MIPS: Fix potential DOS by untrusted user app.

On a 64 bit kernel if an o32 syscall was made with a syscall number less
than 4000, we would read the function from outside of the bounds of the
syscall table.  This led to non-deterministic behavior including system
crashes.

While we were at it we reworked the 32 bit version as well to use fewer
instructions.  Both 32 and 64 bit versions are use the same code now.

Signed-off-by: Vlad Malov <Vlad.Malov@caviumnetworks.com>
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
This commit is contained in:
Vlad Malov 2008-11-18 15:05:46 -08:00 committed by Ralf Baechle
parent feaf3848a8
commit e807f9574e
2 changed files with 6 additions and 11 deletions

View File

@ -262,14 +262,11 @@ bad_alignment:
LEAF(sys_syscall) LEAF(sys_syscall)
subu t0, a0, __NR_O32_Linux # check syscall number subu t0, a0, __NR_O32_Linux # check syscall number
sltiu v0, t0, __NR_O32_Linux_syscalls + 1 sltiu v0, t0, __NR_O32_Linux_syscalls + 1
beqz t0, einval # do not recurse
sll t1, t0, 3 sll t1, t0, 3
beqz v0, einval beqz v0, einval
lw t2, sys_call_table(t1) # syscall routine lw t2, sys_call_table(t1) # syscall routine
li v1, 4000 - __NR_O32_Linux # index of sys_syscall
beq t0, v1, einval # do not recurse
/* Some syscalls like execve get their arguments from struct pt_regs /* Some syscalls like execve get their arguments from struct pt_regs
and claim zero arguments in the syscall table. Thus we have to and claim zero arguments in the syscall table. Thus we have to
assume the worst case and shuffle around all potential arguments. assume the worst case and shuffle around all potential arguments.

View File

@ -174,14 +174,12 @@ not_o32_scall:
END(handle_sys) END(handle_sys)
LEAF(sys32_syscall) LEAF(sys32_syscall)
sltu v0, a0, __NR_O32_Linux + __NR_O32_Linux_syscalls + 1 subu t0, a0, __NR_O32_Linux # check syscall number
sltiu v0, t0, __NR_O32_Linux_syscalls + 1
beqz t0, einval # do not recurse
dsll t1, t0, 3
beqz v0, einval beqz v0, einval
ld t2, sys_call_table(t1) # syscall routine
dsll v0, a0, 3
ld t2, (sys_call_table - (__NR_O32_Linux * 8))(v0)
li v1, 4000 # indirect syscall number
beq a0, v1, einval # do not recurse
move a0, a1 # shift argument registers move a0, a1 # shift argument registers
move a1, a2 move a1, a2