mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 11:19:37 +00:00
powerpc: Fix machine check problem on 32-bit kernels
This fixes a bug found by Dave Jones that means that it is possible for userspace to provoke a machine check on 32-bit kernels. This also fixes a couple of other places where I found similar problems by inspection. Signed-off-by: Paul Mackerras <paulus@samba.org>
This commit is contained in:
parent
1def630a6a
commit
7c85d1f9d3
2 changed files with 12 additions and 1 deletions
|
@ -803,10 +803,13 @@ static int do_setcontext(struct ucontext __user *ucp, struct pt_regs *regs, int
|
|||
if (__get_user(cmcp, &ucp->uc_regs))
|
||||
return -EFAULT;
|
||||
mcp = (struct mcontext __user *)(u64)cmcp;
|
||||
/* no need to check access_ok(mcp), since mcp < 4GB */
|
||||
}
|
||||
#else
|
||||
if (__get_user(mcp, &ucp->uc_regs))
|
||||
return -EFAULT;
|
||||
if (!access_ok(VERIFY_READ, mcp, sizeof(*mcp)))
|
||||
return -EFAULT;
|
||||
#endif
|
||||
restore_sigmask(&set);
|
||||
if (restore_user_regs(regs, mcp, sig))
|
||||
|
@ -908,13 +911,14 @@ int sys_debug_setcontext(struct ucontext __user *ctx,
|
|||
{
|
||||
struct sig_dbg_op op;
|
||||
int i;
|
||||
unsigned char tmp;
|
||||
unsigned long new_msr = regs->msr;
|
||||
#if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
|
||||
unsigned long new_dbcr0 = current->thread.dbcr0;
|
||||
#endif
|
||||
|
||||
for (i=0; i<ndbg; i++) {
|
||||
if (__copy_from_user(&op, dbg, sizeof(op)))
|
||||
if (copy_from_user(&op, dbg + i, sizeof(op)))
|
||||
return -EFAULT;
|
||||
switch (op.dbg_type) {
|
||||
case SIG_DBG_SINGLE_STEPPING:
|
||||
|
@ -959,6 +963,11 @@ int sys_debug_setcontext(struct ucontext __user *ctx,
|
|||
current->thread.dbcr0 = new_dbcr0;
|
||||
#endif
|
||||
|
||||
if (!access_ok(VERIFY_READ, ctx, sizeof(*ctx))
|
||||
|| __get_user(tmp, (u8 __user *) ctx)
|
||||
|| __get_user(tmp, (u8 __user *) (ctx + 1) - 1))
|
||||
return -EFAULT;
|
||||
|
||||
/*
|
||||
* If we get a fault copying the context into the kernel's
|
||||
* image of the user's registers, we can't just return -EFAULT
|
||||
|
|
|
@ -182,6 +182,8 @@ static long restore_sigcontext(struct pt_regs *regs, sigset_t *set, int sig,
|
|||
err |= __get_user(msr, &sc->gp_regs[PT_MSR]);
|
||||
if (err)
|
||||
return err;
|
||||
if (v_regs && !access_ok(VERIFY_READ, v_regs, 34 * sizeof(vector128)))
|
||||
return -EFAULT;
|
||||
/* Copy 33 vec registers (vr0..31 and vscr) from the stack */
|
||||
if (v_regs != 0 && (msr & MSR_VEC) != 0)
|
||||
err |= __copy_from_user(current->thread.vr, v_regs,
|
||||
|
|
Loading…
Reference in a new issue