[PATCH] nptl: Properly inline setgroups syscall [BZ #26248]

["H.J. Lu" <hjl.tools@gmail.com>]

nptl has

/* Opcodes and data types for communication with the signal handler to
   change user/group IDs.  */
struct xid_command
{
  int syscall_no;
  long int id[3];
  volatile int cntr;
  volatile int error;
};

 /* This must be last, otherwise the current thread might not have
     permissions to send SIGSETXID syscall to the other threads.  */
  result = INTERNAL_SYSCALL_NCS (cmdp->syscall_no, 3,
                                 cmdp->id[0], cmdp->id[1], cmdp->id[2]);

But the second argument of setgroups syscal is a pointer:

       int setgroups(size_t size, const gid_t *list);

But on x32, pointers passed to syscall must have pointer type so that they
will be zero-extended.

Add <setxid-internal.h> to define INTERNAL_SETXID_SYSCALL_NCS and use it,
instead of INTERNAL_SYSCALL_NCS, for SETXID syscalls.  X32 override it
with pointer type for setgroups.  A testcase is added and setgroups
returned with EFAULT when running as root without the fix.
---
 nptl/allocatestack.c                          |  4 +-
 nptl/nptl-init.c                              |  4 +-
 sysdeps/nptl/setxid-internal.h                | 21 +++++++
 sysdeps/unix/sysv/linux/x86_64/x32/Makefile   |  4 ++
 .../sysv/linux/x86_64/x32/setxid-internal.h   | 36 +++++++++++
 .../sysv/linux/x86_64/x32/tst-setgroups.c     | 62 +++++++++++++++++++
 6 files changed, 127 insertions(+), 4 deletions(-)
 create mode 100644 sysdeps/nptl/setxid-internal.h
 create mode 100644 sysdeps/unix/sysv/linux/x86_64/x32/setxid-internal.h
 create mode 100644 sysdeps/unix/sysv/linux/x86_64/x32/tst-setgroups.c

diff --git a/nptl/allocatestack.c b/nptl/allocatestack.c
index 4ae4b5a986..af5fc5f882 100644
--- a/nptl/allocatestack.c
+++ b/nptl/allocatestack.c
@@ -32,6 +32,7 @@
 #include <futex-internal.h>
 #include <kernel-features.h>
 #include <stack-aliasing.h>
+#include <setxid-internal.h>
 
 
 #ifndef NEED_SEPARATE_REGISTER_STACK
@@ -1159,8 +1160,7 @@ __nptl_setxid (struct xid_command *cmdp)
 
   /* This must be last, otherwise the current thread might not have
      permissions to send SIGSETXID syscall to the other threads.  */
-  result = INTERNAL_SYSCALL_NCS (cmdp->syscall_no, 3,
-				 cmdp->id[0], cmdp->id[1], cmdp->id[2]);
+  result = INTERNAL_SETXID_SYSCALL_NCS (cmdp);
   int error = 0;
   if (__glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (result)))
     {
diff --git a/nptl/nptl-init.c b/nptl/nptl-init.c
index 95c60a524a..80771e7788 100644
--- a/nptl/nptl-init.c
+++ b/nptl/nptl-init.c
@@ -39,6 +39,7 @@
 #include <libc-pointer-arith.h>
 #include <pthread-pids.h>
 #include <pthread_mutex_conf.h>
+#include <setxid-internal.h>
 
 #ifndef TLS_MULTIPLE_THREADS_IN_TCB
 /* Pointer to the corresponding variable in libc.  */
@@ -188,8 +189,7 @@ sighandler_setxid (int sig, siginfo_t *si, void *ctx)
       || si->si_code != SI_TKILL)
     return;
 
