1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 1991, 1992 Linus Torvalds 4 * 5 * 1997-11-28 Modified for POSIX.1b signals by Richard Henderson 6 * 2000-06-20 Pentium III FXSR, SSE support by Gareth Hughes 7 * 2000-12-* x86-64 compatibility mode signal handling by Andi Kleen 8 */ 9 10 #include <linux/sched.h> 11 #include <linux/sched/task_stack.h> 12 #include <linux/mm.h> 13 #include <linux/smp.h> 14 #include <linux/kernel.h> 15 #include <linux/errno.h> 16 #include <linux/wait.h> 17 #include <linux/unistd.h> 18 #include <linux/stddef.h> 19 #include <linux/personality.h> 20 #include <linux/compat.h> 21 #include <linux/binfmts.h> 22 #include <linux/syscalls.h> 23 #include <asm/ucontext.h> 24 #include <linux/uaccess.h> 25 #include <asm/fpu/signal.h> 26 #include <asm/ptrace.h> 27 #include <asm/user32.h> 28 #include <uapi/asm/sigcontext.h> 29 #include <asm/proto.h> 30 #include <asm/vdso.h> 31 #include <asm/sigframe.h> 32 #include <asm/sighandling.h> 33 #include <asm/smap.h> 34 #include <asm/gsseg.h> 35 36 /* 37 * The first GDT descriptor is reserved as 'NULL descriptor'. As bits 0 38 * and 1 of a segment selector, i.e., the RPL bits, are NOT used to index 39 * GDT, selector values 0~3 all point to the NULL descriptor, thus values 40 * 0, 1, 2 and 3 are all valid NULL selector values. 41 * 42 * However IRET zeros ES, FS, GS, and DS segment registers if any of them 43 * is found to have any nonzero NULL selector value, which can be used by 44 * userspace in pre-FRED systems to spot any interrupt/exception by loading 45 * a nonzero NULL selector and waiting for it to become zero. Before FRED 46 * there was nothing software could do to prevent such an information leak. 47 * 48 * ERETU, the only legit instruction to return to userspace from kernel 49 * under FRED, by design does NOT zero any segment register to avoid this 50 * problem behavior. 51 * 52 * As such, leave NULL selector values 0~3 unchanged. 53 */ 54 static inline u16 fixup_rpl(u16 sel) 55 { 56 return sel <= 3 ? sel : sel | 3; 57 } 58 59 #ifdef CONFIG_IA32_EMULATION 60 #include <asm/unistd_32_ia32.h> 61 62 static inline void reload_segments(struct sigcontext_32 *sc) 63 { 64 u16 cur; 65 66 /* 67 * Reload fs and gs if they have changed in the signal 68 * handler. This does not handle long fs/gs base changes in 69 * the handler, but does not clobber them at least in the 70 * normal case. 71 */ 72 savesegment(gs, cur); 73 if (fixup_rpl(sc->gs) != cur) 74 load_gs_index(fixup_rpl(sc->gs)); 75 savesegment(fs, cur); 76 if (fixup_rpl(sc->fs) != cur) 77 loadsegment(fs, fixup_rpl(sc->fs)); 78 79 savesegment(ds, cur); 80 if (fixup_rpl(sc->ds) != cur) 81 loadsegment(ds, fixup_rpl(sc->ds)); 82 savesegment(es, cur); 83 if (fixup_rpl(sc->es) != cur) 84 loadsegment(es, fixup_rpl(sc->es)); 85 } 86 87 #define sigset32_t compat_sigset_t 88 #define siginfo32_t compat_siginfo_t 89 #define restore_altstack32 compat_restore_altstack 90 #define unsafe_save_altstack32 unsafe_compat_save_altstack 91 92 #else 93 94 #define sigset32_t sigset_t 95 #define siginfo32_t siginfo_t 96 #define __NR_ia32_sigreturn __NR_sigreturn 97 #define __NR_ia32_rt_sigreturn __NR_rt_sigreturn 98 #define restore_altstack32 restore_altstack 99 #define unsafe_save_altstack32 unsafe_save_altstack 100 #define __copy_siginfo_to_user32 copy_siginfo_to_user 101 102 #endif 103 104 /* 105 * Do a signal return; undo the signal stack. 