lkml.org 
[lkml]   [2018]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 009/118] MIPS: Guard against any partial write attempt with PTRACE_SETREGSET
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Maciej W. Rozycki <macro@mips.com>

    commit dc24d0edf33c3e15099688b6bbdf7bdc24bf6e91 upstream.

    Complement commit d614fd58a283 ("mips/ptrace: Preserve previous
    registers for short regset write") and ensure that no partial register
    write attempt is made with PTRACE_SETREGSET, as we do not preinitialize
    any temporaries used to hold incoming register data and consequently
    random data could be written.

    It is the responsibility of the caller, such as `ptrace_regset', to
    arrange for writes to span whole registers only, so here we only assert
    that it has indeed happened.

    Signed-off-by: Maciej W. Rozycki <macro@mips.com>
    Fixes: 72b22bbad1e7 ("MIPS: Don't assume 64-bit FP registers for FP regset")
    Cc: James Hogan <james.hogan@mips.com>
    Cc: Paul Burton <Paul.Burton@mips.com>
    Cc: Alex Smith <alex@alex-smith.me.uk>
    Cc: Dave Martin <Dave.Martin@arm.com>
    Cc: linux-mips@linux-mips.org
    Cc: linux-kernel@vger.kernel.org
    Patchwork: https://patchwork.linux-mips.org/patch/17926/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/mips/kernel/ptrace.c | 12 +++++++++++-
    1 file changed, 11 insertions(+), 1 deletion(-)

    --- a/arch/mips/kernel/ptrace.c
    +++ b/arch/mips/kernel/ptrace.c
    @@ -507,7 +507,15 @@ static int fpr_set_msa(struct task_struc
    return 0;
    }

    -/* Copy the supplied NT_PRFPREG buffer to the floating-point context. */
    +/*
    + * Copy the supplied NT_PRFPREG buffer to the floating-point context.
    + *
    + * We optimize for the case where `count % sizeof(elf_fpreg_t) == 0',
    + * which is supposed to have been guaranteed by the kernel before
    + * calling us, e.g. in `ptrace_regset'. We enforce that requirement,
    + * so that we can safely avoid preinitializing temporaries for
    + * partial register writes.
    + */
    static int fpr_set(struct task_struct *target,
    const struct user_regset *regset,
    unsigned int pos, unsigned int count,
    @@ -515,6 +523,8 @@ static int fpr_set(struct task_struct *t
    {
    int err;

    + BUG_ON(count % sizeof(elf_fpreg_t));
    +
    /* XXX fcr31 */

    init_fp_ctx(target);

    \
     
     \ /
      Last update: 2018-01-15 14:20    [W:4.110 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site