|
@@ -9,6 +9,7 @@
|
|
#include <linux/gfp.h>
|
|
#include <linux/gfp.h>
|
|
#include <linux/init.h>
|
|
#include <linux/init.h>
|
|
#include <linux/stringify.h>
|
|
#include <linux/stringify.h>
|
|
|
|
+#include <linux/security.h>
|
|
#include <asm/proto.h>
|
|
#include <asm/proto.h>
|
|
#include <asm/tlbflush.h>
|
|
#include <asm/tlbflush.h>
|
|
#include <asm/ia32_unistd.h>
|
|
#include <asm/ia32_unistd.h>
|
|
@@ -30,51 +31,57 @@ extern int sysctl_vsyscall32;
|
|
char *syscall32_page;
|
|
char *syscall32_page;
|
|
static int use_sysenter = -1;
|
|
static int use_sysenter = -1;
|
|
|
|
|
|
-/*
|
|
|
|
- * Map the 32bit vsyscall page on demand.
|
|
|
|
- *
|
|
|
|
- * RED-PEN: This knows too much about high level VM.
|
|
|
|
- *
|
|
|
|
- * Alternative would be to generate a vma with appropriate backing options
|
|
|
|
- * and let it be handled by generic VM.
|
|
|
|
- */
|
|
|
|
-int __map_syscall32(struct mm_struct *mm, unsigned long address)
|
|
|
|
-{
|
|
|
|
- pgd_t *pgd;
|
|
|
|
- pud_t *pud;
|
|
|
|
- pte_t *pte;
|
|
|
|
- pmd_t *pmd;
|
|
|
|
- int err = -ENOMEM;
|
|
|
|
-
|
|
|
|
- spin_lock(&mm->page_table_lock);
|
|
|
|
- pgd = pgd_offset(mm, address);
|
|
|
|
- pud = pud_alloc(mm, pgd, address);
|
|
|
|
- if (pud) {
|
|
|
|
- pmd = pmd_alloc(mm, pud, address);
|
|
|
|
- if (pmd && (pte = pte_alloc_map(mm, pmd, address)) != NULL) {
|
|
|
|
- if (pte_none(*pte)) {
|
|
|
|
- set_pte(pte,
|
|
|
|
- mk_pte(virt_to_page(syscall32_page),
|
|
|
|
- PAGE_KERNEL_VSYSCALL32));
|
|
|
|
- }
|
|
|
|
- /* Flush only the local CPU. Other CPUs taking a fault
|
|
|
|
- will just end up here again
|
|
|
|
- This probably not needed and just paranoia. */
|
|
|
|
- __flush_tlb_one(address);
|
|
|
|
- err = 0;
|
|
|
|
- }
|
|
|
|
- }
|
|
|
|
- spin_unlock(&mm->page_table_lock);
|
|
|
|
- return err;
|
|
|
|
|
|
+static struct page *
|
|
|
|
+syscall32_nopage(struct vm_area_struct *vma, unsigned long adr, int *type)
|
|
|
|
+{
|
|
|
|
+ struct page *p = virt_to_page(adr - vma->vm_start + syscall32_page);
|
|
|
|
+ get_page(p);
|
|
|
|
+ return p;
|
|
}
|
|
}
|
|
|
|
|
|
-int map_syscall32(struct mm_struct *mm, unsigned long address)
|
|
|
|
|
|
+/* Prevent VMA merging */
|
|
|
|
+static void syscall32_vma_close(struct vm_area_struct *vma)
|
|
{
|
|
{
|
|
- int err;
|
|
|
|
- down_read(&mm->mmap_sem);
|
|
|
|
- err = __map_syscall32(mm, address);
|
|
|
|
- up_read(&mm->mmap_sem);
|
|
|
|
- return err;
|
|
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+static struct vm_operations_struct syscall32_vm_ops = {
|
|
|
|
+ .close = syscall32_vma_close,
|
|
|
|
+ .nopage = syscall32_nopage,
|
|
|
|
+};
|
|
|
|
+
|
|
|
|
+struct linux_binprm;
|
|
|
|
+
|
|
|
|
+/* Setup a VMA at program startup for the vsyscall page */
|
|
|
|
+int syscall32_setup_pages(struct linux_binprm *bprm, int exstack)
|
|
|
|
+{
|
|
|
|
+ int npages = (VSYSCALL32_END - VSYSCALL32_BASE) >> PAGE_SHIFT;
|
|
|
|
+ struct vm_area_struct *vma;
|
|
|
|
+ struct mm_struct *mm = current->mm;
|
|
|
|
+
|
|
|
|
+ vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
|
|
|
|
+ if (!vma)
|
|
|
|
+ return -ENOMEM;
|
|
|
|
+ if (security_vm_enough_memory(npages)) {
|
|
|
|
+ kmem_cache_free(vm_area_cachep, vma);
|
|
|
|
+ return -ENOMEM;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ memset(vma, 0, sizeof(struct vm_area_struct));
|
|
|
|
+ /* Could randomize here */
|
|
|
|
+ vma->vm_start = VSYSCALL32_BASE;
|
|
|
|
+ vma->vm_end = VSYSCALL32_END;
|
|
|
|
+ /* MAYWRITE to allow gdb to COW and set breakpoints */
|
|
|
|
+ vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC|VM_MAYEXEC|VM_MAYWRITE;
|
|
|
|
+ vma->vm_flags |= mm->def_flags;
|
|
|
|
+ vma->vm_page_prot = protection_map[vma->vm_flags & 7];
|
|
|
|
+ vma->vm_ops = &syscall32_vm_ops;
|
|
|
|
+ vma->vm_mm = mm;
|
|
|
|
+
|
|
|
|
+ down_write(&mm->mmap_sem);
|
|
|
|
+ insert_vm_struct(mm, vma);
|
|
|
|
+ mm->total_vm += npages;
|
|
|
|
+ up_write(&mm->mmap_sem);
|
|
|
|
+ return 0;
|
|
}
|
|
}
|
|
|
|
|
|
static int __init init_syscall32(void)
|
|
static int __init init_syscall32(void)
|
|
@@ -82,7 +89,6 @@ static int __init init_syscall32(void)
|
|
syscall32_page = (void *)get_zeroed_page(GFP_KERNEL);
|
|
syscall32_page = (void *)get_zeroed_page(GFP_KERNEL);
|
|
if (!syscall32_page)
|
|
if (!syscall32_page)
|
|
panic("Cannot allocate syscall32 page");
|
|
panic("Cannot allocate syscall32 page");
|
|
- SetPageReserved(virt_to_page(syscall32_page));
|
|
|
|
if (use_sysenter > 0) {
|
|
if (use_sysenter > 0) {
|
|
memcpy(syscall32_page, syscall32_sysenter,
|
|
memcpy(syscall32_page, syscall32_sysenter,
|
|
syscall32_sysenter_end - syscall32_sysenter);
|
|
syscall32_sysenter_end - syscall32_sysenter);
|