[roll] Roll fuchsia [starnix] Don't trust userspace when checking for syscall restarts. Adds a new field to ThreadState for the current task that we can use to indicate that a syscall may need to be restarted without having to scrape the return register for particular errno codes. There are only three places where we currently mutate the return register: 1. starnix_core::execution::execute_syscall() 2. starnix_core::signals::signal_handling::prepare_to_restart_syscall() 3. starnix_core::task::do_clone() (1) is the only place where any of the syscall restart errno codes can be written. This change updates execute_syscall() to check for restartable errno codes and stores them in a separate field, ensuring that all syscalls will still be able to request a restart just by returning the correct errno. This new field on ThreadState is then used in prepare_to_restart_syscall() and must be set to Some(...) in order for that function to interact at all with user registers, preventing the kernel from ever attempting to interpret or mutate registers for a restarting syscall unless it was triggered by our syscall implementation. Userspace will no longer be able to put the right values in registers and trap into the kernel with a signal to invoke the syscall restart logic. This also prevents the underflow debug assertion we would sometimes see from signals being delivered at unexpected points in the syscall return path. Adds two new tests based on repro snippets in the linked bugs. Confirmed locally that the crasher fails on x64/arm64/riscv64 without the changes to Starnix and that the control flow hijack fails on x64 without the changes to Starnix. Also includes a minor cleanup to centralize understanding of syscall-restarting errno codes. Original-Fixed: 347756382 Original-Fixed: 347063218 Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1181025 Original-Revision: efe127cd6872db7fb10289a265948953bc05cdde GitOrigin-RevId: cc9fa331742e45e5ed9088ff42558a22f42dcf23 Change-Id: Ia55750368b10a085c95940665a62e1b70a757404
This repository contains Fuchsia's Global Integration manifest files.
All changes should be made to the internal version of this repository. Our infrastructure automatically updates this version when the internal one changes.
Currently all changes must be made by a Google employee. Non-Google employees wishing to make a change can ask for assistance in one of the communication channels documented at get involved.
First install Jiri.
Next run:
$ jiri init $ jiri import minimal https://fuchsia.googlesource.com/integration $ jiri update
Third party projects should have their own subdirectory in ./third_party.