[zircon][debugger] Disallow setting non-canonical rip addresses.

This CL modifies the `arch_set_general_regs` function by always checking
the `rip` for non-canonical addresses.

Without this change, callers of `zx_thread_write_state` could set the
`rip` to a non-canonical address on a suspended thread, causing the
`iretq` instruction to trigger a general protection fault.

Given that the `iretq` instruction would fail after executing the
`swapgs` instruction, the #GP exception would be handled with the `gs`
register from userspace. However, given that there was no change of
privileges, the handler will not issue another `swapgs`: causing the
handler to use the `gs` register from userspace.

Note that before, top-bit set addresses (kernel addresses) were
also disallowed. This change uses `x86_is_vaddr_canonical` instead (the
same mechanism used elsewhere in the kernel) and disallows kernel
addresses with `is_kernel_address`.

I also updated the `NoncanonicalRipAddressSyscall` test to use a real
kernel address (it was using a high address, but that was out of the
kernel address space).

I added a unit test in to test this behavior: writing a non-canonical
return address to the rip results in an invalid argument. Without
this fix, resuming that thread would crash the system.

To run the test:

```
$ fx set bringup.x64 \
    --with-base //garnet/packages/tests:zircon \
    --with-base //bundles/bringup:tests
```

And run it with `runtests -t threads-test`

BUG=50633
This vulnerability was reported by: Quarkslab

Change-Id: I09eaf28c48c4dfbb308cfa82617d6b682df31412
Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/383356
Commit-Queue: Marco Vanotti <mvanotti@google.com>
Reviewed-by: Mark Seaborn <mseaborn@google.com>
Reviewed-by: Travis Geiselbrecht <travisg@google.com>
Reviewed-by: Nick Maniscalco <maniscalco@google.com>
Reviewed-by: Venkatesh Srinivas <venkateshs@google.com>
Reviewed-by: Kostya Kortchinsky <kostyak@google.com>
Testability-Review: Nick Maniscalco <maniscalco@google.com>
4 files changed
tree: 201ed9cfb555980935b33ef520fdf4df4a57d4dc
  1. .clang-format
  2. .clang-tidy
  3. .dir-locals.el
  4. .gitattributes
  5. .gitignore
  6. .gn
  7. .style.yapf
  8. AUTHORS
  9. BUILD.gn
  10. CODE_OF_CONDUCT.md
  11. CONTRIBUTING.md
  12. LICENSE
  13. OWNERS
  14. PATENTS
  15. README.md
  16. boards/
  17. build/
  18. bundles/
  19. docs/
  20. examples/
  21. garnet/
  22. products/
  23. rustfmt.toml
  24. scripts/
  25. sdk/
  26. src/
  27. third_party/
  28. tools/
  29. zircon/
README.md

Fuchsia

Pink + Purple == Fuchsia (a new operating system)

What is Fuchsia?

Fuchsia is a modular, capability-based operating system. Fuchsia runs on modern 64-bit Intel and ARM processors.

Fuchsia is an open source project with a code of conduct that we expect everyone who interacts with the project to respect.

How can I build and run Fuchsia?

See Getting Started.

Where can I learn more about Fuchsia?

See fuchsia.dev.