1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-21 09:55:07 +00:00
serenity/Kernel/Syscalls/sigaction.cpp
Andreas Kling 6a6eb8844a Kernel: Use Userspace<T> in sys$sigaction()
fuzz-syscalls found a bunch of unaligned accesses into struct sigaction
via this syscall. This patch fixes that issue by porting the syscall
to Userspace<T> which we should have done anyway. :^)

Fixes #5500.
2021-03-01 14:06:20 +01:00

129 lines
4.5 KiB
C++

/*
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <Kernel/Arch/x86/SmapDisabler.h>
#include <Kernel/Panic.h>
#include <Kernel/Process.h>
namespace Kernel {
KResultOr<int> Process::sys$sigprocmask(int how, Userspace<const sigset_t*> set, Userspace<sigset_t*> old_set)
{
REQUIRE_PROMISE(sigaction);
auto current_thread = Thread::current();
u32 previous_signal_mask;
if (set) {
sigset_t set_value;
if (!copy_from_user(&set_value, set))
return EFAULT;
switch (how) {
case SIG_BLOCK:
previous_signal_mask = current_thread->signal_mask_block(set_value, true);
break;
case SIG_UNBLOCK:
previous_signal_mask = current_thread->signal_mask_block(set_value, false);
break;
case SIG_SETMASK:
previous_signal_mask = current_thread->update_signal_mask(set_value);
break;
default:
return EINVAL;
}
} else {
previous_signal_mask = current_thread->signal_mask();
}
if (old_set && !copy_to_user(old_set, &previous_signal_mask))
return EFAULT;
return 0;
}
KResultOr<int> Process::sys$sigpending(Userspace<sigset_t*> set)
{
REQUIRE_PROMISE(stdio);
auto pending_signals = Thread::current()->pending_signals();
if (!copy_to_user(set, &pending_signals))
return EFAULT;
return 0;
}
KResultOr<int> Process::sys$sigaction(int signum, Userspace<const sigaction*> user_act, Userspace<sigaction*> user_old_act)
{
REQUIRE_PROMISE(sigaction);
if (signum < 1 || signum >= 32 || signum == SIGKILL || signum == SIGSTOP)
return EINVAL;
sigaction act {};
if (!copy_from_user(&act, user_act))
return EFAULT;
InterruptDisabler disabler; // FIXME: This should use a narrower lock. Maybe a way to ignore signals temporarily?
auto& action = Thread::current()->m_signal_action_data[signum];
if (user_old_act) {
sigaction old_act {};
old_act.sa_flags = action.flags;
old_act.sa_sigaction = reinterpret_cast<decltype(old_act.sa_sigaction)>(action.handler_or_sigaction.as_ptr());
if (!copy_to_user(user_old_act, &old_act))
return EFAULT;
}
action.flags = act.sa_flags;
action.handler_or_sigaction = VirtualAddress { reinterpret_cast<void*>(act.sa_sigaction) };
return 0;
}
KResultOr<int> Process::sys$sigreturn([[maybe_unused]] RegisterState& registers)
{
REQUIRE_PROMISE(stdio);
SmapDisabler disabler;
#if ARCH(I386)
//Here, we restore the state pushed by dispatch signal and asm_signal_trampoline.
u32* stack_ptr = (u32*)registers.userspace_esp;
u32 smuggled_eax = *stack_ptr;
//pop the stored eax, ebp, return address, handler and signal code
stack_ptr += 5;
Thread::current()->m_signal_mask = *stack_ptr;
stack_ptr++;
//pop edi, esi, ebp, esp, ebx, edx, ecx and eax
memcpy(&registers.edi, stack_ptr, 8 * sizeof(FlatPtr));
stack_ptr += 8;
registers.eip = *stack_ptr;
stack_ptr++;
registers.eflags = (registers.eflags & ~safe_eflags_mask) | (*stack_ptr & safe_eflags_mask);
stack_ptr++;
registers.userspace_esp = registers.esp;
return smuggled_eax;
#else
PANIC("sys$sigreturn() not implemented.");
#endif
}
}