106 */ 107 static bool ia32_restore_sigcontext(struct pt_regs *regs, 108 struct sigcontext_32 __user *usc) 109 { 110 struct sigcontext_32 sc; 111 112 /* Always make any pending restarted system calls return -EINTR */ 113 current->restart_block.fn = do_no_restart_syscall; 114 115 if (unlikely(copy_from_user(&sc, usc, sizeof(sc)))) 116 return false; 117 118 /* Get only the ia32 registers. */ 119 regs->bx = sc.bx; 120 regs->cx = sc.cx; 121 regs->dx = sc.dx; 122 regs->si = sc.si; 123 regs->di = sc.di; 124 regs->bp = sc.bp; 125 regs->ax = sc.ax; 126 regs->sp = sc.sp; 127 regs->ip = sc.ip; 128 129 /* Get CS/SS and force CPL3 */ 130 regs->cs = sc.cs | 0x03; 131 regs->ss = sc.ss | 0x03; 132 133 regs->flags = (regs->flags & ~FIX_EFLAGS) | (sc.flags & FIX_EFLAGS); 134 /* disable syscall checks */ 135 regs->orig_ax = -1; 136 137 #ifdef CONFIG_IA32_EMULATION 138 reload_segments(&sc); 139 #else 140 loadsegment(gs, fixup_rpl(sc.gs)); 141 regs->fs = fixup_rpl(sc.fs); 142 regs->es = fixup_rpl(sc.es); 143 regs->ds = fixup_rpl(sc.ds); 144 #endif 145 146 return fpu__restore_sig(compat_ptr(sc.fpstate), 1); 147 } 148 149 SYSCALL32_DEFINE0(sigreturn) 150 { 151 struct pt_regs *regs = current_pt_regs(); 152 struct sigframe_ia32 __user *frame = (struct sigframe_ia32 __user *)(regs->sp-8); 153 sigset_t set; 154 155 if (!access_ok(frame, sizeof(*frame))) 156 goto badframe; 157 if (__get_user(set.sig[0], &frame->sc.oldmask) 158 || __get_user(((__u32 *)&set)[1], &frame->extramask[0])) 159 goto badframe; 160 161 set_current_blocked(&set); 162 163 if (!ia32_restore_sigcontext(regs, &frame->sc)) 164 goto badframe; 165 return regs->ax; 166 167 badframe: 168 signal_fault(regs, frame, "32bit sigreturn"); 169 return 0; 170 } 171 172 SYSCALL32_DEFINE0(rt_sigreturn) 173 { 174 struct pt_regs *regs = current_pt_regs(); 175 struct rt_sigframe_ia32 __user *frame; 176 sigset_t set; 177 178 frame = (struct rt_sigframe_ia32 __user *)(regs->sp - 4); 179 180 if (!access_ok(frame, sizeof(*frame))) 181 goto badframe; 182 if (__get_user(*(__u64 *)&set, (__u64 __user *)&frame->uc.uc_sigmask)) 183 goto badframe; 184 185 set_current_blocked(&set); 186 187 if (!ia32_restore_sigcontext(regs, &frame->uc.uc_mcontext)) 188 goto badframe; 189 190 if (restore_altstack32(&frame->uc.uc_stack)) 191 goto badframe; 192 193 return regs->ax; 194 195 badframe: 196 signal_fault(regs, frame, "32bit rt sigreturn"); 197 return 0; 198 } 199 200 /* 201 * Set up a signal frame. 202 */ 203 204 #define get_user_seg(seg) ({ unsigned int v; savesegment(seg, v); v; }) 205 206 static __always_inline int 207 __unsafe_setup_sigcontext32(struct sigcontext_32 __user *sc, 208 void __user *fpstate, 209 struct pt_regs *regs, unsigned int mask) 210 { 211 unsafe_put_user(get_user_seg(gs), (unsigned int __user *)&sc->gs, Efault); 212 #ifdef CONFIG_IA32_EMULATION 213 unsafe_put_user(get_user_seg(fs), (unsigned int __user *)&sc->fs, Efault); 214 unsafe_put_user(get_user_seg(ds), (unsigned int __user *)&sc->ds, Efault); 215 unsafe_put_user(get_user_seg(es), (unsigned int __user *)&sc->es, Efault); 216 #else 217 unsafe_put_user(regs->fs, (unsigned int __user *)&sc->fs, Efault); 218 unsafe_put_user(regs->es, (unsigned int __user *)&sc->es, Efault); 219 unsafe_put_user(regs->ds, (unsigned int __user *)&sc->ds, Efault); 220 #endif 221 222 unsafe_put_user(regs->di, &sc->di, Efault); 223 unsafe_put_user(regs->si, &sc->si, Efault); 224 unsafe_put_user(regs->bp, &sc->bp, Efault); 225 unsafe_put_user(regs->sp, &sc->sp, Efault); 226 unsafe_put_user(regs->bx, &sc->bx, Efault); 227 unsafe_put_user(regs->dx, &sc->dx, Efault); 228 unsafe_put_user(regs->cx, &sc->cx, Efault); 229 unsafe_put_user(regs->ax, &sc->ax, Efault); 230 unsafe_put_user(current->thread.trap_nr, &sc->trapno, Efault); 231 unsafe_put_user(current->thread.error_code, &sc->err, Efault); 232 unsafe_put_user(regs->ip, &sc->ip, Efault); 233 unsafe_put_user(regs->cs, (unsigned int __user *)&sc->cs, Efault); 234 unsafe_put_user(regs->flags, &sc->flags, Efault); 235 unsafe_put_user(regs->sp, &sc->sp_at_signal, Efault); 236 unsafe_put_user(regs->ss, (unsigned int __user *)&sc->ss, Efault); 237 238 unsafe_put_user(ptr_to_compat(fpstate), &sc->fpstate, Efault); 239 240 /* non-iBCS2 extensions.. */ 241 unsafe_put_user(mask, &sc->oldmask, Efault); 242 unsafe_put_user(current->thread.cr2, &sc->cr2, Efault); 243 return 0; 244 245 Efault: 246 return -EFAULT; 247 } 248 249 #define unsafe_put_sigcontext32(sc, fp, regs, set, label) \ 250 do { \ 251 if (__unsafe_setup_sigcontext32(sc, fp, regs, set->sig[0])) \ 252 goto label; \ 253 } while(0) 254 255 int ia32_setup_frame(struct ksignal *ksig, struct pt_regs *regs) 256 { 257 sigset32_t *set = (sigset32_t *) sigmask_to_save(); 258 struct sigframe_ia32 __user *frame; 259 void __user *restorer; 260 void __user *fp = NULL; 261 262 /* copy_to_user optimizes that into a single 8 byte store */ 263 static const struct { 264 u16 poplmovl; 265 u32 val; 266 u16 int80; 267 } __attribute__((packed)) code = { 268 0xb858, /* popl %eax ; movl $...,%eax */ 269 __NR_ia32_sigreturn, 270 0x80cd, /* int $0x80 */ 271 }; 272 273 frame = get_sigframe(ksig, regs, sizeof(*frame), &fp); 274 275 if (ksig->ka.sa.sa_flags & SA_RESTORER) { 276 restorer = ksig->ka.sa.sa_restorer; 277 } else { 278 /* Return stub is in 32bit vsyscall page */ 279 if (current->mm->context.vdso) 280 restorer = current->mm->context.vdso + 281 vdso_image_32.sym___kernel_sigreturn; 282 else 283 restorer = &frame->retcode; 284 } 285 286 if (!user_access_begin(frame, sizeof(*frame))) 287 return -EFAULT; 288 289 unsafe_put_user(ksig->sig, &frame->sig, Efault); 290 unsafe_put_sigcontext32(&frame->sc, fp, regs, set, Efault); 291 unsafe_put_user(set->sig[1], &frame->extramask[0], Efault); 292 unsafe_put_user(ptr_to_compat(restorer), &frame->pretcode, Efault); 293 /* 294 * These are actually not used anymore, but left because some 295 * gdb versions depend on them as a marker. 296 */ 297 unsafe_put_user(*((u64 *)&code), (u64 __user *)frame->retcode, Efault); 298 user_access_end(); 299 300 /* Set up registers for signal handler */ 301 regs->sp = (unsigned long) frame; 302 regs->ip = (unsigned long) ksig->ka.sa.sa_handler; 303 304 /* Make -mregparm=3 work */ 305 regs->ax = ksig->sig; 306 regs->dx = 0; 307 regs->cx = 0; 308 309 #ifdef CONFIG_IA32_EMULATION 310 loadsegment(ds, __USER_DS); 311 loadsegment(es, __USER_DS); 312 #else 313 regs->ds = __USER_DS; 314 regs->es = __USER_DS; 315 #endif 316 317 regs->cs = __USER32_CS; 318 regs->ss = __USER_DS; 319 320 return 0; 321 Efault: 322 user_access_end(); 323 return -EFAULT; 324 } 325 326 int ia32_setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs) 327 { 328 sigset32_t *set = (sigset32_t *) sigmask_to_save(); 329 struct rt_sigframe_ia32 __user *frame; 330 void __user *restorer; 331 void __user *fp = NULL; 332 333 /* unsafe_put_user optimizes that into a single 8 byte store */ 334 static const struct { 335 u8 movl; 336 u32 val; 