These commits use WARN_ON_ONCE() and kill the offending processes when
deprecated and unknown flags are encountered:
commit c17a6ff93213 ("rseq: Kill process when unknown flags are encountered in ABI structures")
commit 0190e4198e47 ("rseq: Deprecate RSEQ_CS_FLAG_NO_RESTART_ON_* flags")
The WARN_ON_ONCE() triggered by userspace input prevents use of
Syzkaller to fuzz the rseq system call.
Replace this WARN_ON_ONCE() by pr_warn_once() messages which contain
actually useful information.
Reported-by: Mark Rutland <[email protected]>
Signed-off-by: Mathieu Desnoyers <[email protected]>
---
kernel/rseq.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/kernel/rseq.c b/kernel/rseq.c
index bda8175f8f99..d38ab944105d 100644
--- a/kernel/rseq.c
+++ b/kernel/rseq.c
@@ -171,12 +171,27 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs)
return 0;
}
+static bool rseq_warn_flags(const char *str, u32 flags)
+{
+ u32 test_flags;
+
+ if (!flags)
+ return false;
+ test_flags = flags & RSEQ_CS_NO_RESTART_FLAGS;
+ if (test_flags)
+ pr_warn_once("Deprecated flags (%u) in %s ABI structure", test_flags, str);
+ test_flags = flags & ~RSEQ_CS_NO_RESTART_FLAGS;
+ if (test_flags)
+ pr_warn_once("Unknown flags (%u) in %s ABI structure", test_flags, str);
+ return true;
+}
+
static int rseq_need_restart(struct task_struct *t, u32 cs_flags)
{
u32 flags, event_mask;
int ret;
- if (WARN_ON_ONCE(cs_flags & RSEQ_CS_NO_RESTART_FLAGS) || cs_flags)
+ if (rseq_warn_flags("rseq_cs", cs_flags))
return -EINVAL;
/* Get thread flags. */
@@ -184,7 +199,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags)
if (ret)
return ret;
- if (WARN_ON_ONCE(flags & RSEQ_CS_NO_RESTART_FLAGS) || flags)
+ if (rseq_warn_flags("rseq", flags))
return -EINVAL;
/*
--
2.30.2
On Thu, Sep 29, 2022 at 10:12:27AM -0400, Mathieu Desnoyers wrote:
> These commits use WARN_ON_ONCE() and kill the offending processes when
> deprecated and unknown flags are encountered:
>
> commit c17a6ff93213 ("rseq: Kill process when unknown flags are encountered in ABI structures")
> commit 0190e4198e47 ("rseq: Deprecate RSEQ_CS_FLAG_NO_RESTART_ON_* flags")
>
> The WARN_ON_ONCE() triggered by userspace input prevents use of
> Syzkaller to fuzz the rseq system call.
>
> Replace this WARN_ON_ONCE() by pr_warn_once() messages which contain
> actually useful information.
>
> Reported-by: Mark Rutland <[email protected]>
> Signed-off-by: Mathieu Desnoyers <[email protected]>
Thanks for this!
I've set off a Syzkaller run with this applied, and I'll be able to tell you in
a day or two whether that's made it possible to spot anything more interesting.
Regardless, I think this is a good change, so FWIW:
Acked-by: Mark Rutland <[email protected]>
Mark.
> ---
> kernel/rseq.c | 19 +++++++++++++++++--
> 1 file changed, 17 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/rseq.c b/kernel/rseq.c
> index bda8175f8f99..d38ab944105d 100644
> --- a/kernel/rseq.c
> +++ b/kernel/rseq.c
> @@ -171,12 +171,27 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs)
> return 0;
> }
>
> +static bool rseq_warn_flags(const char *str, u32 flags)
> +{
> + u32 test_flags;
> +
> + if (!flags)
> + return false;
> + test_flags = flags & RSEQ_CS_NO_RESTART_FLAGS;
> + if (test_flags)
> + pr_warn_once("Deprecated flags (%u) in %s ABI structure", test_flags, str);
> + test_flags = flags & ~RSEQ_CS_NO_RESTART_FLAGS;
> + if (test_flags)
> + pr_warn_once("Unknown flags (%u) in %s ABI structure", test_flags, str);
> + return true;
> +}
> +
> static int rseq_need_restart(struct task_struct *t, u32 cs_flags)
> {
> u32 flags, event_mask;
> int ret;
>
> - if (WARN_ON_ONCE(cs_flags & RSEQ_CS_NO_RESTART_FLAGS) || cs_flags)
> + if (rseq_warn_flags("rseq_cs", cs_flags))
> return -EINVAL;
>
> /* Get thread flags. */
> @@ -184,7 +199,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags)
> if (ret)
> return ret;
>
> - if (WARN_ON_ONCE(flags & RSEQ_CS_NO_RESTART_FLAGS) || flags)
> + if (rseq_warn_flags("rseq", flags))
> return -EINVAL;
>
> /*
> --
> 2.30.2
>
On Thu, Sep 29, 2022 at 10:12:27AM -0400, Mathieu Desnoyers wrote:
> These commits use WARN_ON_ONCE() and kill the offending processes when
> deprecated and unknown flags are encountered:
>
> commit c17a6ff93213 ("rseq: Kill process when unknown flags are encountered in ABI structures")
> commit 0190e4198e47 ("rseq: Deprecate RSEQ_CS_FLAG_NO_RESTART_ON_* flags")
>
> The WARN_ON_ONCE() triggered by userspace input prevents use of
> Syzkaller to fuzz the rseq system call.
