old_nr_entries = old_ldt ? old_ldt->nr_entries : 0;
- new_nr_entries = max(ldt_info.entry_number + 1, old_nr_entries);
+ new_nr_entries = max(index + count, old_nr_entries);
error = -ENOMEM;
new_ldt = alloc_ldt_struct(new_nr_entries);
@@ -446,9 +432,46 @@ static int write_ldt(void __user *ptr, unsigned long
bytecount, int oldmode)
goto out_unlock;
if (old_ldt)
- memcpy(new_ldt->entries, old_ldt->entries, old_nr_entries *
LDT_ENTRY_SIZE);
+ memcpy(new_ldt->entries, old_ldt->entries,
+ old_nr_entries * LDT_ENTRY_SIZE);
+
+ while (count--) {
+ error = -EFAULT;
+ if (kptr) {
+ memcpy(&ldt_info, kptr++, sizeof(ldt_info));
+ } else {
+ if (__copy_from_user(&ldt_info, uptr++,
+ sizeof(ldt_info)))
+ goto out_free;
+ }
+
+ error = -EINVAL;
+ if (ldt_info.contents == 3) {
+ if (oldmode)
+ goto out_free;
+ if (ldt_info.seg_not_present == 0)
+ goto out_free;
+ }
+
+ if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) ||
+ LDT_empty(&ldt_info)) {
+ /* The user wants to clear the entry. */
+ memset(&ldt, 0, sizeof(ldt));
+ } else {
+ if (!IS_ENABLED(CONFIG_X86_16BIT) &&
+ !ldt_info.seg_32bit) {
+ error = -EINVAL;
+ goto out_free;
+ }
+ }
+
+ fill_ldt(&ldt, &ldt_info);
+ if (oldmode)
+ ldt.avl = 0;
+
+ new_ldt->entries[index++] = ldt;
+ }
- new_ldt->entries[ldt_info.entry_number] = ldt;
finalize_ldt_struct(new_ldt);
/*
@@ -466,20 +489,41 @@ static int write_ldt(void __user *ptr, unsigned long
bytecount, int oldmode)
*/
if (!WARN_ON_ONCE(old_ldt))
free_ldt_pgtables(mm);
- free_ldt_struct(new_ldt);
- goto out_unlock;
+ goto out_free;
}
- install_ldt(mm, new_ldt, ldt_info.entry_number, ldt_info.entry_number);
- free_ldt_struct(old_ldt);
+ install_ldt(mm, new_ldt, first_index, last_index);
+
+ /* Success! */
+ new_ldt = old_ldt; /* Free the old LDT, not the new one */
error = 0;
+out_free:
+ free_ldt_struct(new_ldt);
out_unlock:
up_write(&mm->context.ldt_usr_sem);
-out:
return error;
}
+static int write_ldt(void __user *ptr, unsigned long bytecount, bool oldmode)
+{
+ struct user_desc ldt_info;
+
+ /*
+ * We have to read the LDT entry number from the structure
+ * ahead of time, so it is not practical to allow more than
+ * one update here.
+ */
+ if (bytecount != sizeof(ldt_info))
+ return -EINVAL;
+
+ if (copy_from_user(&ldt_info, ptr, sizeof(ldt_info)))
+ return -EFAULT;
+
+ return do_write_ldt(current, &ldt_info, NULL, sizeof(ldt_info),
+ ldt_info.entry_number, oldmode);
+}
+
SYSCALL_DEFINE3(modify_ldt, int , func , void __user * , ptr ,
unsigned long , bytecount)
{
@@ -490,13 +534,13 @@ SYSCALL_DEFINE3(modify_ldt, int , func , void __user * ,
ptr ,
ret = read_ldt(ptr, bytecount);
break;
case 1:
- ret = write_ldt(ptr, bytecount, 1);
+ ret = write_ldt(ptr, bytecount, true);
break;
case 2:
ret = read_default_ldt(ptr, bytecount);
break;
case 0x11:
- ret = write_ldt(ptr, bytecount, 0);
+ ret = write_ldt(ptr, bytecount, false);
break;
}
/*
@@ -510,3 +554,82 @@ SYSCALL_DEFINE3(modify_ldt, int , func , void __user * ,
ptr ,
*/
return (unsigned int)ret;
}
+
+int regset_ldt_active(struct task_struct *target,
+ const struct user_regset *regset)
+{
+ struct mm_struct *mm = target->mm;
+ const struct desc_struct *p;
+ int n;
+
+ down_read(&mm->context.ldt_usr_sem);
+
+ if (!mm->context.ldt) {
+ n = 0;
+ } else {
+ n = mm->context.ldt->nr_entries;
