1 #include <linux/kernel.h>
2 #include <linux/syscalls.h>
3 #include <linux/fdtable.h>
4 #include <linux/string.h>
5 #include <linux/random.h>
6 #include <linux/module.h>
7 #include <linux/ptrace.h>
8 #include <linux/init.h>
9 #include <linux/errno.h>
10 #include <linux/cache.h>
11 #include <linux/bug.h>
12 #include <linux/err.h>
13 #include <linux/kcmp.h>
15 #include <asm/unistd.h>
18 * We don't expose the real in-memory order of objects for security reasons.
19 * But still the comparison results should be suitable for sorting. So we
20 * obfuscate kernel pointers values and compare the production instead.
22 * The obfuscation is done in two steps. First we xor the kernel pointer with
23 * a random value, which puts pointer into a new position in a reordered space.
24 * Secondly we multiply the xor production with a large odd random number to
25 * permute its bits even more (the odd multiplier guarantees that the product
26 * is unique ever after the high bits are truncated, since any odd number is
27 * relative prime to 2^n).
29 * Note also that the obfuscation itself is invisible to userspace and if needed
30 * it can be changed to an alternate scheme.
32 static unsigned long cookies
[KCMP_TYPES
][2] __read_mostly
;
34 static long kptr_obfuscate(long v
, int type
)
36 return (v
^ cookies
[type
][0]) * cookies
[type
][1];
40 * 0 - equal, i.e. v1 = v2
41 * 1 - less than, i.e. v1 < v2
42 * 2 - greater than, i.e. v1 > v2
43 * 3 - not equal but ordering unavailable (reserved for future)
45 static int kcmp_ptr(void *v1
, void *v2
, enum kcmp_type type
)
49 ret
= kptr_obfuscate((long)v1
, type
) - kptr_obfuscate((long)v2
, type
);
51 return (ret
< 0) | ((ret
> 0) << 1);
54 /* The caller must have pinned the task */
56 get_file_raw_ptr(struct task_struct
*task
, unsigned int idx
)
58 struct file
*file
= NULL
;
64 file
= fcheck_files(task
->files
, idx
);
72 static void kcmp_unlock(struct mutex
*m1
, struct mutex
*m2
)
79 static int kcmp_lock(struct mutex
*m1
, struct mutex
*m2
)
86 err
= mutex_lock_killable(m1
);
87 if (!err
&& likely(m1
!= m2
)) {
88 err
= mutex_lock_killable_nested(m2
, SINGLE_DEPTH_NESTING
);
96 SYSCALL_DEFINE5(kcmp
, pid_t
, pid1
, pid_t
, pid2
, int, type
,
97 unsigned long, idx1
, unsigned long, idx2
)
99 struct task_struct
*task1
, *task2
;
105 * Tasks are looked up in caller's PID namespace only.
107 task1
= find_task_by_vpid(pid1
);
108 task2
= find_task_by_vpid(pid2
);
109 if (!task1
|| !task2
)
112 get_task_struct(task1
);
113 get_task_struct(task2
);
118 * One should have enough rights to inspect task details.
120 ret
= kcmp_lock(&task1
->signal
->cred_guard_mutex
,
121 &task2
->signal
->cred_guard_mutex
);
124 if (!ptrace_may_access(task1
, PTRACE_MODE_READ
) ||
125 !ptrace_may_access(task2
, PTRACE_MODE_READ
)) {
132 struct file
*filp1
, *filp2
;
134 filp1
= get_file_raw_ptr(task1
, idx1
);
135 filp2
= get_file_raw_ptr(task2
, idx2
);
138 ret
= kcmp_ptr(filp1
, filp2
, KCMP_FILE
);
144 ret
= kcmp_ptr(task1
->mm
, task2
->mm
, KCMP_VM
);
147 ret
= kcmp_ptr(task1
->files
, task2
->files
, KCMP_FILES
);
150 ret
= kcmp_ptr(task1
->fs
, task2
->fs
, KCMP_FS
);
153 ret
= kcmp_ptr(task1
->sighand
, task2
->sighand
, KCMP_SIGHAND
);
156 ret
= kcmp_ptr(task1
->io_context
, task2
->io_context
, KCMP_IO
);
159 #ifdef CONFIG_SYSVIPC
160 ret
= kcmp_ptr(task1
->sysvsem
.undo_list
,
161 task2
->sysvsem
.undo_list
,
173 kcmp_unlock(&task1
->signal
->cred_guard_mutex
,
174 &task2
->signal
->cred_guard_mutex
);
176 put_task_struct(task1
);
177 put_task_struct(task2
);
186 static __init
int kcmp_cookies_init(void)
190 get_random_bytes(cookies
, sizeof(cookies
));
192 for (i
= 0; i
< KCMP_TYPES
; i
++)
193 cookies
[i
][1] |= (~(~0UL >> 1) | 1);
197 arch_initcall(kcmp_cookies_init
);
This page took 0.033702 seconds and 5 git commands to generate.