Commit fd881d0a authored by Michael Jeanson's avatar Michael Jeanson Committed by Ingo Molnar
Browse files

rseq: Fix segfault on registration when rseq_cs is non-zero 



The rseq_cs field is documented as being set to 0 by user-space prior to
registration, however this is not currently enforced by the kernel. This
can result in a segfault on return to user-space if the value stored in
the rseq_cs field doesn't point to a valid struct rseq_cs.

The correct solution to this would be to fail the rseq registration when
the rseq_cs field is non-zero. However, some older versions of glibc
will reuse the rseq area of previous threads without clearing the
rseq_cs field and will also terminate the process if the rseq
registration fails in a secondary thread. This wasn't caught in testing
because in this case the leftover rseq_cs does point to a valid struct
rseq_cs.

What we can do is clear the rseq_cs field on registration when it's
non-zero which will prevent segfaults on registration and won't break
the glibc versions that reuse rseq areas on thread creation.

Signed-off-by: default avatarMichael Jeanson <mjeanson@efficios.com>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Reviewed-by: default avatarMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://lore.kernel.org/r/20250306211223.109455-1-mjeanson@efficios.com
parent 82354fce

kernel/rseq.c

+48 −12
Original line number Diff line number Diff line
@@ -236,6 +236,29 @@ static int rseq_reset_rseq_cpu_node_id(struct task_struct *t) 
	return -EFAULT;

}



/*

 * Get the user-space pointer value stored in the 'rseq_cs' field.

 */

static int rseq_get_rseq_cs_ptr_val(struct rseq __user *rseq, u64 *rseq_cs)

{

	if (!rseq_cs)

		return -EFAULT;



#ifdef CONFIG_64BIT

	if (get_user(*rseq_cs, &rseq->rseq_cs))

		return -EFAULT;

#else

	if (copy_from_user(rseq_cs, &rseq->rseq_cs, sizeof(*rseq_cs)))

		return -EFAULT;

#endif



	return 0;

}



/*

 * If the rseq_cs field of 'struct rseq' contains a valid pointer to

 * user-space, copy 'struct rseq_cs' from user-space and validate its fields.

 */

static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs)

{

	struct rseq_cs __user *urseq_cs;
@@ -244,17 +267,16 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) 
	u32 sig;

	int ret;



#ifdef CONFIG_64BIT

	if (get_user(ptr, &t->rseq->rseq_cs))

		return -EFAULT;

#else

	if (copy_from_user(&ptr, &t->rseq->rseq_cs, sizeof(ptr)))

		return -EFAULT;

#endif

	ret = rseq_get_rseq_cs_ptr_val(t->rseq, &ptr);

	if (ret)

		return ret;



	/* If the rseq_cs pointer is NULL, return a cleared struct rseq_cs. */

	if (!ptr) {

		memset(rseq_cs, 0, sizeof(*rseq_cs));

		return 0;

	}

	/* Check that the pointer value fits in the user-space process space. */

	if (ptr >= TASK_SIZE)

		return -EINVAL;

	urseq_cs = (struct rseq_cs __user *)(unsigned long)ptr;
@@ -330,7 +352,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags) 
	return !!event_mask;

}



static int clear_rseq_cs(struct task_struct *t)

static int clear_rseq_cs(struct rseq __user *rseq)

{

	/*

	 * The rseq_cs field is set to NULL on preemption or signal
@@ -341,9 +363,9 @@ static int clear_rseq_cs(struct task_struct *t) 
	 * Set rseq_cs to NULL.

	 */

#ifdef CONFIG_64BIT

	return put_user(0UL, &t->rseq->rseq_cs);

	return put_user(0UL, &rseq->rseq_cs);

#else

	if (clear_user(&t->rseq->rseq_cs, sizeof(t->rseq->rseq_cs)))

	if (clear_user(&rseq->rseq_cs, sizeof(rseq->rseq_cs)))

		return -EFAULT;

	return 0;

#endif
@@ -375,11 +397,11 @@ static int rseq_ip_fixup(struct pt_regs *regs) 
	 * Clear the rseq_cs pointer and return.

	 */

	if (!in_rseq_cs(ip, &rseq_cs))

		return clear_rseq_cs(t);

		return clear_rseq_cs(t->rseq);

	ret = rseq_need_restart(t, rseq_cs.flags);

	if (ret <= 0)

		return ret;

	ret = clear_rseq_cs(t);

	ret = clear_rseq_cs(t->rseq);

	if (ret)

		return ret;

	trace_rseq_ip_fixup(ip, rseq_cs.start_ip, rseq_cs.post_commit_offset,
@@ -453,6 +475,7 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, 
		int, flags, u32, sig)

{

	int ret;

	u64 rseq_cs;



	if (flags & RSEQ_FLAG_UNREGISTER) {

		if (flags & ~RSEQ_FLAG_UNREGISTER)
@@ -507,6 +530,19 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, 
		return -EINVAL;

	if (!access_ok(rseq, rseq_len))

		return -EFAULT;



	/*

	 * If the rseq_cs pointer is non-NULL on registration, clear it to

	 * avoid a potential segfault on return to user-space. The proper thing

	 * to do would have been to fail the registration but this would break

	 * older libcs that reuse the rseq area for new threads without

	 * clearing the fields.

	 */

	if (rseq_get_rseq_cs_ptr_val(rseq, &rseq_cs))

	        return -EFAULT;

	if (rseq_cs && clear_rseq_cs(rseq))

		return -EFAULT;



#ifdef CONFIG_DEBUG_RSEQ

	/*

	 * Initialize the in-kernel rseq fields copy for validation of