Message ID | 9ce6e3e3bde4621442049476f41b5e0c7cf283be.1623739212.git.christophe.leroy@csgroup.eu (mailing list archive) |
---|---|
State | Superseded |
Headers | show |
Series | [1/7] powerpc/signal64: Copy siginfo before changing regs->nip | expand |
Related | show |
Context | Check | Description |
---|---|---|
snowpatch_ozlabs/apply_patch | success | Successfully applied on branch powerpc/merge (419dfbc3e05d80c5f6d6856534cd0a21c22c22de) |
snowpatch_ozlabs/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 20 lines checked |
snowpatch_ozlabs/needsstable | success | Patch has no Fixes tags |
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c index 8b2eb758131c..9ca97b4366df 100644 --- a/arch/powerpc/kernel/signal_64.c +++ b/arch/powerpc/kernel/signal_64.c @@ -936,8 +936,18 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, func_descr_t __user *funct_desc_ptr = (func_descr_t __user *) ksig->ka.sa.sa_handler; - err |= get_user(regs->ctr, &funct_desc_ptr->entry); - err |= get_user(regs->gpr[2], &funct_desc_ptr->toc); + if (user_read_access_begin(funct_desc_ptr, sizeof(func_descr_t))) { + unsafe_get_user(regs->ctr, &funct_desc_ptr->entry, bad_funct_desc_block); + unsafe_get_user(regs->gpr[2], &funct_desc_ptr->toc, bad_funct_desc_block); + } else { + goto bad_funct_desc; +bad_funct_desc_block: + user_read_access_end(); +bad_funct_desc: + signal_fault(current, regs, __func__, funct_desc_ptr); + return 1; + } + user_read_access_end(); } /* enter the signal handler in native-endian mode */
Access the function descriptor of the handler within a user access block. Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu> --- arch/powerpc/kernel/signal_64.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)