Skip to content

Commit 182ffd5

Browse files
BeYkeRYktBeYkeRYkt
committed
patches: 4.9: update patches
Change-Id: Ie93454d396f0aad95c5a1df3ff0453c560fff43d
1 parent 51cbf06 commit 182ffd5

13 files changed

+1699
-0
lines changed

‎patches/4.9/CVE-2019-2054_1.patch‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
From c13dcfc3c4fa0ac8a40da64c30ba57dc14eb8096 Mon Sep 17 00:00:00 2001
2+
From: Andy Lutomirski <[email protected]>
3+
Date: Thu, 28 Jan 2016 15:11:21 -0800
4+
Subject: [PATCH] UPSTREAM: x86/syscalls: Refactor syscalltbl.sh
5+
6+
This splits out the code to emit a syscall line.
7+
8+
Signed-off-by: Andy Lutomirski <[email protected]>
9+
Cc: Andy Lutomirski <[email protected]>
10+
Cc: Borislav Petkov <[email protected]>
11+
Cc: Brian Gerst <[email protected]>
12+
Cc: Denys Vlasenko <[email protected]>
13+
Cc: Frederic Weisbecker <[email protected]>
14+
Cc: H. Peter Anvin <[email protected]>
15+
Cc: Linus Torvalds <[email protected]>
16+
Cc: Peter Zijlstra <[email protected]>
17+
Cc: Thomas Gleixner <[email protected]>
18+
Link: http://lkml.kernel.org/r/1bfcbba991f5cfaa9291ff950a593daa972a205f.1454022279.git.luto@kernel.org
19+
Signed-off-by: Ingo Molnar <[email protected]>
20+
(cherry picked from commit fba324744bfd2a7948a7710d7a021d76dafb9b67)
21+
22+
Bug: 119769499
23+
Change-Id: Ie36f49882c4c3a69d87288795e4525353bb05ec5
24+
Signed-off-by: Greg Hackmann <[email protected]>
25+
---
26+
arch/x86/syscalls/syscalltbl.sh | 18 +++++++++++++-----
27+
1 file changed, 13 insertions(+), 5 deletions(-)
28+
29+
diff --git a/arch/x86/syscalls/syscalltbl.sh b/arch/x86/syscalls/syscalltbl.sh
30+
index 0e7f8ec071e76..167965ee742e0 100644
31+
--- a/arch/x86/syscalls/syscalltbl.sh
32+
+++ b/arch/x86/syscalls/syscalltbl.sh
33+
@@ -3,13 +3,21 @@
34+
in="$1"
35+
out="$2"
36+
37+
+emit() {
38+
+ abi="$1"
39+
+ nr="$2"
40+
+ entry="$3"
41+
+ compat="$4"
42+
+ if [ -n "$compat" ]; then
43+
+ echo "__SYSCALL_${abi}($nr, $entry, $compat)"
44+
+ elif [ -n "$entry" ]; then
45+
+ echo "__SYSCALL_${abi}($nr, $entry, $entry)"
46+
+ fi
47+
+}
48+
+
49+
grep '^[0-9]' "$in" | sort -n | (
50+
while read nr abi name entry compat; do
51+
abi=`echo "$abi" | tr '[a-z]' '[A-Z]'`
52+
- if [ -n "$compat" ]; then
53+
- echo "__SYSCALL_${abi}($nr, $entry, $compat)"
54+
- elif [ -n "$entry" ]; then
55+
- echo "__SYSCALL_${abi}($nr, $entry, $entry)"
56+
- fi
57+
+ emit "$abi" "$nr" "$entry" "$compat"
58+
done
59+
) > "$out"

