From d04ac3a54895a36998e3f1da27c2ce33f7a80c5a Mon Sep 17 00:00:00 2001
From: Dmitry Vyukov <dvyukov@google.com>
Date: Mon, 3 Apr 2023 07:45:09 +0200
Subject: sys/linux: add syz_pkey_set syscalls

The syscall sets PKRU register which is part of protection keys (pkey).
---
 pkg/csource/generated.go   | 19 +++++++++++++++++++
 pkg/host/syscalls_linux.go | 20 ++++++++++++++++++++
 2 files changed, 39 insertions(+)

(limited to 'pkg')

diff --git a/pkg/csource/generated.go b/pkg/csource/generated.go
index 552cc9191..204d6d2ee 100644
--- a/pkg/csource/generated.go
+++ b/pkg/csource/generated.go
@@ -11378,6 +11378,25 @@ static long syz_clone3(volatile long a0, volatile long a1)
 
 #endif
 
+#if SYZ_EXECUTOR || __NR_syz_pkey_set
+static long syz_pkey_set(volatile long pkey, volatile long val)
+{
+#if GOARCH_amd64 || GOARCH_386
+	uint32 eax = 0;
+	uint32 ecx = 0;
+	asm volatile("rdpkru"
+		     : "=a"(eax)
+		     : "c"(ecx)
+		     : "edx");
+	eax &= ~(3 << ((pkey % 16) * 2));
+	eax |= (val & 3) << ((pkey % 16) * 2);
+	uint32 edx = 0;
+	asm volatile("wrpkru" ::"a"(eax), "c"(ecx), "d"(edx));
+#endif
+	return 0;
+}
+#endif
+
 #elif GOOS_test
 
 #include <stdlib.h>
diff --git a/pkg/host/syscalls_linux.go b/pkg/host/syscalls_linux.go
index 67efd9295..7037dc001 100644
--- a/pkg/host/syscalls_linux.go
+++ b/pkg/host/syscalls_linux.go
@@ -18,6 +18,7 @@ import (
 	"github.com/google/syzkaller/pkg/osutil"
 	"github.com/google/syzkaller/prog"
 	"github.com/google/syzkaller/sys/targets"
+	"golang.org/x/sys/unix"
 )
 
 func isSupported(c *prog.Syscall, target *prog.Target, sandbox string) (bool, string) {
@@ -37,6 +38,9 @@ func isSupported(c *prog.Syscall, target *prog.Target, sandbox string) (bool, st
 	if strings.HasPrefix(c.Name, "mount$") {
 		return isSupportedMount(c, sandbox)
 	}
+	if c.CallName == "pkey_alloc" {
+		return isSyzPkeySetSupported(c, target, sandbox)
+	}
 	if c.Name == "ioctl$EXT4_IOC_SHUTDOWN" && sandbox == "none" {
 		// Don't shutdown root filesystem.
 		return false, "unsafe with sandbox=none"
@@ -317,6 +321,7 @@ var syzkallSupport = map[string]func(*prog.Syscall, *prog.Target, string) (bool,
 	"syz_usbip_server_init":       isSyzUsbIPSupported,
 	"syz_clone":                   alwaysSupported,
 	"syz_clone3":                  alwaysSupported,
+	"syz_pkey_set":                isSyzPkeySetSupported,
 }
 
 func isSupportedSyzkall(c *prog.Syscall, target *prog.Target, sandbox string) (bool, string) {
@@ -544,3 +549,18 @@ func extractStringConst(typ prog.Type) (string, bool) {
 	}
 	return v, true
 }
+
+func isSyzPkeySetSupported(c *prog.Syscall, target *prog.Target, sandbox string) (bool, string) {
+	if target.Arch != targets.AMD64 && target.Arch != targets.I386 {
+		return false, "unsupported arch"
+	}
+	key, _, err := syscall.Syscall6(unix.SYS_PKEY_ALLOC, 0, 0, 0, 0, 0, 0)
+	if err != 0 {
+		return false, fmt.Sprintf("pkey_alloc failed: %v", err)
+	}
+	_, _, err = syscall.Syscall6(unix.SYS_PKEY_FREE, key, 0, 0, 0, 0, 0)
+	if err != 0 {
+		return false, fmt.Sprintf("pkey_free failed: %v", err)
+	}
+	return true, ""
+}
-- 
cgit mrf-deployment