337 u16 int80; 338 u8 pad; 339 } __attribute__((packed)) code = { 340 0xb8, 341 __NR_ia32_rt_sigreturn, 342 0x80cd, 343 0, 344 }; 345 346 frame = get_sigframe(ksig, regs, sizeof(*frame), &fp); 347 348 if (!user_access_begin(frame, sizeof(*frame))) 349 return -EFAULT; 350 351 unsafe_put_user(ksig->sig, &frame->sig, Efault); 352 unsafe_put_user(ptr_to_compat(&frame->info), &frame->pinfo, Efault); 353 unsafe_put_user(ptr_to_compat(&frame->uc), &frame->puc, Efault); 354 355 /* Create the ucontext. */ 356 if (static_cpu_has(X86_FEATURE_XSAVE)) 357 unsafe_put_user(UC_FP_XSTATE, &frame->uc.uc_flags, Efault); 358 else 359 unsafe_put_user(0, &frame->uc.uc_flags, Efault); 360 unsafe_put_user(0, &frame->uc.uc_link, Efault); 361 unsafe_save_altstack32(&frame->uc.uc_stack, regs->sp, Efault); 362 363 if (ksig->ka.sa.sa_flags & SA_RESTORER) 364 restorer = ksig->ka.sa.sa_restorer; 365 else 366 restorer = current->mm->context.vdso + 367 vdso_image_32.sym___kernel_rt_sigreturn; 368 unsafe_put_user(ptr_to_compat(restorer), &frame->pretcode, Efault); 369 370 /* 371 * Not actually used anymore, but left because some gdb 372 * versions need it. 373 */ 374 unsafe_put_user(*((u64 *)&code), (u64 __user *)frame->retcode, Efault); 375 unsafe_put_sigcontext32(&frame->uc.uc_mcontext, fp, regs, set, Efault); 376 unsafe_put_user(*(__u64 *)set, (__u64 __user *)&frame->uc.uc_sigmask, Efault); 377 user_access_end(); 378 379 if (__copy_siginfo_to_user32(&frame->info, &ksig->info)) 380 return -EFAULT; 381 382 /* Set up registers for signal handler */ 383 regs->sp = (unsigned long) frame; 384 regs->ip = (unsigned long) ksig->ka.sa.sa_handler; 385 386 /* Make -mregparm=3 work */ 387 regs->ax = ksig->sig; 388 regs->dx = (unsigned long) &frame->info; 389 regs->cx = (unsigned long) &frame->uc; 390 391 #ifdef CONFIG_IA32_EMULATION 392 loadsegment(ds, __USER_DS); 393 loadsegment(es, __USER_DS); 394 #else 395 regs->ds = __USER_DS; 396 regs->es = __USER_DS; 397 #endif 398 399 regs->cs = __USER32_CS; 400 regs->ss = __USER_DS; 401 402 return 0; 403 Efault: 404 user_access_end(); 405 return -EFAULT; 406 } 407 408 /* 409 * The siginfo_t structure and handing code is very easy 410 * to break in several ways. It must always be updated when new 411 * updates are made to the main siginfo_t, and 412 * copy_siginfo_to_user32() must be updated when the 413 * (arch-independent) copy_siginfo_to_user() is updated. 414 * 415 * It is also easy to put a new member in the siginfo_t 416 * which has implicit alignment which can move internal structure 417 * alignment around breaking the ABI. This can happen if you, 418 * for instance, put a plain 64-bit value in there. 419 */ 420 421 /* 422 * If adding a new si_code, there is probably new data in 423 * the siginfo. Make sure folks bumping the si_code 424 * limits also have to look at this code. Make sure any 425 * new fields are handled in copy_siginfo_to_user32()! 426 */ 427 static_assert(NSIGILL == 11); 428 static_assert(NSIGFPE == 15); 429 static_assert(NSIGSEGV == 10); 430 static_assert(NSIGBUS == 5); 431 static_assert(NSIGTRAP == 6); 432 static_assert(NSIGCHLD == 6); 433 static_assert(NSIGSYS == 2); 434 435 /* This is part of the ABI and can never change in size: */ 436 static_assert(sizeof(siginfo32_t) == 128); 437 438 /* This is a part of the ABI and can never change in alignment */ 439 static_assert(__alignof__(siginfo32_t) == 4); 440 441 /* 442 * The offsets of all the (unioned) si_fields are fixed 443 * in the ABI, of course. Make sure none of them ever 444 * move and are always at the beginning: 445 */ 446 static_assert(offsetof(siginfo32_t, _sifields) == 3 * sizeof(int)); 447 448 static_assert(offsetof(siginfo32_t, si_signo) == 0); 449 static_assert(offsetof(siginfo32_t, si_errno) == 4); 450 static_assert(offsetof(siginfo32_t, si_code) == 8); 451 452 /* 453 * Ensure that the size of each si_field never changes. 