‎patches/4.9/CVE-2019-2054_10.patch‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
From 7734d5abc327e9ea93bb37d74e4f6161d109a739 Mon Sep 17 00:00:00 2001
2+
From: Kees Cook <[email protected]>
3+
Date: Thu, 9 Jun 2016 12:36:50 -0700
4+
Subject: [PATCH] BACKPORT: x86/ptrace: run seccomp after ptrace
5+
6+
This moves seccomp after ptrace on x86 to that seccomp can catch changes
7+
made by ptrace. Emulation should skip the rest of processing too.
8+
9+
We can get rid of test_thread_flag because there's no longer any
10+
opportunity for seccomp to mess with ptrace state before invoking
11+
ptrace.
12+
13+
Suggested-by: Andy Lutomirski <[email protected]>
14+
Signed-off-by: Kees Cook <[email protected]>
15+
Cc: [email protected]
16+
Cc: Andy Lutomirski <[email protected]>
17+
(cherry picked from commit 93e35efb8de45393cf61ed07f7b407629bf698ea)
18+
19+
Bug: 119769499
20+
Change-Id: Ia8e6f9a314b8ab36abee47082e49c66fcf201433
21+
[[email protected]: apply entry/common.c changes to kernel/ptrace.c]
22+
Signed-off-by: Greg Hackmann <[email protected]>
23+
---
24+
arch/x86/kernel/ptrace.c | 22 ++++++++++++----------
25+
1 file changed, 12 insertions(+), 10 deletions(-)
26+
27+
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
28+
index cf7fa7db1bbc0..883fe73cf2a45 100644
29+
--- a/arch/x86/kernel/ptrace.c
30+
+++ b/arch/x86/kernel/ptrace.c
31+
@@ -1464,6 +1464,7 @@ long syscall_trace_enter(struct pt_regs *regs)
32+
u32 arch = is_ia32_task() ? AUDIT_ARCH_I386 : AUDIT_ARCH_X86_64;
33+
34+
unsigned long ret = 0;
35+
+ bool emulated = false;
36+
u32 work;
37+
38+
BUG_ON(regs != task_pt_regs(current));
39+
@@ -1490,11 +1491,19 @@ long syscall_trace_enter(struct pt_regs *regs)
40+
if (work & _TIF_SINGLESTEP)
41+
regs->flags |= X86_EFLAGS_TF;
42+
43+
+ if (unlikely(work & _TIF_SYSCALL_EMU))
44+
+ emulated = true;
45+
+
46+
+ if ((emulated || (work & _TIF_SYSCALL_TRACE)) &&
47+
+ tracehook_report_syscall_entry(regs))
48+
+ return -1L;
49+
+
50+
+ if (emulated)
51+
+ return -1L;
52+
+
53+
#ifdef CONFIG_SECCOMP
54+
/*
55+
- * Do seccomp first -- it should minimize exposure of other
56+
- * code, and keeping seccomp fast is probably more valuable
57+
- * than the rest of this.
58+
+ * Do seccomp after ptrace, to catch any tracer changes.
59+
*/
60+
if (work & _TIF_SECCOMP) {
61+
struct seccomp_data sd;
62+
@@ -1527,13 +1536,6 @@ long syscall_trace_enter(struct pt_regs *regs)
63+
}
64+
#endif
65+
66+
- if (unlikely(work & _TIF_SYSCALL_EMU))
67+
- ret = -1L;
68+
-
69+
- if ((ret || test_thread_flag(TIF_SYSCALL_TRACE)) &&
70+
- tracehook_report_syscall_entry(regs))
71+
- ret = -1L;
72+
-
73+
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
74+
trace_sys_enter(regs, regs->orig_ax);
75+

