8a15ac8378
If multithreaded non-Linux process execs Linux binary, then non-Linux threads different from the one that execing are cleared by single-threading at boundary, and then terminating them in post_execve(). Since at that time the process is already switched to linux ABI, linuxolator is involved in the thread clearing on boundary, but cannot find the emul data. Handle it by pre-creating emuldata for all threads in the execing process. Also remove a code in linux_proc_exec() handler that cleared emul data for other threads when execing from multithreaded Linux process. It is excessive. PR: 247020 Reported by: Martin FIlla <freebsd@sysctl.cz> Reported by: Henrique L. Amorim, Independent Security Researcher Reported by: Rodrigo Rubira Branco (BSDaemon), Amazon Web Services Reviewed by: markj Tested by: trasz Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D25293
385 lines
9.6 KiB
C
385 lines
9.6 KiB
C
/*-
|
|
* SPDX-License-Identifier: BSD-2-Clause-FreeBSD
|
|
*
|
|
* Copyright (c) 1994-1996 Søren Schmidt
|
|
* Copyright (c) 2006 Roman Divacky
|
|
* Copyright (c) 2013 Dmitry Chagin
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
|
|
#include <sys/cdefs.h>
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
#include <sys/param.h>
|
|
#include <sys/systm.h>
|
|
#include <sys/fcntl.h>
|
|
#include <sys/imgact.h>
|
|
#include <sys/kernel.h>
|
|
#include <sys/ktr.h>
|
|
#include <sys/lock.h>
|
|
#include <sys/malloc.h>
|
|
#include <sys/mutex.h>
|
|
#include <sys/sx.h>
|
|
#include <sys/proc.h>
|
|
#include <sys/resourcevar.h>
|
|
#include <sys/syscallsubr.h>
|
|
#include <sys/sysent.h>
|
|
|
|
#include <compat/linux/linux_emul.h>
|
|
#include <compat/linux/linux_mib.h>
|
|
#include <compat/linux/linux_misc.h>
|
|
#include <compat/linux/linux_persona.h>
|
|
#include <compat/linux/linux_util.h>
|
|
|
|
#if BYTE_ORDER == LITTLE_ENDIAN
|
|
#define SHELLMAGIC 0x2123 /* #! */
|
|
#else
|
|
#define SHELLMAGIC 0x2321
|
|
#endif
|
|
|
|
/*
|
|
* This returns reference to the thread emuldata entry (if found)
|
|
*
|
|
* Hold PROC_LOCK when referencing emuldata from other threads.
|
|
*/
|
|
struct linux_emuldata *
|
|
em_find(struct thread *td)
|
|
{
|
|
struct linux_emuldata *em;
|
|
|
|
em = td->td_emuldata;
|
|
|
|
return (em);
|
|
}
|
|
|
|
/*
|
|
* This returns reference to the proc pemuldata entry (if found)
|
|
*
|
|
* Hold PROC_LOCK when referencing proc pemuldata from other threads.
|
|
* Hold LINUX_PEM_LOCK wher referencing pemuldata members.
|
|
*/
|
|
struct linux_pemuldata *
|
|
pem_find(struct proc *p)
|
|
{
|
|
struct linux_pemuldata *pem;
|
|
|
|
pem = p->p_emuldata;
|
|
|
|
return (pem);
|
|
}
|
|
|
|
/*
|
|
* Linux apps generally expect the soft open file limit to be set
|
|
* to 1024, often iterating over all the file descriptors up to that
|
|
* limit instead of using closefrom(2). Give them what they want,
|
|
* unless there already is a resource limit in place.
