1 files changed, 42 insertions, 14 deletions

diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
index 7515cf0e1805..8d141b309046 100644
--- a/arch/x86/kernel/vsyscall_64.c
+++ b/arch/x86/kernel/vsyscall_64.c
@@ -18,6 +18,8 @@
  *  use the vDSO.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/time.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -111,18 +113,13 @@ void update_vsyscall(struct timespec *wall_time, struct timespec *wtm,
 static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
                               const char *message)
 {
-        static DEFINE_RATELIMIT_STATE(rs, DEFAULT_RATELIMIT_INTERVAL, DEFAULT_RATELIMIT_BURST);
-        struct task_struct *tsk;
-
-        if (!show_unhandled_signals || !__ratelimit(&rs))
+        if (!show_unhandled_signals)
                 return;
 
-        tsk = current;
-
-        printk("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
-               level, tsk->comm, task_pid_nr(tsk),
-               message, regs->ip, regs->cs,
-               regs->sp, regs->ax, regs->si, regs->di);
+        pr_notice_ratelimited("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
+                              level, current->comm, task_pid_nr(current),
+                              message, regs->ip, regs->cs,
+                              regs->sp, regs->ax, regs->si, regs->di);
 }
 
 static int addr_to_vsyscall_nr(unsigned long addr)
@@ -139,6 +136,19 @@ static int addr_to_vsyscall_nr(unsigned long addr)
         return nr;
 }
 
+#ifdef CONFIG_SECCOMP
+static int vsyscall_seccomp(struct task_struct *tsk, int syscall_nr)
+{
+        if (!seccomp_mode(&tsk->seccomp))
+                return 0;
+        task_pt_regs(tsk)->orig_ax = syscall_nr;
+        task_pt_regs(tsk)->ax = syscall_nr;
+        return __secure_computing(syscall_nr);
+}
+#else
+#define vsyscall_seccomp(_tsk, _nr) 0
+#endif
+
 static bool write_ok_or_segv(unsigned long ptr, size_t size)
 {
         /*
@@ -174,6 +184,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
         int vsyscall_nr;
         int prev_sig_on_uaccess_error;
         long ret;
+        int skip;
 
         /*
          * No point in checking CS -- the only way to get here is a user mode
@@ -205,9 +216,6 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
         }
 
         tsk = current;
-        if (seccomp_mode(&tsk->seccomp))
-                do_exit(SIGKILL);
-
         /*
          * With a real vsyscall, page faults cause SIGSEGV.  We want to
          * preserve that behavior to make writing exploits harder.
@@ -222,8 +230,13 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
          * address 0".
          */
         ret = -EFAULT;
+        skip = 0;
         switch (vsyscall_nr) {
         case 0:
+                skip = vsyscall_seccomp(tsk, __NR_gettimeofday);
+                if (skip)
+                        break;
+
                 if (!write_ok_or_segv(regs->di, sizeof(struct timeval)) ||
                     !write_ok_or_segv(regs->si, sizeof(struct timezone)))
                         break;
@@ -234,6 +247,10 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
                 break;
 
         case 1:
+                skip = vsyscall_seccomp(tsk, __NR_time);
+                if (skip)
+                        break;
+
                 if (!write_ok_or_segv(regs->di, sizeof(time_t)))
                         break;
 
@@ -241,6 +258,10 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
                 break;
 
         case 2:
+                skip = vsyscall_seccomp(tsk, __NR_getcpu);
+                if (skip)
+                        break;
+
                 if (!write_ok_or_segv(regs->di, sizeof(unsigned)) ||
                     !write_ok_or_segv(regs->si, sizeof(unsigned)))
                         break;
@@ -253,6 +274,12 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
 
         current_thread_info()->sig_on_uaccess_error = prev_sig_on_uaccess_error;
 
+        if (skip) {
+                if ((long)regs->ax <= 0L) /* seccomp errno emulation */
+                        goto do_ret;
+                goto done; /* seccomp trace/trap */
+        }
+
         if (ret == -EFAULT) {
                 /* Bad news -- userspace fed a bad pointer to a vsyscall. */
                 warn_bad_vsyscall(KERN_INFO, regs,
@@ -271,10 +298,11 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
 
         regs->ax = ret;
 
+do_ret:
         /* Emulate a ret instruction. */
         regs->ip = caller;
         regs->sp += 8;
-
+done:
         return true;
 
 sigsegv: