[roll] Roll fuchsia [starnix] Don't trust userspace when checking for syscall restarts.

Adds a new field to ThreadState for the current task that we can use to
indicate that a syscall may need to be restarted without having to
scrape the return register for particular errno codes.

There are only three places where we currently mutate the return
register:

1. starnix_core::execution::execute_syscall()
2. starnix_core::signals::signal_handling::prepare_to_restart_syscall()
3. starnix_core::task::do_clone()

(1) is the only place where any of the syscall restart errno codes can
be written. This change updates execute_syscall() to check for
restartable errno codes and stores them in a separate field, ensuring
that all syscalls will still be able to request a restart just by
returning the correct errno.

This new field on ThreadState is then used in
prepare_to_restart_syscall() and must be set to Some(...) in order for
that function to interact at all with user registers, preventing the
kernel from ever attempting to interpret or mutate registers for a
restarting syscall unless it was triggered by our syscall
implementation. Userspace will no longer be able to put the right
values in registers and trap into the kernel with a signal to invoke
the syscall restart logic.

This also prevents the underflow debug assertion we would sometimes see
from signals being delivered at unexpected points in the syscall return
path.

Adds two new tests based on repro snippets in the linked bugs. Confirmed
locally that the crasher fails on x64/arm64/riscv64 without the changes
to Starnix and that the control flow hijack fails on x64 without the
changes to Starnix.

Also includes a minor cleanup to centralize understanding of
syscall-restarting errno codes.

Original-Fixed: 347756382
Original-Fixed: 347063218
Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1181025
Original-Revision: efe127cd6872db7fb10289a265948953bc05cdde
GitOrigin-RevId: cc9fa331742e45e5ed9088ff42558a22f42dcf23
Change-Id: Ia55750368b10a085c95940665a62e1b70a757404
1 file changed
tree: 36a801366c07f188acbb715c88413702a01f3f00
  1. ctf/
  2. git-hooks/
  3. infra/
  4. third_party/
  5. cts
  6. firmware
  7. flower
  8. jiri.lock
  9. MILESTONE
  10. minimal
  11. prebuilts
  12. README.md
  13. stem
  14. test_durations
  15. toolchain
README.md

Integration

This repository contains Fuchsia's Global Integration manifest files.

Making changes

All changes should be made to the internal version of this repository. Our infrastructure automatically updates this version when the internal one changes.

Currently all changes must be made by a Google employee. Non-Google employees wishing to make a change can ask for assistance in one of the communication channels documented at get involved.

Obtaining the source

First install Jiri.

Next run:

$ jiri init
$ jiri import minimal https://fuchsia.googlesource.com/integration
$ jiri update

Third party

Third party projects should have their own subdirectory in ./third_party.