CVS commit: [netbsd-6-0] src/sys/compat/linux/arch/amd64

[Soren Jacobsen]

Module Name:src
Committed By:   snj
Date:   Tue Feb 14 16:57:57 UTC 2017

Modified Files:
src/sys/compat/linux/arch/amd64 [netbsd-6-0]: linux_machdep.c

Log Message:
Pull up following revision(s) (requested by maxv in ticket #1433):
sys/compat/linux/arch/amd64/linux_machdep.c: 1.50, 1.51
Don't let userland choose %rip. This is the Intel Sysret vulnerability
again.
--
Make sure %rip is in userland. This is harmless, since the return to
userland is made with iret instead of sysret in this path. While here, use
size_t.


To generate a diff of this commit:
cvs rdiff -u -r1.39 -r1.39.10.1 \
src/sys/compat/linux/arch/amd64/linux_machdep.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/linux/arch/amd64/linux_machdep.c
diff -u src/sys/compat/linux/arch/amd64/linux_machdep.c:1.39 src/sys/compat/linux/arch/amd64/linux_machdep.c:1.39.10.1
--- src/sys/compat/linux/arch/amd64/linux_machdep.c:1.39	Fri Nov 18 04:07:43 2011
+++ src/sys/compat/linux/arch/amd64/linux_machdep.c	Tue Feb 14 16:57:57 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: linux_machdep.c,v 1.39 2011/11/18 04:07:43 christos Exp $ */
+/*	$NetBSD: linux_machdep.c,v 1.39.10.1 2017/02/14 16:57:57 snj Exp $ */
 
 /*-
  * Copyright (c) 2005 Emmanuel Dreyfus, all rights reserved.
@@ -33,7 +33,7 @@
 
 #include 
 
-__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.39 2011/11/18 04:07:43 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.39.10.1 2017/02/14 16:57:57 snj Exp $");
 
 #include 
 #include 
@@ -254,7 +254,12 @@ linux_sendsig(const ksiginfo_t *ksi, con
 	if (error != 0) {
 		sigexit(l, SIGILL);
 		return;
-	}	
+	}
+
+	if ((vaddr_t)catcher >= VM_MAXUSER_ADDRESS) {
+		sigexit(l, SIGILL);
+		return;
+	}
 
 	linux_buildcontext(l, catcher, sp);
 	tf->tf_rdi = sigframe.info.lsi_signo;
@@ -485,7 +490,7 @@ linux_usertrap(struct lwp *l, vaddr_t tr
 {
 	struct trapframe *tf = arg;
 	uint64_t retaddr;
-	int vsyscallnr;
+	size_t vsyscallnr;
 
 	/*
 	 * Check for a vsyscall. %rip must be the fault address,
@@ -515,6 +520,8 @@ linux_usertrap(struct lwp *l, vaddr_t tr
 	 */
 	if (copyin((void *)tf->tf_rsp, , sizeof retaddr) != 0)
 		return 0;
+	if ((vaddr_t)retaddr >= VM_MAXUSER_ADDRESS)
+		return 0;
 	tf->tf_rip = retaddr;
 	tf->tf_rax = linux_vsyscall_to_syscall[vsyscallnr];
 	tf->tf_rsp += 8;	/* "pop" the return address */

CVS commit: [netbsd-6-0] src/sys/compat/linux/arch/amd64

[Soren Jacobsen]

Module Name:src
Committed By:   snj
Date:   Tue Feb 14 16:57:57 UTC 2017

Modified Files:
src/sys/compat/linux/arch/amd64 [netbsd-6-0]: linux_machdep.c

Log Message:
Pull up following revision(s) (requested by maxv in ticket #1433):
sys/compat/linux/arch/amd64/linux_machdep.c: 1.50, 1.51
Don't let userland choose %rip. This is the Intel Sysret vulnerability
again.
--
Make sure %rip is in userland. This is harmless, since the return to
userland is made with iret instead of sysret in this path. While here, use
size_t.