>
> Replace this WARN_ON_ONCE() by pr_warn_once() messages which contain
> actually useful information.
>
> Reported-by: Mark Rutland <[email protected]>
> Signed-off-by: Mathieu Desnoyers <[email protected]>
Acked-by: Paul E. McKenney <[email protected]>
> ---
> kernel/rseq.c | 19 +++++++++++++++++--
> 1 file changed, 17 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/rseq.c b/kernel/rseq.c
> index bda8175f8f99..d38ab944105d 100644
> --- a/kernel/rseq.c
> +++ b/kernel/rseq.c
> @@ -171,12 +171,27 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs)
> return 0;
> }
>
> +static bool rseq_warn_flags(const char *str, u32 flags)
> +{
> + u32 test_flags;
> +
> + if (!flags)
> + return false;
> + test_flags = flags & RSEQ_CS_NO_RESTART_FLAGS;
> + if (test_flags)
> + pr_warn_once("Deprecated flags (%u) in %s ABI structure", test_flags, str);
> + test_flags = flags & ~RSEQ_CS_NO_RESTART_FLAGS;
> + if (test_flags)
> + pr_warn_once("Unknown flags (%u) in %s ABI structure", test_flags, str);
> + return true;
> +}
> +
> static int rseq_need_restart(struct task_struct *t, u32 cs_flags)
> {
> u32 flags, event_mask;
> int ret;
>
> - if (WARN_ON_ONCE(cs_flags & RSEQ_CS_NO_RESTART_FLAGS) || cs_flags)
> + if (rseq_warn_flags("rseq_cs", cs_flags))
> return -EINVAL;
>
> /* Get thread flags. */
> @@ -184,7 +199,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags)
> if (ret)
> return ret;
>
> - if (WARN_ON_ONCE(flags & RSEQ_CS_NO_RESTART_FLAGS) || flags)
> + if (rseq_warn_flags("rseq", flags))
> return -EINVAL;
>
> /*
> --
> 2.30.2
>
On 2022-09-29 10:12, Mathieu Desnoyers wrote:
> These commits use WARN_ON_ONCE() and kill the offending processes when
> deprecated and unknown flags are encountered:
>
> commit c17a6ff93213 ("rseq: Kill process when unknown flags are encountered in ABI structures")
> commit 0190e4198e47 ("rseq: Deprecate RSEQ_CS_FLAG_NO_RESTART_ON_* flags")
>
> The WARN_ON_ONCE() triggered by userspace input prevents use of
> Syzkaller to fuzz the rseq system call.
>
> Replace this WARN_ON_ONCE() by pr_warn_once() messages which contain
> actually useful information.
Hi Peter,
Should I resubmit this or can you simply pick up the Acked-by from Paul
McKenney and Mark Rutland and route this through the tip tree ?
Thanks,
Mathieu
>
> Reported-by: Mark Rutland <[email protected]>
> Signed-off-by: Mathieu Desnoyers <[email protected]>
> ---
> kernel/rseq.c | 19 +++++++++++++++++--
> 1 file changed, 17 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/rseq.c b/kernel/rseq.c
> index bda8175f8f99..d38ab944105d 100644
> --- a/kernel/rseq.c
> +++ b/kernel/rseq.c
> @@ -171,12 +171,27 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs)
> return 0;
> }
>
> +static bool rseq_warn_flags(const char *str, u32 flags)
> +{
> + u32 test_flags;
> +
> + if (!flags)
> + return false;
> + test_flags = flags & RSEQ_CS_NO_RESTART_FLAGS;
> + if (test_flags)
> + pr_warn_once("Deprecated flags (%u) in %s ABI structure", test_flags, str);
> + test_flags = flags & ~RSEQ_CS_NO_RESTART_FLAGS;
> + if (test_flags)
> + pr_warn_once("Unknown flags (%u) in %s ABI structure", test_flags, str);
> + return true;
> +}
> +
> static int rseq_need_restart(struct task_struct *t, u32 cs_flags)
> {
> u32 flags, event_mask;
> int ret;
>
> - if (WARN_ON_ONCE(cs_flags & RSEQ_CS_NO_RESTART_FLAGS) || cs_flags)
> + if (rseq_warn_flags("rseq_cs", cs_flags))
> return -EINVAL;
>
> /* Get thread flags. */
> @@ -184,7 +199,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags)
> if (ret)
> return ret;
>
> - if (WARN_ON_ONCE(flags & RSEQ_CS_NO_RESTART_FLAGS) || flags)
> + if (rseq_warn_flags("rseq", flags))
> return -EINVAL;
>
> /*
--
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com