forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2023-12-11 6778948f9de86c3cfaf36725a7c87dcff9ba247f 
 kernel/kernel/debug/kdb/kdb_main.c
....@@ -45,6 +45,7 @@
4545 #include <linux/proc_fs.h>
4646 #include <linux/uaccess.h>
4747 #include <linux/slab.h>
48
+#include <linux/security.h>
4849 #include "kdb_private.h"
4950 
5051 #undef	MODULE_PARAM_PREFIX
....@@ -62,7 +63,7 @@
6263 /*
6364  * Kernel debugger state flags
6465  */
65
-int kdb_flags;
66
+unsigned int kdb_flags;
6667 
6768 /*
6869  * kdb_lock protects updates to kdb_initial_cpu.  Used to
....@@ -73,7 +74,6 @@
7374 int kdb_state;			/* General KDB state */
7475 
7576 struct task_struct *kdb_current_task;
76
-EXPORT_SYMBOL(kdb_current_task);
7777 struct pt_regs *kdb_current_regs;
7878 
7979 const char *kdb_diemsg;
....@@ -198,10 +198,62 @@
198198 }
199199 
200200 /*
201
- * Check whether the flags of the current command and the permissions
202
- * of the kdb console has allow a command to be run.
201
+ * Update the permissions flags (kdb_cmd_enabled) to match the
202
+ * current lockdown state.
203
+ *
204
+ * Within this function the calls to security_locked_down() are "lazy". We
205
+ * avoid calling them if the current value of kdb_cmd_enabled already excludes
206
+ * flags that might be subject to lockdown. Additionally we deliberately check
207
+ * the lockdown flags independently (even though read lockdown implies write
208
+ * lockdown) since that results in both simpler code and clearer messages to
209
+ * the user on first-time debugger entry.
210
+ *
211
+ * The permission masks during a read+write lockdown permits the following
212
+ * flags: INSPECT, SIGNAL, REBOOT (and ALWAYS_SAFE).
213
+ *
214
+ * The INSPECT commands are not blocked during lockdown because they are
215
+ * not arbitrary memory reads. INSPECT covers the backtrace family (sometimes
216
+ * forcing them to have no arguments) and lsmod. These commands do expose
217
+ * some kernel state but do not allow the developer seated at the console to
218
+ * choose what state is reported. SIGNAL and REBOOT should not be controversial,
219
+ * given these are allowed for root during lockdown already.
203220  */
204
-static inline bool kdb_check_flags(kdb_cmdflags_t flags, int permissions,
221
+static void kdb_check_for_lockdown(void)
222
+{
223
+	const int write_flags = KDB_ENABLE_MEM_WRITE |
224
+				KDB_ENABLE_REG_WRITE |
225
+				KDB_ENABLE_FLOW_CTRL;
226
+	const int read_flags = KDB_ENABLE_MEM_READ |
227
+			       KDB_ENABLE_REG_READ;
228
+
229
+	bool need_to_lockdown_write = false;
230
+	bool need_to_lockdown_read = false;
231
+
232
+	if (kdb_cmd_enabled & (KDB_ENABLE_ALL | write_flags))
233
+		need_to_lockdown_write =
234
+			security_locked_down(LOCKDOWN_DBG_WRITE_KERNEL);
235
+
236
+	if (kdb_cmd_enabled & (KDB_ENABLE_ALL | read_flags))
237
+		need_to_lockdown_read =
238
+			security_locked_down(LOCKDOWN_DBG_READ_KERNEL);
239
+
240
+	/* De-compose KDB_ENABLE_ALL if required */
241
+	if (need_to_lockdown_write || need_to_lockdown_read)
242
+		if (kdb_cmd_enabled & KDB_ENABLE_ALL)
243
+			kdb_cmd_enabled = KDB_ENABLE_MASK & ~KDB_ENABLE_ALL;
244
+
245
+	if (need_to_lockdown_write)
246
+		kdb_cmd_enabled &= ~write_flags;
247
+
248
+	if (need_to_lockdown_read)
249
+		kdb_cmd_enabled &= ~read_flags;
250
+}
251
+
252
+/*
253
+ * Check whether the flags of the current command, the permissions of the kdb
254
+ * console and the lockdown state allow a command to be run.