To generate a diff of this commit:
cvs rdiff -u -r1.39 -r1.39.10.1 \
src/sys/compat/linux/arch/amd64/linux_machdep.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: [netbsd-6-0] src/sys/compat/linux/arch

[Manuel Bouyer]

Module Name:src
Committed By:   bouyer
Date:   Sun Nov 15 20:42:37 UTC 2015

Modified Files:
src/sys/compat/linux/arch/arm [netbsd-6-0]: linux_ptrace.c
src/sys/compat/linux/arch/i386 [netbsd-6-0]: linux_ptrace.c
src/sys/compat/linux/arch/powerpc [netbsd-6-0]: linux_ptrace.c

Log Message:
Pull up following revision(s) (requested by pgoyette in ticket #1335):
sys/compat/linux/arch/i386/linux_ptrace.c: revision 1.31
sys/compat/linux/arch/arm/linux_ptrace.c: revision 1.19
sys/compat/linux/arch/powerpc/linux_ptrace.c: revision 1.29
Don't release proc_lock until we're done looking at things that are
protected by the lock, particularly p_stat and p_waited.  Found by
Robert Elz.
XXX Pullup to NetBSD-7, -6, -6-0, and -6-1


To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.16.18.1 src/sys/compat/linux/arch/arm/linux_ptrace.c
cvs rdiff -u -r1.26 -r1.26.20.1 src/sys/compat/linux/arch/i386/linux_ptrace.c
cvs rdiff -u -r1.23 -r1.23.20.1 \
src/sys/compat/linux/arch/powerpc/linux_ptrace.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

CVS commit: [netbsd-6-0] src/sys/compat/linux/arch

[Manuel Bouyer]

Module Name:src
Committed By:   bouyer
Date:   Sun Nov 15 20:42:37 UTC 2015

Modified Files:
src/sys/compat/linux/arch/arm [netbsd-6-0]: linux_ptrace.c
src/sys/compat/linux/arch/i386 [netbsd-6-0]: linux_ptrace.c
src/sys/compat/linux/arch/powerpc [netbsd-6-0]: linux_ptrace.c

Log Message:
Pull up following revision(s) (requested by pgoyette in ticket #1335):
sys/compat/linux/arch/i386/linux_ptrace.c: revision 1.31
sys/compat/linux/arch/arm/linux_ptrace.c: revision 1.19
sys/compat/linux/arch/powerpc/linux_ptrace.c: revision 1.29
Don't release proc_lock until we're done looking at things that are
protected by the lock, particularly p_stat and p_waited.  Found by
Robert Elz.
XXX Pullup to NetBSD-7, -6, -6-0, and -6-1


To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.16.18.1 src/sys/compat/linux/arch/arm/linux_ptrace.c
cvs rdiff -u -r1.26 -r1.26.20.1 src/sys/compat/linux/arch/i386/linux_ptrace.c
cvs rdiff -u -r1.23 -r1.23.20.1 \
src/sys/compat/linux/arch/powerpc/linux_ptrace.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/linux/arch/arm/linux_ptrace.c
diff -u src/sys/compat/linux/arch/arm/linux_ptrace.c:1.16 src/sys/compat/linux/arch/arm/linux_ptrace.c:1.16.18.1
--- src/sys/compat/linux/arch/arm/linux_ptrace.c:1.16	Wed Jul  7 01:30:33 2010
+++ src/sys/compat/linux/arch/arm/linux_ptrace.c	Sun Nov 15 20:42:36 2015
@@ -1,4 +1,4 @@
-/*	$NetBSD: linux_ptrace.c,v 1.16 2010/07/07 01:30:33 chs Exp $	*/
+/*	$NetBSD: linux_ptrace.c,v 1.16.18.1 2015/11/15 20:42:36 bouyer Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
 
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: linux_ptrace.c,v 1.16 2010/07/07 01:30:33 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_ptrace.c,v 1.16.18.1 2015/11/15 20:42:36 bouyer Exp $");
 
 #include 
 #include 
@@ -140,7 +140,6 @@ linux_sys_ptrace_arch(struct lwp *l, con
 		goto out;
 	}
 	mutex_enter(t->p_lock);
-	mutex_exit(proc_lock);
 
