[PATCH RESEND v3 1/6] powerpc/signal64: Access function descriptor with user access block
From: Christophe Leroy <hidden>
Date: 2021-09-13 15:20:25
Also in:
lkml
Subsystem:
linux for powerpc (32-bit and 64-bit), the rest · Maintainers:
Madhavan Srinivasan, Linus Torvalds
Access the function descriptor of the handler within a user access block. Signed-off-by: Christophe Leroy <redacted> --- Resending with correct date, sorry for the noise, my new PC seems to have used the fake date from Git instead of adding proper Date: from current date/time. v3: Flatten the change to avoid nested gotos. --- arch/powerpc/kernel/signal_64.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 1831bba0582e..7b1cd50bc4fb 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c@@ -936,8 +936,13 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, func_descr_t __user *funct_desc_ptr = (func_descr_t __user *) ksig->ka.sa.sa_handler; - err |= get_user(regs->ctr, &funct_desc_ptr->entry); - err |= get_user(regs->gpr[2], &funct_desc_ptr->toc); + if (!user_read_access_begin(funct_desc_ptr, sizeof(func_descr_t))) + goto badfunc; + + unsafe_get_user(regs->ctr, &funct_desc_ptr->entry, badfunc_block); + unsafe_get_user(regs->gpr[2], &funct_desc_ptr->toc, badfunc_block); + + user_read_access_end(); } /* enter the signal handler in native-endian mode */
@@ -962,5 +967,12 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, badframe: signal_fault(current, regs, "handle_rt_signal64", frame); + return 1; + +badfunc_block: + user_read_access_end(); +badfunc: + signal_fault(current, regs, __func__, (void __user *)ksig->ka.sa.sa_handler); + return 1; }
--
2.31.1