Re: [PATCH] Fix msr check in compat_sys_swapcontext
From: Andreas Schwab <hidden>
Date: 2008-11-06 10:49:24
Also in:
lkml
Subsystem:
linux for powerpc (32-bit and 64-bit), the rest · Maintainers:
Madhavan Srinivasan, Linus Torvalds
Possibly related (same subject, not in this thread)
- 2008-11-06 · Re: [PATCH] Fix msr check in compat_sys_swapcontext · Paul Mackerras <hidden>
- 2008-11-06 · Re: [PATCH] Fix msr check in compat_sys_swapcontext · Andreas Schwab <hidden>
- 2008-11-06 · Re: [PATCH] Fix msr check in compat_sys_swapcontext · Paul Mackerras <hidden>
- 2008-11-05 · [PATCH] Fix msr check in compat_sys_swapcontext · Andreas Schwab <hidden>
Paul Mackerras [off-list ref] writes:
Andreas Schwab writes:quoted
Paul Mackerras [off-list ref] writes:quoted
we need to use get_user, not __get_user, since we haven't done an access_ok() check on the address.The address is always ok since its a compat pointer, see do_setcontext.OK, since it's inside a CONFIG_PPC64 block. I'll add a paragraph to the patch description pointing that out.
How about this:
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index a6a4310..b13abf3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c@@ -941,9 +941,21 @@ long sys_swapcontext(struct ucontext __user *old_ctx, #ifdef CONFIG_PPC64 unsigned long new_msr = 0; - if (new_ctx && - get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR])) - return -EFAULT; + if (new_ctx) { + struct mcontext __user *mcp; + u32 cmcp; + + /* + * Get pointer to the real mcontext. No need for + * access_ok since we are dealing with compat + * pointers. + */ + if (__get_user(cmcp, &new_ctx->uc_regs)) + return -EFAULT; + mcp = (struct mcontext __user *)(u64)cmcp; + if (__get_user(new_msr, &mcp->mc_gregs[PT_MSR])) + return -EFAULT; + } /* * Check that the context is not smaller than the original * size (with VMX but without VSX)
Andreas. -- Andreas Schwab, SuSE Labs, schwab@suse.de SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany PGP key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5 "And now for something completely different."