From 009db928a6c2fc2b17f2edf43e1a98397fd74cc4 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Mon, 12 Feb 2018 23:59:26 +0000 Subject: [PATCH] x86: Make x32 syscall support conditional on a kernel parameter Enabling x32 in the standard amd64 kernel would increase its attack surface while provide no benefit to the vast majority of its users. No-one seems interested in regularly checking for vulnerabilities specific to x32 (at least no-one with a white hat). Still, adding another flavour just to turn on x32 seems wasteful. And the only differences on syscall entry are a few instructions that mask out the x32 flag and compare the syscall number. Use a static key to control whether x32 syscalls are really enabled, a Kconfig parameter to set its default value and a kernel parameter "syscall.x32" to change it at boot time. Signed-off-by: Ben Hutchings Gbp-Pq: Topic features/x86 Gbp-Pq: Name x86-make-x32-syscall-support-conditional.patch --- .../admin-guide/kernel-parameters.txt | 4 ++ arch/x86/Kconfig | 8 +++ arch/x86/entry/common.c | 15 ++++-- arch/x86/entry/syscall_64.c | 50 +++++++++++++++++++ arch/x86/include/asm/elf.h | 4 +- arch/x86/include/asm/syscall.h | 13 +++++ arch/x86/include/asm/unistd.h | 4 +- 7 files changed, 92 insertions(+), 6 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 04f14df03ae..b1a373cb888 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -4608,6 +4608,10 @@ switches= [HW,M68k] + syscall.x32= [KNL,x86_64] Enable/disable use of x32 syscalls on + an x86_64 kernel where CONFIG_X86_X32 is enabled. + Default depends on CONFIG_X86_X32_DISABLED. + sysfs.deprecated=0|1 [KNL] Enable/disable old style sysfs layout for old udev on older distributions. When this option is enabled diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 2bbbd4d1ba3..c041428a96b 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -2850,6 +2850,14 @@ config COMPAT_32 select HAVE_UID16 select OLD_SIGSUSPEND3 +config X86_X32_DISABLED + bool "x32 ABI disabled by default" + depends on X86_X32 + default n + help + Disable the x32 ABI unless explicitly enabled using the + kernel paramter "syscall.x32=y". + config COMPAT def_bool y depends on IA32_EMULATION || X86_X32 diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c index 2418804e66b..efcd0edf4d0 100644 --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -295,12 +295,21 @@ __visible void do_syscall_64(unsigned long nr, struct pt_regs *regs) * table. The only functional difference is the x32 bit in * regs->orig_ax, which changes the behavior of some syscalls. */ - nr &= __SYSCALL_MASK; - if (likely(nr < NR_syscalls)) { + if (x32_enabled) { + nr &= ~__X32_SYSCALL_BIT; + if (unlikely(nr >= NR_syscalls)) + goto bad; nr = array_index_nospec(nr, NR_syscalls); + goto good; + } else { + nr &= ~0U; + if (unlikely(nr >= NR_non_x32_syscalls)) + goto bad; + nr = array_index_nospec(nr, NR_non_x32_syscalls); +good: regs->ax = sys_call_table[nr](regs); } - +bad: syscall_return_slowpath(regs); } #endif diff --git a/arch/x86/entry/syscall_64.c b/arch/x86/entry/syscall_64.c index d5252bc1e38..5a904077127 100644 --- a/arch/x86/entry/syscall_64.c +++ b/arch/x86/entry/syscall_64.c @@ -4,6 +4,9 @@ #include #include #include +#include +#undef MODULE_PARAM_PREFIX +#define MODULE_PARAM_PREFIX "syscall." #include #include @@ -23,3 +26,50 @@ asmlinkage const sys_call_ptr_t sys_call_table[__NR_syscall_max+1] = { [0 ... __NR_syscall_max] = &sys_ni_syscall, #include }; + +#ifdef CONFIG_X86_X32_ABI + +/* Maybe enable x32 syscalls */ + +#if defined(CONFIG_X86_X32_DISABLED) +DEFINE_STATIC_KEY_FALSE(x32_enabled_skey); +#else +DEFINE_STATIC_KEY_TRUE(x32_enabled_skey); +#endif + +static int __init x32_param_set(const char *val, const struct kernel_param *p) +{ + bool enabled; + int ret; + + ret = kstrtobool(val, &enabled); + if (ret) + return ret; + if (IS_ENABLED(CONFIG_X86_X32_DISABLED)) { + if (enabled) { + static_key_enable(&x32_enabled_skey.key); + pr_info("Enabled x32 syscalls\n"); + } + } else { + if (!enabled) { + static_key_disable(&x32_enabled_skey.key); + pr_info("Disabled x32 syscalls\n"); + } + } + return 0; +} + +static int x32_param_get(char *buffer, const struct kernel_param *p) +{ + return sprintf(buffer, "%c\n", + static_key_enabled(&x32_enabled_skey) ? 'Y' : 'N'); +} + +static const struct kernel_param_ops x32_param_ops = { + .set = x32_param_set, + .get = x32_param_get, +}; + +arch_param_cb(x32, &x32_param_ops, NULL, 0444); + +#endif diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h index 69c0f892e31..4cfc1795e2c 100644 --- a/arch/x86/include/asm/elf.h +++ b/arch/x86/include/asm/elf.h @@ -11,6 +11,7 @@ #include #include #include +#include typedef unsigned long elf_greg_t; @@ -163,7 +164,8 @@ do { \ #define compat_elf_check_arch(x) \ (elf_check_arch_ia32(x) || \ - (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64)) + (IS_ENABLED(CONFIG_X86_X32_ABI) && x32_enabled && \ + (x)->e_machine == EM_X86_64)) #if __USER32_DS != __USER_DS # error "The following code assumes __USER32_DS == __USER_DS" diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h index 2dc4a021bee..ea056310309 100644 --- a/arch/x86/include/asm/syscall.h +++ b/arch/x86/include/asm/syscall.h @@ -13,6 +13,7 @@ #include #include #include +#include #include /* For NR_syscalls */ #include /* for TS_COMPAT */ #include @@ -36,6 +37,18 @@ extern const sys_call_ptr_t sys_call_table[]; extern const sys_call_ptr_t ia32_sys_call_table[]; #endif +#if defined(CONFIG_X86_X32_ABI) +#if defined(CONFIG_X86_X32_DISABLED) +DECLARE_STATIC_KEY_FALSE(x32_enabled_skey); +#define x32_enabled static_branch_unlikely(&x32_enabled_skey) +#else +DECLARE_STATIC_KEY_TRUE(x32_enabled_skey); +#define x32_enabled static_branch_likely(&x32_enabled_skey) +#endif +#else +#define x32_enabled 0 +#endif + /* * Only the low 32 bits of orig_ax are meaningful, so we return int. * This importantly ignores the high bits on 64-bit, so comparisons diff --git a/arch/x86/include/asm/unistd.h b/arch/x86/include/asm/unistd.h index 146859efd83..45ff6ef8bed 100644 --- a/arch/x86/include/asm/unistd.h +++ b/arch/x86/include/asm/unistd.h @@ -6,9 +6,9 @@ # ifdef CONFIG_X86_X32_ABI -# define __SYSCALL_MASK (~(__X32_SYSCALL_BIT)) +# define NR_non_x32_syscalls 512 # else -# define __SYSCALL_MASK (~0) +# define NR_non_x32_syscalls NR_syscalls # endif # ifdef CONFIG_X86_32 -- 2.30.2