Cyrill Gorcunov | d97b46a | 2012-05-31 16:26:44 -0700 | [diff] [blame] | 1 | #include <linux/kernel.h> |
| 2 | #include <linux/syscalls.h> |
| 3 | #include <linux/fdtable.h> |
| 4 | #include <linux/string.h> |
| 5 | #include <linux/random.h> |
| 6 | #include <linux/module.h> |
Cyrill Gorcunov | 44fd07e | 2012-12-20 15:05:21 -0800 | [diff] [blame] | 7 | #include <linux/ptrace.h> |
Cyrill Gorcunov | d97b46a | 2012-05-31 16:26:44 -0700 | [diff] [blame] | 8 | #include <linux/init.h> |
| 9 | #include <linux/errno.h> |
| 10 | #include <linux/cache.h> |
| 11 | #include <linux/bug.h> |
| 12 | #include <linux/err.h> |
| 13 | #include <linux/kcmp.h> |
| 14 | |
| 15 | #include <asm/unistd.h> |
| 16 | |
| 17 | /* |
| 18 | * We don't expose the real in-memory order of objects for security reasons. |
| 19 | * But still the comparison results should be suitable for sorting. So we |
| 20 | * obfuscate kernel pointers values and compare the production instead. |
| 21 | * |
| 22 | * The obfuscation is done in two steps. First we xor the kernel pointer with |
| 23 | * a random value, which puts pointer into a new position in a reordered space. |
| 24 | * Secondly we multiply the xor production with a large odd random number to |
| 25 | * permute its bits even more (the odd multiplier guarantees that the product |
| 26 | * is unique ever after the high bits are truncated, since any odd number is |
| 27 | * relative prime to 2^n). |
| 28 | * |
| 29 | * Note also that the obfuscation itself is invisible to userspace and if needed |
| 30 | * it can be changed to an alternate scheme. |
| 31 | */ |
| 32 | static unsigned long cookies[KCMP_TYPES][2] __read_mostly; |
| 33 | |
| 34 | static long kptr_obfuscate(long v, int type) |
| 35 | { |
| 36 | return (v ^ cookies[type][0]) * cookies[type][1]; |
| 37 | } |
| 38 | |
| 39 | /* |
| 40 | * 0 - equal, i.e. v1 = v2 |
| 41 | * 1 - less than, i.e. v1 < v2 |
| 42 | * 2 - greater than, i.e. v1 > v2 |
| 43 | * 3 - not equal but ordering unavailable (reserved for future) |
| 44 | */ |
| 45 | static int kcmp_ptr(void *v1, void *v2, enum kcmp_type type) |
| 46 | { |
Rasmus Villemoes | acbbe6f | 2014-09-09 14:51:01 -0700 | [diff] [blame] | 47 | long t1, t2; |
Cyrill Gorcunov | d97b46a | 2012-05-31 16:26:44 -0700 | [diff] [blame] | 48 | |
Rasmus Villemoes | acbbe6f | 2014-09-09 14:51:01 -0700 | [diff] [blame] | 49 | t1 = kptr_obfuscate((long)v1, type); |
| 50 | t2 = kptr_obfuscate((long)v2, type); |
Cyrill Gorcunov | d97b46a | 2012-05-31 16:26:44 -0700 | [diff] [blame] | 51 | |
Rasmus Villemoes | acbbe6f | 2014-09-09 14:51:01 -0700 | [diff] [blame] | 52 | return (t1 < t2) | ((t1 > t2) << 1); |
Cyrill Gorcunov | d97b46a | 2012-05-31 16:26:44 -0700 | [diff] [blame] | 53 | } |
| 54 | |
| 55 | /* The caller must have pinned the task */ |
| 56 | static struct file * |
| 57 | get_file_raw_ptr(struct task_struct *task, unsigned int idx) |
| 58 | { |
| 59 | struct file *file = NULL; |
| 60 | |
| 61 | task_lock(task); |
| 62 | rcu_read_lock(); |
| 63 | |
| 64 | if (task->files) |
| 65 | file = fcheck_files(task->files, idx); |
| 66 | |
| 67 | rcu_read_unlock(); |
| 68 | task_unlock(task); |
| 69 | |
| 70 | return file; |
| 71 | } |
| 72 | |
| 73 | static void kcmp_unlock(struct mutex *m1, struct mutex *m2) |
| 74 | { |
| 75 | if (likely(m2 != m1)) |
| 76 | mutex_unlock(m2); |
| 77 | mutex_unlock(m1); |