255
+ */
256
+static bool kdb_check_flags(kdb_cmdflags_t flags, int permissions,
205257 				   bool no_args)
206258 {
207259 	/* permissions comes from userspace so needs massaging slightly */
....@@ -400,6 +452,13 @@
400452 		return KDB_ARGCOUNT;
401453 
402454 	/*
455
+	 * Censor sensitive variables
456
+	 */
457
+	if (strcmp(argv[1], "PROMPT") == 0 &&
458
+	    !kdb_check_flags(KDB_ENABLE_MEM_READ, kdb_cmd_enabled, false))
459
+		return KDB_NOPERM;
460
+
461
+	/*
403462 	 * Check for internal variables
404463 	 */
405464 	if (strcmp(argv[1], "KDBDEBUG") == 0) {
....@@ -412,8 +471,7 @@
412471 				    argv[2]);
413472 			return 0;
414473 		}
415
-		kdb_flags = (kdb_flags &
416
-			     ~(KDB_DEBUG_FLAG_MASK << KDB_DEBUG_FLAG_SHIFT))
474
+		kdb_flags = (kdb_flags & ~KDB_DEBUG(MASK))
417475 			| (debugflags << KDB_DEBUG_FLAG_SHIFT);
418476 
419477 		return 0;
....@@ -658,7 +716,7 @@
658716  */
659717 struct defcmd_set {
660718 	int count;
661
-	int usable;
719
+	bool usable;
662720 	char *name;
663721 	char *usage;
664722 	char *help;
....@@ -666,7 +724,7 @@
666724 };
667725 static struct defcmd_set *defcmd_set;
668726 static int defcmd_set_count;
669
-static int defcmd_in_progress;
727
+static bool defcmd_in_progress;
670728 
671729 /* Forward references */
672730 static int kdb_exec_defcmd(int argc, const char **argv);
....@@ -676,9 +734,9 @@
676734 	struct defcmd_set *s = defcmd_set + defcmd_set_count - 1;
677735 	char **save_command = s->command;
678736 	if (strcmp(argv0, "endefcmd") == 0) {
679
-		defcmd_in_progress = 0;
737
+		defcmd_in_progress = false;
680738 		if (!s->count)
681
-			s->usable = 0;
739
+			s->usable = false;
682740 		if (s->usable)
683741 			/* macros are always safe because when executed each
684742 			 * internal command re-enters kdb_parse() and is
....@@ -695,7 +753,7 @@
695753 	if (!s->command) {
696754 		kdb_printf("Could not allocate new kdb_defcmd table for %s\n",
697755 			   cmdstr);
698
-		s->usable = 0;
756
+		s->usable = false;
699757 		return KDB_NOTIMP;
700758 	}
701759 	memcpy(s->command, save_command, s->count * sizeof(*(s->command)));
....@@ -737,7 +795,7 @@
737795 	       defcmd_set_count * sizeof(*defcmd_set));
738796 	s = defcmd_set + defcmd_set_count;
739797 	memset(s, 0, sizeof(*s));
740
-	s->usable = 1;
798
+	s->usable = true;
741799 	s->name = kdb_strdup(argv[1], GFP_KDB);
742800 	if (!s->name)
743801 		goto fail_name;
....@@ -756,7 +814,7 @@
756814 		s->help[strlen(s->help)-1] = '\0';
757815 	}
758816 	++defcmd_set_count;
759
-	defcmd_in_progress = 1;
817
+	defcmd_in_progress = true;
760818 	kfree(save_defcmd_set);
761819 	return 0;
762820 fail_help:
....@@ -830,7 +888,7 @@
830888 	cp++;
831889 	while (isspace(*cp))
832890 		cp++;
833
-	if (strncmp(cp, "grep ", 5)) {
891
+	if (!str_has_prefix(cp, "grep ")) {
834892 		kdb_printf("invalid 'pipe', see grephelp\n");
835893 		return;
836894 	}
....@@ -1102,13 +1160,14 @@
11021160 	switch (*cmd) {
11031161 	case CTRL_P:
11041162 		if (cmdptr != cmd_tail)
1105
-			cmdptr = (cmdptr-1) % KDB_CMD_HISTORY_COUNT;
1106
-		strncpy(cmd_cur, cmd_hist[cmdptr], CMD_BUFLEN);
1163
+			cmdptr = (cmdptr + KDB_CMD_HISTORY_COUNT - 1) %
1164
+				 KDB_CMD_HISTORY_COUNT;
1165
+		strscpy(cmd_cur, cmd_hist[cmdptr], CMD_BUFLEN);
11071166 		return 1;
11081167 	case CTRL_N:
11091168 		if (cmdptr != cmd_head)
11101169 			cmdptr = (cmdptr+1) % KDB_CMD_HISTORY_COUNT;
1111
-		strncpy(cmd_cur, cmd_hist[cmdptr], CMD_BUFLEN);
1170
+		strscpy(cmd_cur, cmd_hist[cmdptr], CMD_BUFLEN);
11121171 		return 1;
11131172 	}
11141173 	return 0;
....@@ -1139,7 +1198,7 @@
11391198 	console_loglevel = old_lvl;
11401199 }
11411200 
1142
-void kdb_set_current_task(struct task_struct *p)
1201
+static void kdb_set_current_task(struct task_struct *p)
11431202 {
11441203 	kdb_current_task = p;
11451204 
....@@ -1188,6 +1247,9 @@
11881247 		kdb_curr_task(raw_smp_processor_id());
11891248 
11901249 	KDB_DEBUG_STATE("kdb_local 1", reason);
1250
+
1251
+	kdb_check_for_lockdown();
1252
+
