2007-11-15 18:23:00

by Ulrich Drepper

Subject: [PATCHv2 1/4] actual sys_indirect code

This is the actual architecture-independent part of the system call
implementation.

b/include/linux/indirect.h | 13 ++++++++++++
b/include/linux/syscalls.h | 3 ++
b/kernel/Makefile | 2 -
b/kernel/indirect.c | 46 +++++++++++++++++++++++++++++++++++++++++++++
include/linux/sched.h | 4 +++
5 files changed, 67 insertions(+), 1 deletion(-)

--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -80,6 +80,7 @@ struct sched_param {
#include <linux/rcupdate.h>
#include <linux/futex.h>
#include <linux/rtmutex.h>
+#include <linux/indirect.h>

#include <linux/time.h>
#include <linux/param.h>
@@ -1174,6 +1175,9 @@ struct task_struct {
int make_it_fail;
#endif
struct prop_local_single dirties;
+
+ /* Additional system call parameters. */
+ union indirect_params indirect_params;
};

/*
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 61def7c..614ff36 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -54,6 +54,7 @@ struct compat_stat;
struct compat_timeval;
struct robust_list_head;
struct getcpu_cache;
+struct indirect_registers;

#include <linux/types.h>
#include <linux/aio_abi.h>
@@ -611,6 +612,8 @@ asmlinkage long sys_timerfd(int ufd, int clockid, int flags,
const struct itimerspec __user *utmr);
asmlinkage long sys_eventfd(unsigned int count);
asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len);
+asmlinkage long sys_indirect(struct indirect_registers __user *userregs,
+ void __user *userparams, size_t paramslen);

int kernel_execve(const char *filename, char *const argv[], char *const envp[]);

diff --git a/kernel/Makefile b/kernel/Makefile
index f60afe7..ef82be0 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -9,7 +9,7 @@ obj-y = sched.o fork.o exec_domain.o panic.o printk.o profile.o \
rcupdate.o extable.o params.o posix-timers.o \
kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
hrtimer.o rwsem.o latency.o nsproxy.o srcu.o \
- utsname.o notifier.o
+ utsname.o notifier.o indirect.o

obj-$(CONFIG_SYSCTL) += sysctl_check.o
obj-$(CONFIG_STACKTRACE) += stacktrace.o
diff --git a/net/socket.c b/net/socket.c
index 74784df..e3a3a04 100644
--- /dev/null 2007-09-23 16:36:38.465394704 -0700
+++ b/include/linux/indirect.h 2007-11-14 17:53:18.000000000 -0800
@@ -0,0 +1,13 @@
+#ifndef _LINUX_INDIRECT_H
+#define _LINUX_INDIRECT_H
+
+#include <asm/indirect.h>
+
+
+union indirect_params {
+ struct {
+ int flags;
+ } file_flags;
+};
+
+#endif
--- /dev/null 2007-09-23 16:36:38.465394704 -0700
+++ b/kernel/indirect.c 2007-11-15 09:46:34.000000000 -0800
@@ -0,0 +1,46 @@
+#include <linux/sched.h>
+#include <linux/uaccess.h>
+#include <linux/unistd.h>
+#include <asm/asm-offsets.h>
+
+
+long sys_indirect(struct indirect_registers __user *userregs,
+ void __user *userparams, size_t paramslen)
+{
+ struct indirect_registers regs;
+ long result;
+
+ if (copy_from_user(&regs, userregs, sizeof(regs)))
+ return -EFAULT;
+
+ switch (INDIRECT_SYSCALL (&regs))
+ {
+#ifdef __NR_accept
+ case __NR_accept:
+#endif
+#ifdef __NR_socketpair
+ case __NR_socketpair:
+#endif
+#ifdef __NR_socket
+ case __NR_socket:
+#endif
+#ifdef __NR_socketcall
+ case __NR_socketcall:
+#endif
+ break;
+
+ default:
+ return -EINVAL;
+ }
+
+ if (paramslen > sizeof(union indirect_params))
+ return -EINVAL;
+ if (copy_from_user(&current->indirect_params, userparams, paramslen))
+ return -EFAULT;
+
+ result = CALL_INDIRECT(&regs);
+
+ memset(&current->indirect_params, '\0', paramslen);
+
+ return result;
+}

2007-11-16 02:44:52

by Eric Dumazet

Subject: Re: [PATCHv2 1/4] actual sys_indirect code

Ulrich Drepper a ?crit :
> This is the actual architecture-independent part of the system call
> implementation.
>

> +
> +long sys_indirect(struct indirect_registers __user *userregs,
> + void __user *userparams, size_t paramslen)
> +{
> + struct indirect_registers regs;
> + long result;
> +
> + if (copy_from_user(&regs, userregs, sizeof(regs)))
> + return -EFAULT;
> +
> + switch (INDIRECT_SYSCALL (&regs))
> + {
> +#ifdef __NR_accept
> + case __NR_accept:
> +#endif
> +#ifdef __NR_socketpair
> + case __NR_socketpair:
> +#endif
> +#ifdef __NR_socket
> + case __NR_socket:
> +#endif
> +#ifdef __NR_socketcall
> + case __NR_socketcall:
> +#endif
> + break;
> +
> + default:
> + return -EINVAL;
> + }
> +
> + if (paramslen > sizeof(union indirect_params))
> + return -EINVAL;
> + if (copy_from_user(&current->indirect_params, userparams, paramslen))

Here, you should clear current->indirect_params before returning -EFAULT
{
memset(&current->indirect_params, 0, paramslen);
> + return -EFAULT;
}
copy_from_user could do a partial copy (so dirty first bytes of
indirect_params) and all furthers calls to socket()/open() and so on could be
broken.

> +
> + result = CALL_INDIRECT(&regs);
> +
> + memset(&current->indirect_params, '\0', paramslen);
> +
> + return result;
> +}
> -