| 78 | } |
| 79 | |
| 80 | static int kcmp_lock(struct mutex *m1, struct mutex *m2) |
| 81 | { |
| 82 | int err; |
| 83 | |
| 84 | if (m2 > m1) |
| 85 | swap(m1, m2); |
| 86 | |
| 87 | err = mutex_lock_killable(m1); |
| 88 | if (!err && likely(m1 != m2)) { |
| 89 | err = mutex_lock_killable_nested(m2, SINGLE_DEPTH_NESTING); |
| 90 | if (err) |
| 91 | mutex_unlock(m1); |
| 92 | } |
| 93 | |
| 94 | return err; |
| 95 | } |
| 96 | |
| 97 | SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type, |
| 98 | unsigned long, idx1, unsigned long, idx2) |
| 99 | { |
| 100 | struct task_struct *task1, *task2; |
| 101 | int ret; |
| 102 | |
| 103 | rcu_read_lock(); |
| 104 | |
| 105 | /* |
| 106 | * Tasks are looked up in caller's PID namespace only. |
| 107 | */ |
| 108 | task1 = find_task_by_vpid(pid1); |
| 109 | task2 = find_task_by_vpid(pid2); |
| 110 | if (!task1 || !task2) |
| 111 | goto err_no_task; |
| 112 | |
| 113 | get_task_struct(task1); |
| 114 | get_task_struct(task2); |
| 115 | |
| 116 | rcu_read_unlock(); |
| 117 | |
| 118 | /* |
| 119 | * One should have enough rights to inspect task details. |
| 120 | */ |
| 121 | ret = kcmp_lock(&task1->signal->cred_guard_mutex, |
| 122 | &task2->signal->cred_guard_mutex); |
| 123 | if (ret) |
| 124 | goto err; |
| 125 | if (!ptrace_may_access(task1, PTRACE_MODE_READ) || |
| 126 | !ptrace_may_access(task2, PTRACE_MODE_READ)) { |
| 127 | ret = -EPERM; |
| 128 | goto err_unlock; |
| 129 | } |
| 130 | |
| 131 | switch (type) { |
| 132 | case KCMP_FILE: { |
| 133 | struct file *filp1, *filp2; |
| 134 | |
| 135 | filp1 = get_file_raw_ptr(task1, idx1); |
| 136 | filp2 = get_file_raw_ptr(task2, idx2); |
| 137 | |
| 138 | if (filp1 && filp2) |
| 139 | ret = kcmp_ptr(filp1, filp2, KCMP_FILE); |
| 140 | else |
| 141 | ret = -EBADF; |
| 142 | break; |
| 143 | } |
| 144 | case KCMP_VM: |
| 145 | ret = kcmp_ptr(task1->mm, task2->mm, KCMP_VM); |
| 146 | break; |
| 147 | case KCMP_FILES: |
| 148 | ret = kcmp_ptr(task1->files, task2->files, KCMP_FILES); |
| 149 | break; |
| 150 | case KCMP_FS: |
| 151 | ret = kcmp_ptr(task1->fs, task2->fs, KCMP_FS); |
| 152 | break; |
| 153 | case KCMP_SIGHAND: |
| 154 | ret = kcmp_ptr(task1->sighand, task2->sighand, KCMP_SIGHAND); |
| 155 | break; |
| 156 | case KCMP_IO: |
| 157 | ret = kcmp_ptr(task1->io_context, task2->io_context, KCMP_IO); |
| 158 | break; |
| 159 | case KCMP_SYSVSEM: |
| 160 | #ifdef CONFIG_SYSVIPC |
| 161 | ret = kcmp_ptr(task1->sysvsem.undo_list, |
| 162 | task2->sysvsem.undo_list, |
| 163 | KCMP_SYSVSEM); |
| 164 | #else |
| 165 | ret = -EOPNOTSUPP; |
| 166 | #endif |
| 167 | break; |
| 168 | default: |
| 169 | ret = -EINVAL; |
| 170 | break; |
| 171 | } |
| 172 | |
| 173 | err_unlock: |
| 174 | kcmp_unlock(&task1->signal->cred_guard_mutex, |
| 175 | &task2->signal->cred_guard_mutex); |
| 176 | err: |
| 177 | put_task_struct(task1); |
| 178 | put_task_struct(task2); |
| 179 | |
| 180 | return ret; |
| 181 | |
| 182 | err_no_task: |
| 183 | rcu_read_unlock(); |
| 184 | return -ESRCH; |
| 185 | } |
| 186 | |
| 187 | static __init int kcmp_cookies_init(void) |
| 188 | { |
| 189 | int i; |
| 190 | |
| 191 | get_random_bytes(cookies, sizeof(cookies)); |
| 192 | |
| 193 | for (i = 0; i < KCMP_TYPES; i++) |
| 194 | cookies[i][1] |= (~(~0UL >> 1) | 1); |
| 195 | |
| 196 | return 0; |
| 197 | } |
| 198 | arch_initcall(kcmp_cookies_init); |