11911253 	kdb_go_count = 0;
11921254 	if (reason == KDB_REASON_DEBUG) {
11931255 		/* special case below */
....@@ -1299,12 +1361,9 @@
12991361 		*(cmd_hist[cmd_head]) = '\0';
13001362 
13011363 do_full_getstr:
1302
-#if defined(CONFIG_SMP)
1364
+		/* PROMPT can only be set if we have MEM_READ permission. */
13031365 		snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"),
13041366 			 raw_smp_processor_id());
1305
-#else
1306
-		snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"));
1307
-#endif
13081367 		if (defcmd_in_progress)
13091368 			strncat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN);
13101369 
....@@ -1315,7 +1374,7 @@
13151374 		if (*cmdbuf != '\n') {
13161375 			if (*cmdbuf < 32) {
13171376 				if (cmdptr == cmd_head) {
1318
-					strncpy(cmd_hist[cmd_head], cmd_cur,
1377
+					strscpy(cmd_hist[cmd_head], cmd_cur,
13191378 						CMD_BUFLEN);
13201379 					*(cmd_hist[cmd_head] +
13211380 					  strlen(cmd_hist[cmd_head])-1) = '\0';
....@@ -1325,7 +1384,7 @@
13251384 				cmdbuf = cmd_cur;
13261385 				goto do_full_getstr;
13271386 			} else {
1328
-				strncpy(cmd_hist[cmd_head], cmd_cur,
1387
+				strscpy(cmd_hist[cmd_head], cmd_cur,
13291388 					CMD_BUFLEN);
13301389 			}
13311390 
....@@ -1493,6 +1552,7 @@
14931552 	char cbuf[32];
14941553 	char *c = cbuf;
14951554 	int i;
1555
+	int j;
14961556 	unsigned long word;
14971557 
14981558 	memset(cbuf, '\0', sizeof(cbuf));
....@@ -1538,25 +1598,9 @@
15381598 			wc.word = word;
15391599 #define printable_char(c) \
15401600 	({unsigned char __c = c; isascii(__c) && isprint(__c) ? __c : '.'; })
1541
-			switch (bytesperword) {
1542
-			case 8:
1601
+			for (j = 0; j < bytesperword; j++)
15431602 				*c++ = printable_char(*cp++);
1544
-				*c++ = printable_char(*cp++);
1545
-				*c++ = printable_char(*cp++);
1546
-				*c++ = printable_char(*cp++);
1547
-				addr += 4;
1548
-			case 4:
1549
-				*c++ = printable_char(*cp++);
1550
-				*c++ = printable_char(*cp++);
1551
-				addr += 2;
1552
-			case 2:
1553
-				*c++ = printable_char(*cp++);
1554
-				addr++;
1555
-			case 1:
1556
-				*c++ = printable_char(*cp++);
1557
-				addr++;
1558
-				break;
1559
-			}
1603
+			addr += bytesperword;
15601604 #undef printable_char
15611605 		}
15621606 	}
....@@ -2093,7 +2137,8 @@
20932137 	}
20942138 
20952139 	if (KDB_DEBUG(MASK))
2096
-		kdb_printf("KDBFLAGS=0x%x\n", kdb_flags);
2140
+		kdb_printf("KDBDEBUG=0x%x\n",
2141
+			(kdb_flags & KDB_DEBUG(MASK)) >> KDB_DEBUG_FLAG_SHIFT);
20972142 
20982143 	return 0;
20992144 }
....@@ -2310,10 +2355,10 @@
23102355 		if (kdb_task_state(p, mask_I))
23112356 			++idle;
23122357 	}
2313
-	kdb_do_each_thread(g, p) {
2358
+	for_each_process_thread(g, p) {
23142359 		if (kdb_task_state(p, mask_M))
23152360 			++daemon;
2316
-	} kdb_while_each_thread(g, p);
2361
+	}
23172362 	if (idle || daemon) {
23182363 		if (idle)
23192364 			kdb_printf("%d idle process%s (state I)%s\n",
....@@ -2337,7 +2382,8 @@
23372382 	int cpu;
23382383 	unsigned long tmp;
23392384 
2340
-	if (!p || probe_kernel_read(&tmp, (char *)p, sizeof(unsigned long)))
2385
+	if (!p ||
2386
+	    copy_from_kernel_nofault(&tmp, (char *)p, sizeof(unsigned long)))
23412387 		return;
23422388 
23432389 	cpu = kdb_process_cpu(p);
....@@ -2380,12 +2426,12 @@
23802426 	}
23812427 	kdb_printf("\n");
23822428 	/* Now the real tasks */
2383
-	kdb_do_each_thread(g, p) {
2429
+	for_each_process_thread(g, p) {
23842430 		if (KDB_FLAG(CMD_INTERRUPT))
23852431 			return 0;
23862432 		if (kdb_task_state(p, mask))
23872433 			kdb_ps1(p);
2388
-	} kdb_while_each_thread(g, p);
2434
+	}
23892435 
23902436 	return 0;
23912437 }
....@@ -2537,7 +2583,6 @@
25372583 	kdb_printf("machine    %s\n", init_uts_ns.name.machine);
25382584 	kdb_printf("nodename   %s\n", init_uts_ns.name.nodename);
25392585 	kdb_printf("domainname %s\n", init_uts_ns.name.domainname);
2540
-	kdb_printf("ccversion  %s\n", __stringify(CCVERSION));
25412586 
25422587 	now = __ktime_get_real_seconds();
25432588 	time64_to_tm(now, 0, &tm);