|
|
*/
|
|
static void
|
|
linux_set_default_openfiles(struct thread *td, struct proc *p)
|
|
{
|
|
struct rlimit rlim;
|
|
int error;
|
|
|
|
if (linux_default_openfiles < 0)
|
|
return;
|
|
|
|
PROC_LOCK(p);
|
|
lim_rlimit_proc(p, RLIMIT_NOFILE, &rlim);
|
|
PROC_UNLOCK(p);
|
|
if (rlim.rlim_cur != rlim.rlim_max ||
|
|
rlim.rlim_cur <= linux_default_openfiles)
|
|
return;
|
|
rlim.rlim_cur = linux_default_openfiles;
|
|
error = kern_proc_setrlimit(td, p, RLIMIT_NOFILE, &rlim);
|
|
KASSERT(error == 0, ("kern_proc_setrlimit failed"));
|
|
}
|
|
|
|
void
|
|
linux_proc_init(struct thread *td, struct thread *newtd, int flags)
|
|
{
|
|
struct linux_emuldata *em;
|
|
struct linux_pemuldata *pem;
|
|
struct epoll_emuldata *emd;
|
|
struct proc *p;
|
|
|
|
if (newtd != NULL) {
|
|
p = newtd->td_proc;
|
|
|
|
/* non-exec call */
|
|
em = malloc(sizeof(*em), M_TEMP, M_WAITOK | M_ZERO);
|
|
if (flags & LINUX_CLONE_THREAD) {
|
|
LINUX_CTR1(proc_init, "thread newtd(%d)",
|
|
newtd->td_tid);
|
|
|
|
em->em_tid = newtd->td_tid;
|
|
} else {
|
|
LINUX_CTR1(proc_init, "fork newtd(%d)", p->p_pid);
|
|
|
|
em->em_tid = p->p_pid;
|
|
|
|
pem = malloc(sizeof(*pem), M_LINUX, M_WAITOK | M_ZERO);
|
|
sx_init(&pem->pem_sx, "lpemlk");
|
|
p->p_emuldata = pem;
|
|
}
|
|
newtd->td_emuldata = em;
|
|
|
|
linux_set_default_openfiles(td, p);
|
|
} else {
|
|
p = td->td_proc;
|
|
|
|
/* exec */
|
|
LINUX_CTR1(proc_init, "exec newtd(%d)", p->p_pid);
|
|
|
|
/* lookup the old one */
|
|
em = em_find(td);
|
|
KASSERT(em != NULL, ("proc_init: emuldata not found in exec case.\n"));
|
|
|
|
em->em_tid = p->p_pid;
|
|
em->flags = 0;
|
|
em->robust_futexes = NULL;
|
|
em->child_clear_tid = NULL;
|
|
em->child_set_tid = NULL;
|
|
|
|
/* epoll should be destroyed in a case of exec. */
|
|
pem = pem_find(p);
|
|
KASSERT(pem != NULL, ("proc_exit: proc emuldata not found.\n"));
|
|
pem->persona = 0;
|
|
if (pem->epoll != NULL) {
|
|
emd = pem->epoll;
|
|
pem->epoll = NULL;
|
|
free(emd, M_EPOLL);
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
void
|
|
linux_proc_exit(void *arg __unused, struct proc *p)
|
|
{
|
|
struct linux_pemuldata *pem;
|
|
struct epoll_emuldata *emd;
|
|
struct thread *td = curthread;
|
|
|
|
if (__predict_false(SV_CURPROC_ABI() != SV_ABI_LINUX))
|
|
return;
|
|
|
|
LINUX_CTR3(proc_exit, "thread(%d) proc(%d) p %p",
|
|
td->td_tid, p->p_pid, p);
|
|
|
|
pem = pem_find(p);
|
|
if (pem == NULL)
|
|
return;
|
|
(p->p_sysent->sv_thread_detach)(td);
|
|
|
|
p->p_emuldata = NULL;
|
|
|
|
if (pem->epoll != NULL) {
|
|
emd = pem->epoll;
|
|
pem->epoll = NULL;
|
|
free(emd, M_EPOLL);
|
|
}
|
|
|
|
sx_destroy(&pem->pem_sx);
|
|
free(pem, M_LINUX);
|
|
}
|
|
|
|
/*
|
|
* If a Linux binary is exec'ing something, try this image activator
|
|
* first. We override standard shell script execution in order to
|
|
* be able to modify the interpreter path. We only do this if a Linux
|
|
* binary is doing the exec, so we do not create an EXEC module for it.
|
|
*/
|
|
int
|
|
linux_exec_imgact_try(struct image_params *imgp)
|
|
{
|
|
const char *head = (const char *)imgp->image_header;
|
|
char *rpath;
|
|
int error = -1;
|
|
|
|
/*
|
|
* The interpreter for shell scripts run from a Linux binary needs
|
|
* to be located in /compat/linux if possible in order to recursively
|
|
* maintain Linux path emulation.
|
|
*/
|
|
if (((const short *)head)[0] == SHELLMAGIC) {
|
|
/*
|
|
* Run our normal shell image activator. If it succeeds attempt
|
|
* to use the alternate path for the interpreter. If an
|
|
* alternate path is found, use our stringspace to store it.
|
|
*/
|
|
if ((error = exec_shell_imgact(imgp)) == 0) {
|
|
linux_emul_convpath(FIRST_THREAD_IN_PROC(imgp->proc),
|
|
imgp->interpreter_name, UIO_SYSSPACE, &rpath, 0,
|
|
AT_FDCWD);
|
|
if (rpath != NULL)
|
|
imgp->args->fname_buf =
|
|
imgp->interpreter_name = rpath;
|
|
}
|
|
}
|
|
return (error);
|
|
}
|
|
|
|
int
|
|
linux_common_execve(struct thread *td, struct image_args *eargs)
|
|
{
|
|
struct linux_pemuldata *pem;
|
|
struct epoll_emuldata *emd;
|
|
struct vmspace *oldvmspace;
|
|
struct linux_emuldata *em;
|
|
struct proc *p;
|
|
int error;
|
|
|
|
p = td->td_proc;
|
|
|
|
error = pre_execve(td, &oldvmspace);
|
|
if (error != 0)
|
|
return (error);
|
|
|
|
error = kern_execve(td, eargs, NULL);
|
|
post_execve(td, error, oldvmspace);
|
|
if (error != EJUSTRETURN)
|
|
return (error);
|
|
|
|
/*
|
|
* In a case of transition from Linux binary execing to
|
|
* FreeBSD binary we destroy Linux emuldata thread & proc entries.
