lkml.org 
[lkml]   [2016]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v3 2/3] x86: SROP mitigation: implement signal cookies
    >  static int ia32_restore_sigcontext(struct pt_regs *regs,
    > - struct sigcontext_32 __user *sc)
    > + struct sigcontext_32 __user *sc,
    > + void __user **user_cookie)
    > {
    > unsigned int tmpflags, err = 0;
    > void __user *buf;
    > @@ -105,6 +106,16 @@ static int ia32_restore_sigcontext(struct pt_regs *regs,
    > buf = compat_ptr(tmp);
    > } get_user_catch(err);
    >
    > + /*
    > + * If there is fp state get cookie from the top of the fp state,
    > + * else get it from the top of the sig frame.
    > + */
    > +
    > + if (tmp != 0)
    > + *user_cookie = compat_ptr(tmp + fpu__getsize(1));
    > + else
    > + *user_cookie = NULL;

    user_cookie is is __user, so shouldn't just be poking at it without
    get/put_user ? It might fault if someone has engineered a bad stack frame.

    Alan

    \
     
     \ /
      Last update: 2016-03-08 22:41    [W:5.239 / U:0.952 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site