Work around clock_gettime kernel bug on Linux x32 (closes: #849923).

5 files changed, 50 insertions, 2 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index d413019d4..53fbcd41e 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-cc50ca70e3b438577c33a85147e2a68666deaad9
-cc50ca70e3b438577c33a85147e2a68666deaad9
+e346421ca6852fbf9f95cf0e764ecc345e5ce21d
+e346421ca6852fbf9f95cf0e764ecc345e5ce21d
 971a7653746a6972b907dfe0ce139c06e4a6f482
 971a7653746a6972b907dfe0ce139c06e4a6f482
 openssh_7.4p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 872eeb404..45260a09f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,7 @@
 openssh (1:7.4p1-5) UNRELEASED; urgency=medium
 
   * Create mux socket for regression tests in a temporary directory.
+  * Work around clock_gettime kernel bug on Linux x32 (closes: #849923).
 
  -- Colin Watson <cjwatson@debian.org>  Tue, 03 Jan 2017 12:23:34 +0000
 
diff --git a/debian/patches/sandbox-x32-workaround.patch b/debian/patches/sandbox-x32-workaround.patch
new file mode 100644
index 000000000..9fabaecfa
--- /dev/null
+++ b/debian/patches/sandbox-x32-workaround.patch
@@ -0,0 +1,37 @@
+From e346421ca6852fbf9f95cf0e764ecc345e5ce21d Mon Sep 17 00:00:00 2001
+From: Colin Watson <cjwatson@debian.org>
+Date: Tue, 3 Jan 2017 14:01:56 +0000
+Subject: Work around clock_gettime kernel bug on Linux x32
+
+On Linux x32, the clock_gettime VDSO currently falls back to the x86-64
+syscall, so allow that as well as its x32 sibling.
+
+Bug-Debian: https://bugs.debian.org/849923
+Forwarded: no
+Last-Update: 2017-01-03
+
+Patch-Name: sandbox-x32-workaround.patch
+---
+ sandbox-seccomp-filter.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index 2e1ed2c5..62c578d3 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -137,6 +137,15 @@ static const struct sock_filter preauth_insns[] = {
+ #endif
+ #ifdef __NR_clock_gettime
+        SC_ALLOW(clock_gettime),
++# if defined(__x86_64__) && defined(__ILP32__)
++       /* On Linux x32, the clock_gettime VDSO currently falls back to the
++        * x86-64 syscall (see https://bugs.debian.org/849923), so allow
++        * that too.
++        */
++       BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K,
++           __NR_clock_gettime & ~__X32_SYSCALL_BIT, 0, 1),
++       BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
++# endif
+ #endif
+ #ifdef __NR_close
+        SC_ALLOW(close),
diff --git a/debian/patches/series b/debian/patches/series
index a743bec00..7edc511b8 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -27,3 +27,4 @@ debian-config.patch
 regress-integrity-robust.patch
 regress-forwarding-race.patch
 regress-mktemp.patch
+sandbox-x32-workaround.patch
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index 2e1ed2c52..62c578d3c 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -137,6 +137,15 @@ static const struct sock_filter preauth_insns[] = {
 #endif
 #ifdef __NR_clock_gettime
         SC_ALLOW(clock_gettime),
+# if defined(__x86_64__) && defined(__ILP32__)
+        /* On Linux x32, the clock_gettime VDSO currently falls back to the
+         * x86-64 syscall (see https://bugs.debian.org/849923), so allow
+         * that too.
+         */
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K,
+            __NR_clock_gettime & ~__X32_SYSCALL_BIT, 0, 1),
+        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
+# endif
 #endif
 #ifdef __NR_close
         SC_ALLOW(close),