‎patches/4.9/CVE-2019-2054_11.patch‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
From bac2f2dde8af50c477b580743deb688db25e9e63 Mon Sep 17 00:00:00 2001
2+
From: Kees Cook <[email protected]>
3+
Date: Thu, 2 Jun 2016 12:16:31 -0700
4+
Subject: [PATCH] UPSTREAM: arm/ptrace: run seccomp after ptrace
5+
6+
Close the hole where ptrace can change a syscall out from under seccomp.
7+
8+
Signed-off-by: Kees Cook <[email protected]>
9+
Cc: Russell King <[email protected]>
10+
Cc: [email protected]
11+
(cherry picked from commit 0f3912fd934cdfd03d93f2dc6f064099795bf638)
12+
13+
Bug: 119769499
14+
Change-Id: Id82e4137207db42a8af31b2745581c53eaaf1f89
15+
Signed-off-by: Greg Hackmann <[email protected]>
16+
---
17+
arch/arm/kernel/ptrace.c | 11 ++++++-----
18+
1 file changed, 6 insertions(+), 5 deletions(-)
19+
20+
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
21+
index 1027d3b545416..ce131ed5939d5 100644
22+
--- a/arch/arm/kernel/ptrace.c
23+
+++ b/arch/arm/kernel/ptrace.c
24+
@@ -932,18 +932,19 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
25+
{
26+
current_thread_info()->syscall = scno;
27+
28+
- /* Do the secure computing check first; failures should be fast. */
29+
+ if (test_thread_flag(TIF_SYSCALL_TRACE))
30+
+ tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
31+
+
32+
+ /* Do seccomp after ptrace; syscall may have changed. */
33+
#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
34+
if (secure_computing(NULL) == -1)
35+
return -1;
36+
#else
37+
/* XXX: remove this once OABI gets fixed */
38+
- secure_computing_strict(scno);
39+
+ secure_computing_strict(current_thread_info()->syscall);
40+
#endif
41+
42+
- if (test_thread_flag(TIF_SYSCALL_TRACE))
43+
- tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
44+
-
45+
+ /* Tracer or seccomp may have changed syscall. */
46+
scno = current_thread_info()->syscall;
47+
48+
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))

‎patches/4.9/CVE-2019-2054_12.patch‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
From 357104de527aae243188951399e1c2f72bf9bc81 Mon Sep 17 00:00:00 2001
2+
From: Kees Cook <[email protected]>
3+
Date: Thu, 2 Jun 2016 12:28:52 -0700
4+
Subject: [PATCH] UPSTREAM: arm64/ptrace: run seccomp after ptrace
5+
6+
Close the hole where ptrace can change a syscall out from under seccomp.
7+
8+
Signed-off-by: Kees Cook <[email protected]>
9+
Cc: Catalin Marinas <[email protected]>
10+
Cc: Will Deacon <[email protected]>
11+
Cc: Mark Rutland <[email protected]>
12+
Cc: [email protected]
13+
(cherry picked from commit a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615)
14+
15+
Bug: 119769499
16+
Change-Id: I9fd3e8e6d38122866df434b2676bf7ba0e808e32
17+
Signed-off-by: Greg Hackmann <[email protected]>
18+
---
19+
arch/arm64/kernel/ptrace.c | 8 ++++----
20+
1 file changed, 4 insertions(+), 4 deletions(-)
21+
22+
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
23+
index 4fe7eb2cd9ee0..acc808c9e29d4 100644
24+
--- a/arch/arm64/kernel/ptrace.c
25+
+++ b/arch/arm64/kernel/ptrace.c
26+
@@ -1151,13 +1151,13 @@ static void tracehook_report_syscall(struct pt_regs *regs,
27+
28+
asmlinkage int syscall_trace_enter(struct pt_regs *regs)
29+
{
30+
- /* Do the secure computing check first; failures should be fast. */
31+
- if (secure_computing(NULL) == -1)
32+
- return -1;
33+
-
34+
if (test_thread_flag(TIF_SYSCALL_TRACE))
35+
tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
36+
37+
+ /* Do the secure computing after ptrace; failures should be fast. */
38+
+ if (secure_computing(NULL) == -1)
39+
+ return -1;
40+
+
41+
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
42+
trace_sys_enter(regs, regs->syscallno);
43+

