From patchwork Sun Sep 16 22:00:00 2001 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christophe Leroy X-Patchwork-Id: 1527308 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org (client-ip=112.213.38.117; helo=lists.ozlabs.org; envelope-from=linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org; receiver=) Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4H7Pbl4npmz9sX3 for ; Mon, 13 Sep 2021 21:37:39 +1000 (AEST) Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4H7Pbl3VBjz2yPs for ; Mon, 13 Sep 2021 21:37:39 +1000 (AEST) X-Original-To: linuxppc-dev@lists.ozlabs.org Delivered-To: linuxppc-dev@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=csgroup.eu (client-ip=93.17.236.30; helo=pegase1.c-s.fr; envelope-from=christophe.leroy@csgroup.eu; receiver=) Received: from pegase1.c-s.fr (pegase1.c-s.fr [93.17.236.30]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4H7PbP2Lfbz2xl7 for ; Mon, 13 Sep 2021 21:37:18 +1000 (AEST) Received: from localhost (mailhub3.si.c-s.fr [192.168.12.233]) by localhost (Postfix) with ESMTP id 4H7PbF1rCGz9s4C; Mon, 13 Sep 2021 13:37:13 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase1.c-s.fr ([192.168.12.234]) by localhost (pegase1.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tneXrTBhke6s; Mon, 13 Sep 2021 13:37:13 +0200 (CEST) Received: from PO20335.IDSI0.si.c-s.fr (unknown [172.25.230.107]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (Client did not present a certificate) by pegase1.c-s.fr (Postfix) with ESMTPS id 4H7PbF017kz9s42; Mon, 13 Sep 2021 13:37:12 +0200 (CEST) Received: from PO20335.IDSI0.si.c-s.fr (localhost [127.0.0.1]) by PO20335.IDSI0.si.c-s.fr (8.16.1/8.16.1) with ESMTPS id 18DBbCq5143479 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 13 Sep 2021 13:37:12 +0200 Received: (from chleroy@localhost) by PO20335.IDSI0.si.c-s.fr (8.16.1/8.16.1/Submit) id 18DBbBvG143476; Mon, 13 Sep 2021 13:37:11 +0200 Date: Mon, 17 Sep 2001 00:00:00 +0200 X-Authentication-Warning: PO20335.IDSI0.si.c-s.fr: chleroy set sender to christophe.leroy@c-s.fr using -f Message-Id: <1718f38859d5366f82d5bef531f255cedf537b5d.1631532888.git.christophe.leroy@csgroup.eu> From: Christophe Leroy Subject: [PATCH v3 1/6] powerpc/signal64: Access function descriptor with user access block To: Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , ebiederm@xmission.com, hch@infradead.org X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org Errors-To: linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org Sender: "Linuxppc-dev" Access the function descriptor of the handler within a user access block. Signed-off-by: Christophe Leroy --- v3: Flatten the change to avoid nested gotos. --- arch/powerpc/kernel/signal_64.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c index 1831bba0582e..7b1cd50bc4fb 100644 --- a/arch/powerpc/kernel/signal_64.c +++ b/arch/powerpc/kernel/signal_64.c @@ -936,8 +936,13 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, func_descr_t __user *funct_desc_ptr = (func_descr_t __user *) ksig->ka.sa.sa_handler; - err |= get_user(regs->ctr, &funct_desc_ptr->entry); - err |= get_user(regs->gpr[2], &funct_desc_ptr->toc); + if (!user_read_access_begin(funct_desc_ptr, sizeof(func_descr_t))) + goto badfunc; + + unsafe_get_user(regs->ctr, &funct_desc_ptr->entry, badfunc_block); + unsafe_get_user(regs->gpr[2], &funct_desc_ptr->toc, badfunc_block); + + user_read_access_end(); } /* enter the signal handler in native-endian mode */ @@ -962,5 +967,12 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, badframe: signal_fault(current, regs, "handle_rt_signal64", frame); + return 1; + +badfunc_block: + user_read_access_end(); +badfunc: + signal_fault(current, regs, __func__, (void __user *)ksig->ka.sa.sa_handler); + return 1; }