+ p = mm->context.ldt->entries + n;
+ while (n > 0 && desc_empty(--p))
+ n--;
+ }
+
+ up_read(&mm->context.ldt_usr_sem);
+ return n;
+}
+
+int regset_ldt_get(struct task_struct *target,
+ const struct user_regset *regset,
+ unsigned int pos, unsigned int count,
+ void *kbuf, void __user *ubuf)
+{
+ struct mm_struct *mm = target->mm;
+ const struct desc_struct *p;
+ struct user_desc udesc;
+ unsigned int index, nr_entries;
+ int err = 0;
+
+ if (pos % sizeof(struct user_desc))
+ return -EINVAL;
+
+ index = pos/sizeof(struct user_desc);
+
+ down_read(&mm->context.ldt_usr_sem);
+
+ if (!mm->context.ldt) {
+ nr_entries = 0;
+ p = NULL;
+ } else {
+ nr_entries = mm->context.ldt->nr_entries;
+ p = mm->context.ldt->entries + index;
+ }
+
+ while (count >= sizeof(struct user_desc) && index < nr_entries) {
+ fill_user_desc(&udesc, index++, p++);
+ err = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
+ &udesc, pos, pos + sizeof(udesc));
+ if (err)
+ goto out_unlock;
+ }
+
+
+ up_read(&mm->context.ldt_usr_sem);
+
+ return user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf,
+ nr_entries*sizeof(struct user_desc),
+ LDT_ENTRIES*sizeof(struct user_desc));
+out_unlock:
+ up_read(&mm->context.ldt_usr_sem);
+ return err;
+}
+
+int regset_ldt_set(struct task_struct *target,
+ const struct user_regset *regset,
+ unsigned int pos, unsigned int count,
+ const void *kbuf, const void __user *ubuf)
+{
+ if (pos % sizeof(struct user_desc))
+ return -EINVAL;
+
+ pos /= sizeof(struct user_desc);
+ return do_write_ldt(target, kbuf, ubuf, count, pos, false);
+}
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 5ce10310f440..4400ef506b5d 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1340,6 +1340,16 @@ static struct user_regset x86_64_regsets[]
__ro_after_init = {
.active = gdt_active, .get = gdt_get,
.set = regset_gdt_set
},
+#ifdef CONFIG_MODIFY_LDT_SYSCALL
+ [REGSET_LDT] = {
+ .core_note_type = NT_X86_LDT,
+ .n = LDT_ENTRIES,
+ .size = sizeof(struct user_desc),
+ .align = sizeof(struct user_desc),
+ .active = regset_ldt_active, .get = regset_ldt_get,
+ .set = regset_ldt_set
+ },
+#endif
};
static const struct user_regset_view user_x86_64_view = {
@@ -1404,6 +1414,16 @@ static struct user_regset x86_32_regsets[]
__ro_after_init = {
.active = gdt_active,
.get = gdt_get, .set = regset_gdt_set
},
+#ifdef CONFIG_MODIFY_LDT_SYSCALL
+ [REGSET_LDT] = {
+ .core_note_type = NT_X86_LDT,
+ .n = LDT_ENTRIES,
+ .size = sizeof(struct user_desc),
+ .align = sizeof(struct user_desc),
+ .active = regset_ldt_active,
+ .get = regset_ldt_get, .set = regset_ldt_set
+ },
+#endif
};
static const struct user_regset_view user_x86_32_view = {
diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h
index 8c386906eba8..9d3564fd6daa 100644
--- a/include/uapi/linux/elf.h
+++ b/include/uapi/linux/elf.h
@@ -401,6 +401,7 @@ typedef struct elf64_shdr {
#define NT_386_IOPERM 0x201 /* x86 io permission bitmap (1=deny) */
#define NT_X86_XSTATE 0x202 /* x86 extended state using xsave */
#define NT_X86_GDT 0x203 /* x86 GDT content (user visible) */
+#define NT_X86_LDT 0x204 /* x86 LDT content (if any) */
#define NT_S390_HIGH_GPRS 0x300 /* s390 upper register halves */
#define NT_S390_TIMER 0x301 /* s390 timer register */
#define NT_S390_TODCMP 0x302 /* s390 TOD clock comparator register */
--
2.14.4