|
|
*/
|
|
if (SV_CURPROC_ABI() != SV_ABI_LINUX) {
|
|
PROC_LOCK(p);
|
|
em = em_find(td);
|
|
KASSERT(em != NULL, ("proc_exec: thread emuldata not found.\n"));
|
|
td->td_emuldata = NULL;
|
|
|
|
pem = pem_find(p);
|
|
KASSERT(pem != NULL, ("proc_exec: proc pemuldata not found.\n"));
|
|
p->p_emuldata = NULL;
|
|
PROC_UNLOCK(p);
|
|
|
|
if (pem->epoll != NULL) {
|
|
emd = pem->epoll;
|
|
pem->epoll = NULL;
|
|
free(emd, M_EPOLL);
|
|
}
|
|
|
|
free(em, M_TEMP);
|
|
free(pem, M_LINUX);
|
|
}
|
|
return (EJUSTRETURN);
|
|
}
|
|
|
|
void
|
|
linux_proc_exec(void *arg __unused, struct proc *p, struct image_params *imgp)
|
|
{
|
|
struct thread *td;
|
|
struct thread *othertd;
|
|
#if defined(__amd64__)
|
|
struct linux_pemuldata *pem;
|
|
#endif
|
|
|
|
td = curthread;
|
|
|
|
/*
|
|
* In a case of execing to Linux binary we create Linux
|
|
* emuldata thread entry.
|
|
*/
|
|
if (__predict_false((imgp->sysent->sv_flags & SV_ABI_MASK) ==
|
|
SV_ABI_LINUX)) {
|
|
if (SV_PROC_ABI(p) == SV_ABI_LINUX) {
|
|
/*
|
|
* Process already was under Linuxolator
|
|
* before exec. Update emuldata to reflect
|
|
* single-threaded cleaned state after exec.
|
|
*/
|
|
linux_proc_init(td, NULL, 0);
|
|
} else {
|
|
/*
|
|
* We are switching the process to Linux emulator.
|
|
*/
|
|
linux_proc_init(td, td, 0);
|
|
|
|
/*
|
|
* Create a transient td_emuldata for all suspended
|
|
* threads, so that p->p_sysent->sv_thread_detach() ==
|
|
* linux_thread_detach() can find expected but unused
|
|
* emuldata.
|
|
*/
|
|
FOREACH_THREAD_IN_PROC(td->td_proc, othertd) {
|
|
if (othertd != td) {
|
|
linux_proc_init(td, othertd,
|
|
LINUX_CLONE_THREAD);
|
|
}
|
|
}
|
|
}
|
|
#if defined(__amd64__)
|
|
/*
|
|
* An IA32 executable which has executable stack will have the
|
|
* READ_IMPLIES_EXEC personality flag set automatically.
|
|
*/
|
|
if (SV_PROC_FLAG(td->td_proc, SV_ILP32) &&
|
|
imgp->stack_prot & VM_PROT_EXECUTE) {
|
|
pem = pem_find(p);
|
|
pem->persona |= LINUX_READ_IMPLIES_EXEC;
|
|
}
|
|
#endif
|
|
}
|
|
}
|
|
|
|
void
|
|
linux_thread_dtor(void *arg __unused, struct thread *td)
|
|
{
|
|
struct linux_emuldata *em;
|
|
|
|
em = em_find(td);
|
|
if (em == NULL)
|
|
return;
|
|
td->td_emuldata = NULL;
|
|
|
|
LINUX_CTR1(thread_dtor, "thread(%d)", em->em_tid);
|
|
|
|
free(em, M_TEMP);
|
|
}
|
|
|
|
void
|
|
linux_schedtail(struct thread *td)
|
|
{
|
|
struct linux_emuldata *em;
|
|
struct proc *p;
|
|
int error = 0;
|
|
int *child_set_tid;
|
|
|
|
p = td->td_proc;
|
|
|
|
em = em_find(td);
|
|
KASSERT(em != NULL, ("linux_schedtail: thread emuldata not found.\n"));
|
|
child_set_tid = em->child_set_tid;
|
|
|
|
if (child_set_tid != NULL) {
|
|
error = copyout(&em->em_tid, child_set_tid,
|
|
sizeof(em->em_tid));
|
|
LINUX_CTR4(schedtail, "thread(%d) %p stored %d error %d",
|
|
td->td_tid, child_set_tid, em->em_tid, error);
|
|
} else
|
|
LINUX_CTR1(schedtail, "thread(%d)", em->em_tid);
|
|
}
|