 	/*
 	 * You cannot do what you want to the process if:
@@ -148,6 +147,7 @@ linux_sys_ptrace_arch(struct lwp *l, con
 	 */
 	if (!ISSET(t->p_slflag, PSL_TRACED)) {
 		mutex_exit(t->p_lock);
+		mutex_exit(proc_lock);
 		error = EPERM;
 		goto out;
 	}
@@ -160,9 +160,11 @@ linux_sys_ptrace_arch(struct lwp *l, con
 	if (ISSET(t->p_slflag, PSL_FSTRACE) || t->p_pptr != p ||
 	t->p_stat != SSTOP || !t->p_waited) {
 		mutex_exit(t->p_lock);
+		mutex_exit(proc_lock);
 		error = EBUSY;
 		goto out;
 	}
+	mutex_exit(proc_lock);
 	/* XXX: ptrace needs revamp for multi-threading support. */
 	if (t->p_nlwps > 1) {
 		mutex_exit(t->p_lock);

Index: src/sys/compat/linux/arch/i386/linux_ptrace.c
diff -u src/sys/compat/linux/arch/i386/linux_ptrace.c:1.26 src/sys/compat/linux/arch/i386/linux_ptrace.c:1.26.20.1
--- src/sys/compat/linux/arch/i386/linux_ptrace.c:1.26	Wed Jul  7 01:30:34 2010
+++ src/sys/compat/linux/arch/i386/linux_ptrace.c	Sun Nov 15 20:42:36 2015
@@ -1,4 +1,4 @@
-/*	$NetBSD: linux_ptrace.c,v 1.26 2010/07/07 01:30:34 chs Exp $	*/
+/*	$NetBSD: linux_ptrace.c,v 1.26.20.1 2015/11/15 20:42:36 bouyer Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: linux_ptrace.c,v 1.26 2010/07/07 01:30:34 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_ptrace.c,v 1.26.20.1 2015/11/15 20:42:36 bouyer Exp $");
 
 #include 
 #include 
@@ -184,7 +184,6 @@ linux_sys_ptrace_arch(struct lwp *l, con
 		return ESRCH;
 	}
 	mutex_enter(t->p_lock);
-	mutex_exit(proc_lock);
 
 	/*
 	 * You cannot do what you want to the process if:
@@ -192,6 +191,7 @@ linux_sys_ptrace_arch(struct lwp *l, con
 	 */
 	if (!ISSET(t->p_slflag, PSL_TRACED)) {
 		mutex_exit(t->p_lock);
+		mutex_exit(proc_lock);
 		error = EPERM;
 		goto out;
 	}
@@ -204,9 +204,11 @@ linux_sys_ptrace_arch(struct lwp *l, con
 	if (ISSET(t->p_slflag, PSL_FSTRACE) || t->p_pptr != p ||
 	t->p_stat != SSTOP || !t->p_waited) {
 		mutex_exit(t->p_lock);
+		mutex_exit(proc_lock);
 		error = EBUSY;
 		goto out;
 	}
+	mutex_exit(proc_lock);
 	/* XXX: ptrace needs revamp for multi-threading support. */
 	if (t->p_nlwps > 1) {
 		mutex_exit(t->p_lock);

Index: src/sys/compat/linux/arch/powerpc/linux_ptrace.c
diff -u src/sys/compat/linux/arch/powerpc/linux_ptrace.c:1.23 src/sys/compat/linux/arch/powerpc/linux_ptrace.c:1.23.20.1
--- src/sys/compat/linux/arch/powerpc/linux_ptrace.c:1.23	Thu Jul  1 02:38:28 2010
+++ src/sys/compat/linux/arch/powerpc/linux_ptrace.c	Sun Nov 15 20:42:36 2015
@@ -1,4 +1,4 @@
-/*	$NetBSD: linux_ptrace.c,v 1.23 2010/07/01 02:38:28 rmind Exp $ */
+/*	$NetBSD: linux_ptrace.c,v 1.23.20.1 2015/11/15 20:42:36 bouyer Exp $ */
 
 /*-
  * Copyright (c) 1999, 2001 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include 
-__KERNEL_RCSID(0, "$NetBSD: linux_ptrace.c,v 1.23 2010/07/01 02:38:28 rmind Exp $");
+__KERNEL_RCSID(0,