lkml.org 
[lkml]   [2008]   [Nov]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] Fix msr check in compat_sys_swapcontext
Andreas Schwab writes:

> The new context may not be 16-byte aligned, so the real address of the
> mcontext structure should be read from the uc_regs pointer instead of
> directly using the (unaligned) uc_mcontext field.

Good catch, but...

> @@ -941,9 +941,17 @@ long sys_swapcontext(struct ucontext __user *old_ctx,
> #ifdef CONFIG_PPC64
> unsigned long new_msr = 0;
>
> - if (new_ctx &&
> - get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR]))
> - return -EFAULT;
> + if (new_ctx) {
> + struct mcontext __user *mcp;
> + u32 cmcp;
> +
> + /* Get pointer to the real mcontext. */
> + if (__get_user(cmcp, &new_ctx->uc_regs))

we need to use get_user, not __get_user, since we haven't done an
access_ok() check on the address.

> + return -EFAULT;
> + mcp = (struct mcontext __user *)(u64)cmcp;
> + if (__get_user(new_msr, &mcp->mc_gregs[PT_MSR]))

ditto here.

Paul.


\
 
 \ /
  Last update: 2008-11-06 01:55    [W:0.054 / U:0.560 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site