‎patches/4.9/CVE-2019-2054_13.patch‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
From cebcb3bb8361857c498bfb80df7f2d7228ba95a1 Mon Sep 17 00:00:00 2001
2+
From: Kees Cook <[email protected]>
3+
Date: Wed, 10 Aug 2016 16:28:09 -0700
4+
Subject: [PATCH] UPSTREAM: seccomp: Fix tracer exit notifications during fatal
5+
signals
6+
7+
This fixes a ptrace vs fatal pending signals bug as manifested in
8+
seccomp now that seccomp was reordered to happen after ptrace. The
9+
short version is that seccomp should not attempt to call do_exit()
10+
while fatal signals are pending under a tracer. The existing code was
11+
trying to be as defensively paranoid as possible, but it now ends up
12+
confusing ptrace. Instead, the syscall can just be skipped (which solves
13+
the original concern that the do_exit() was addressing) and normal signal
14+
handling, tracer notification, and process death can happen.
15+
16+
Paraphrasing from the original bug report:
17+
18+
If a tracee task is in a PTRACE_EVENT_SECCOMP trap, or has been resumed
19+
after such a trap but not yet been scheduled, and another task in the
20+
thread-group calls exit_group(), then the tracee task exits without the
21+
ptracer receiving a PTRACE_EVENT_EXIT notification. Test case here:
22+
https://gist.github.com/khuey/3c43ac247c72cef8c956ca73281c9be7
23+
24+
The bug happens because when __seccomp_filter() detects
25+
fatal_signal_pending(), it calls do_exit() without dequeuing the fatal
26+
signal. When do_exit() sends the PTRACE_EVENT_EXIT notification and
27+
that task is descheduled, __schedule() notices that there is a fatal
28+
signal pending and changes its state from TASK_TRACED to TASK_RUNNING.
29+
That prevents the ptracer's waitpid() from returning the ptrace event.
30+
A more detailed analysis is here:
31+
https://github.com/mozilla/rr/issues/1762#issuecomment-237396255.
32+
33+
Reported-by: Robert O'Callahan <[email protected]>
34+
Reported-by: Kyle Huey <[email protected]>
35+
Tested-by: Kyle Huey <[email protected]>
36+
Fixes: 93e35efb8de4 ("x86/ptrace: run seccomp after ptrace")
37+
Signed-off-by: Kees Cook <[email protected]>
38+
Acked-by: Oleg Nesterov <[email protected]>
39+
Acked-by: James Morris <[email protected]>
40+
(cherry picked from commit 485a252a5559b45d7df04c819ec91177c62c270b)
41+
42+
Bug: 119769499
43+
Change-Id: I444e69093e88d58587b4d5c4f2d777985591c32d
44+
Signed-off-by: Greg Hackmann <[email protected]>
45+
---
46+
kernel/seccomp.c | 12 ++++++++----
47+
1 file changed, 8 insertions(+), 4 deletions(-)
48+
49+
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
50+
index 98b48c2793a26..99bb8734fc88d 100644
51+
--- a/kernel/seccomp.c
52+
+++ b/kernel/seccomp.c
53+
@@ -650,12 +650,16 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
54+
ptrace_event(PTRACE_EVENT_SECCOMP, data);
55+
/*
56+
* The delivery of a fatal signal during event
57+
- * notification may silently skip tracer notification.
58+
- * Terminating the task now avoids executing a system
59+
- * call that may not be intended.
60+
+ * notification may silently skip tracer notification,
61+
+ * which could leave us with a potentially unmodified
62+
+ * syscall that the tracer would have liked to have
63+
+ * changed. Since the process is about to die, we just
64+
+ * force the syscall to be skipped and let the signal
65+
+ * kill the process and correctly handle any tracer exit
66+
+ * notifications.
67+
*/
68+
if (fatal_signal_pending(current))
69+
- do_exit(SIGSYS);
70+
+ goto skip;
71+
/* Check if the tracer forced the syscall to be skipped. */
72+
this_syscall = syscall_get_nr(current, task_pt_regs(current));
73+
if (this_syscall < 0)

0 commit comments

Comments
 (0)