-  result = INTERNAL_SYSCALL_NCS (__xidcmd->syscall_no, 3, __xidcmd->id[0],
-				 __xidcmd->id[1], __xidcmd->id[2]);
+  result = INTERNAL_SETXID_SYSCALL_NCS (__xidcmd);
   int error = 0;
   if (__glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (result)))
     error = INTERNAL_SYSCALL_ERRNO (result);
diff --git a/sysdeps/nptl/setxid-internal.h b/sysdeps/nptl/setxid-internal.h
new file mode 100644
index 0000000000..d378b90db1
--- /dev/null
+++ b/sysdeps/nptl/setxid-internal.h
@@ -0,0 +1,21 @@
+/* INTERNAL_SETXID_SYSCALL_NCS.  Generic version.
+   Copyright (C) 2020 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#define INTERNAL_SETXID_SYSCALL_NCS(cmd) \
+  INTERNAL_SYSCALL_NCS (cmd->syscall_no, 3, cmd->id[0], cmd->id[1], \
+			cmd->id[2])
diff --git a/sysdeps/unix/sysv/linux/x86_64/x32/Makefile b/sysdeps/unix/sysv/linux/x86_64/x32/Makefile
index 16b768d8ba..1a6c984f96 100644
--- a/sysdeps/unix/sysv/linux/x86_64/x32/Makefile
+++ b/sysdeps/unix/sysv/linux/x86_64/x32/Makefile
@@ -5,6 +5,10 @@ ifeq ($(subdir),misc)
 sysdep_routines += arch_prctl
 endif
 
+ifeq ($(subdir),nptl)
+xtests += tst-setgroups
+endif
+
 ifeq ($(subdir),conform)
 # For bugs 16437 and 21279.
 conformtest-xfail-conds += x86_64-x32-linux
diff --git a/sysdeps/unix/sysv/linux/x86_64/x32/setxid-internal.h b/sysdeps/unix/sysv/linux/x86_64/x32/setxid-internal.h
new file mode 100644
index 0000000000..bed30ba040
--- /dev/null
+++ b/sysdeps/unix/sysv/linux/x86_64/x32/setxid-internal.h
@@ -0,0 +1,36 @@
+/* INTERNAL_SETXID_SYSCALL_NCS.  X32 version.
+   Copyright (C) 2020 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+/* Enforce zero-extension for the pointer argument in
+
+   int setgroups(size_t size, const gid_t *list);
+
+ */
+#define INTERNAL_SETXID_SYSCALL_NCS(cmd) \
+  ({								\
+    int __result;						\
+    if (__glibc_unlikely (cmd->syscall_no == __NR_setgroups))	\
+      __result = INTERNAL_SYSCALL_NCS (__NR_setgroups, 2,	\
+				       cmd->id[0],		\
+				       (void *) cmd->id[1]);	\
+    else							\
+      __result = INTERNAL_SYSCALL_NCS (cmd->syscall_no, 3,	\
+				       cmd->id[0], cmd->id[1],	\
+				       cmd->id[2]);		\
+    __result;							\
+  })
diff --git a/sysdeps/unix/sysv/linux/x86_64/x32/tst-setgroups.c b/sysdeps/unix/sysv/linux/x86_64/x32/tst-setgroups.c
new file mode 100644
index 0000000000..a7167b0e26
--- /dev/null
+++ b/sysdeps/unix/sysv/linux/x86_64/x32/tst-setgroups.c
@@ -0,0 +1,62 @@
+/* Basic test for setgroups
+   Copyright (C) 2020 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <stdlib.h>
+#include <limits.h>
+#include <grp.h>
+#include <errno.h>
+#include <error.h>
+#include <support/xthread.h>
+#include <support/support.h>
+#include <support/test-driver.h>
+#include <support/xunistd.h>
+
+static void *
+start_routine (void *args)
+{
+  return NULL;
+}
+
+static int
+do_test (void)
+{
+  int size;
+  /* NB: Stack address is at 0xfffXXXXX.  */
+  gid_t list[NGROUPS_MAX];
+  int status = EXIT_SUCCESS;
+
+  pthread_t thread = xpthread_create (NULL, start_routine, NULL);
+
+  size = getgroups (sizeof (list) / sizeof (list[0]), list);
+  if (size < 0)
+    {
+      status = EXIT_FAILURE;
+      error (0, errno, "getgroups failed");
+    }
+  if (setgroups (size, list) < 0 && errno != EPERM)
+    {
+      status = EXIT_FAILURE;
+      error (0, errno, "setgroups failed");
+    }
+
+  xpthread_join (thread);
+
+  return status;
+}
+
+#include <support/test-driver.c>
-- 
2.26.2