454 * If it does, it is a sign that the 455 * copy_siginfo_to_user32() code below needs to updated 456 * along with the size in the CHECK_SI_SIZE(). 457 * 458 * We repeat this check for both the generic and compat 459 * siginfos. 460 * 461 * Note: it is OK for these to grow as long as the whole 462 * structure stays within the padding size (checked 463 * above). 464 */ 465 466 #define CHECK_SI_OFFSET(name) \ 467 static_assert(offsetof(siginfo32_t, _sifields) == \ 468 offsetof(siginfo32_t, _sifields.name)) 469 470 #define CHECK_SI_SIZE(name, size) \ 471 static_assert(sizeof_field(siginfo32_t, _sifields.name) == size) 472 473 CHECK_SI_OFFSET(_kill); 474 CHECK_SI_SIZE (_kill, 2*sizeof(int)); 475 static_assert(offsetof(siginfo32_t, si_pid) == 0xC); 476 static_assert(offsetof(siginfo32_t, si_uid) == 0x10); 477 478 CHECK_SI_OFFSET(_timer); 479 #ifdef CONFIG_COMPAT 480 /* compat_siginfo_t doesn't have si_sys_private */ 481 CHECK_SI_SIZE (_timer, 3*sizeof(int)); 482 #else 483 CHECK_SI_SIZE (_timer, 4*sizeof(int)); 484 #endif 485 static_assert(offsetof(siginfo32_t, si_tid) == 0x0C); 486 static_assert(offsetof(siginfo32_t, si_overrun) == 0x10); 487 static_assert(offsetof(siginfo32_t, si_value) == 0x14); 488 489 CHECK_SI_OFFSET(_rt); 490 CHECK_SI_SIZE (_rt, 3*sizeof(int)); 491 static_assert(offsetof(siginfo32_t, si_pid) == 0x0C); 492 static_assert(offsetof(siginfo32_t, si_uid) == 0x10); 493 static_assert(offsetof(siginfo32_t, si_value) == 0x14); 494 495 CHECK_SI_OFFSET(_sigchld); 496 CHECK_SI_SIZE (_sigchld, 5*sizeof(int)); 497 static_assert(offsetof(siginfo32_t, si_pid) == 0x0C); 498 static_assert(offsetof(siginfo32_t, si_uid) == 0x10); 499 static_assert(offsetof(siginfo32_t, si_status) == 0x14); 500 static_assert(offsetof(siginfo32_t, si_utime) == 0x18); 501 static_assert(offsetof(siginfo32_t, si_stime) == 0x1C); 502 503 CHECK_SI_OFFSET(_sigfault); 504 CHECK_SI_SIZE (_sigfault, 4*sizeof(int)); 505 static_assert(offsetof(siginfo32_t, si_addr) == 0x0C); 506 507 static_assert(offsetof(siginfo32_t, si_trapno) == 0x10); 508 509 static_assert(offsetof(siginfo32_t, si_addr_lsb) == 0x10); 510 511 static_assert(offsetof(siginfo32_t, si_lower) == 0x14); 512 static_assert(offsetof(siginfo32_t, si_upper) == 0x18); 513 514 static_assert(offsetof(siginfo32_t, si_pkey) == 0x14); 515 516 static_assert(offsetof(siginfo32_t, si_perf_data) == 0x10); 517 static_assert(offsetof(siginfo32_t, si_perf_type) == 0x14); 518 static_assert(offsetof(siginfo32_t, si_perf_flags) == 0x18); 519 520 CHECK_SI_OFFSET(_sigpoll); 521 CHECK_SI_SIZE (_sigpoll, 2*sizeof(int)); 522 static_assert(offsetof(siginfo32_t, si_band) == 0x0C); 523 static_assert(offsetof(siginfo32_t, si_fd) == 0x10); 524 525 CHECK_SI_OFFSET(_sigsys); 526 CHECK_SI_SIZE (_sigsys, 3*sizeof(int)); 527 static_assert(offsetof(siginfo32_t, si_call_addr) == 0x0C); 528 static_assert(offsetof(siginfo32_t, si_syscall) == 0x10); 529 static_assert(offsetof(siginfo32_t, si_arch) == 0x14); 530 531 /* any new si_fields should be added here */ 532