mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-14 12:37:32 +00:00
s390/ptrace: fix guarded storage regset handling
[ Upstream commit5ef2d5231d
] If the guarded storage regset for current is supposed to be changed, the regset from user space is copied directly into the guarded storage control block. If then the process gets scheduled away while the control block is being copied and before the new control block has been loaded, the result is random: the process can be scheduled away due to a page fault or preemption. If that happens the already copied parts will be overwritten by save_gs_cb(), called from switch_to(). Avoid this by copying the data to a temporary buffer on the stack and do the actual update with preemption disabled. Fixes:f5bbd72198
("s390/ptrace: guarded storage regset for the current task") Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
bef9bcf537
commit
a9f359f24c
1 changed files with 22 additions and 11 deletions
|
@ -1172,26 +1172,37 @@ static int s390_gs_cb_set(struct task_struct *target,
|
|||
unsigned int pos, unsigned int count,
|
||||
const void *kbuf, const void __user *ubuf)
|
||||
{
|
||||
struct gs_cb *data = target->thread.gs_cb;
|
||||
struct gs_cb gs_cb = { }, *data = NULL;
|
||||
int rc;
|
||||
|
||||
if (!MACHINE_HAS_GS)
|
||||
return -ENODEV;
|
||||
if (!data) {
|
||||
if (!target->thread.gs_cb) {
|
||||
data = kzalloc(sizeof(*data), GFP_KERNEL);
|
||||
if (!data)
|
||||
return -ENOMEM;
|
||||
data->gsd = 25;
|
||||
target->thread.gs_cb = data;
|
||||
if (target == current)
|
||||
__ctl_set_bit(2, 4);
|
||||
} else if (target == current) {
|
||||
save_gs_cb(data);
|
||||
}
|
||||
if (!target->thread.gs_cb)
|
||||
gs_cb.gsd = 25;
|
||||
else if (target == current)
|
||||
save_gs_cb(&gs_cb);
|
||||
else
|
||||
gs_cb = *target->thread.gs_cb;
|
||||
rc = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
|
||||
data, 0, sizeof(struct gs_cb));
|
||||
if (target == current)
|
||||
restore_gs_cb(data);
|
||||
&gs_cb, 0, sizeof(gs_cb));
|
||||
if (rc) {
|
||||
kfree(data);
|
||||
return -EFAULT;
|
||||
}
|
||||
preempt_disable();
|
||||
if (!target->thread.gs_cb)
|
||||
target->thread.gs_cb = data;
|
||||
*target->thread.gs_cb = gs_cb;
|
||||
if (target == current) {
|
||||
__ctl_set_bit(2, 4);
|
||||
restore_gs_cb(target->thread.gs_cb);
|
||||
}
|
||||
preempt_enable();
|
||||
return rc;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue