| Message ID | jeprlabbi6.fsf@sykes.suse.de (mailing list archive) |
|---|---|
| State | Superseded, archived |
| Headers | show |
Andreas Schwab writes: > The new context may not be 16-byte aligned, so the real address of the > mcontext structure should be read from the uc_regs pointer instead of > directly using the (unaligned) uc_mcontext field. Good catch, but... > @@ -941,9 +941,17 @@ long sys_swapcontext(struct ucontext __user *old_ctx, > #ifdef CONFIG_PPC64 > unsigned long new_msr = 0; > > - if (new_ctx && > - get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR])) > - return -EFAULT; > + if (new_ctx) { > + struct mcontext __user *mcp; > + u32 cmcp; > + > + /* Get pointer to the real mcontext. */ > + if (__get_user(cmcp, &new_ctx->uc_regs)) we need to use get_user, not __get_user, since we haven't done an access_ok() check on the address. > + return -EFAULT; > + mcp = (struct mcontext __user *)(u64)cmcp; > + if (__get_user(new_msr, &mcp->mc_gregs[PT_MSR])) ditto here. Paul.
Paul Mackerras <paulus@samba.org> writes: > we need to use get_user, not __get_user, since we haven't done an > access_ok() check on the address. The address is always ok since its a compat pointer, see do_setcontext. Andreas.
Andreas Schwab writes: > Paul Mackerras <paulus@samba.org> writes: > > > we need to use get_user, not __get_user, since we haven't done an > > access_ok() check on the address. > > The address is always ok since its a compat pointer, see do_setcontext. OK, since it's inside a CONFIG_PPC64 block. I'll add a paragraph to the patch description pointing that out. Paul.
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c index a6a4310..dc10720 100644 --- a/arch/powerpc/kernel/signal_32.c +++ b/arch/powerpc/kernel/signal_32.c @@ -941,9 +941,17 @@ long sys_swapcontext(struct ucontext __user *old_ctx, #ifdef CONFIG_PPC64 unsigned long new_msr = 0; - if (new_ctx && - get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR])) - return -EFAULT; + if (new_ctx) { + struct mcontext __user *mcp; + u32 cmcp; + + /* Get pointer to the real mcontext. */ + if (__get_user(cmcp, &new_ctx->uc_regs)) + return -EFAULT; + mcp = (struct mcontext __user *)(u64)cmcp; + if (__get_user(new_msr, &mcp->mc_gregs[PT_MSR])) + return -EFAULT; + } /* * Check that the context is not smaller than the original * size (with VMX but without VSX)
The new context may not be 16-byte aligned, so the real address of the mcontext structure should be read from the uc_regs pointer instead of directly using the (unaligned) uc_mcontext field. Signed-off-by: Andreas Schwab <schwab@suse.de> ---