* [PATCH 1/5] frv: restart_block.fn needs to be reset on sigreturn
@ 2010-09-20 14:13 David Howells
2010-09-20 14:13 ` [PATCH 2/5] frv: fix address verification holes in setup_frame/setup_rt_frame David Howells
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: David Howells @ 2010-09-20 14:13 UTC (permalink / raw)
To: torvalds, akpm; +Cc: linux-kernel, Al Viro, David Howells
From: Al Viro <viro@ftp.linux.org.uk>
Reset restart_block.fn on executing a sigreturn such that any currently pending
system call restarts will be forced to return -EINTR.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Howells <dhowells@redhat.com>
---
arch/frv/kernel/signal.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/arch/frv/kernel/signal.c b/arch/frv/kernel/signal.c
index 0974c0e..7fc2961 100644
--- a/arch/frv/kernel/signal.c
+++ b/arch/frv/kernel/signal.c
@@ -121,6 +121,9 @@ static int restore_sigcontext(struct sigcontext __user *sc, int *_gr8)
struct user_context *user = current->thread.user;
unsigned long tbr, psr;
+ /* Always make any pending restarted system calls return -EINTR */
+ current_thread_info()->restart_block.fn = do_no_restart_syscall;
+
tbr = user->i.tbr;
psr = user->i.psr;
if (copy_from_user(user, &sc->sc_context, sizeof(sc->sc_context)))
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/5] frv: fix address verification holes in setup_frame/setup_rt_frame
2010-09-20 14:13 [PATCH 1/5] frv: restart_block.fn needs to be reset on sigreturn David Howells
@ 2010-09-20 14:13 ` David Howells
2010-09-20 14:13 ` [PATCH 3/5] frv: avoid infinite loop of SIGSEGV delivery David Howells
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: David Howells @ 2010-09-20 14:13 UTC (permalink / raw)
To: torvalds, akpm; +Cc: linux-kernel, Al Viro, David Howells
From: Al Viro <viro@ftp.linux.org.uk>
a) sa_handler might be maliciously set to point to kernel memory;
blindly dereferencing it in FDPIC case is a Bad Idea(tm).
b) I'm not sure you need that set_fs(USER_DS) there at all, but
if you do, you'd better do it *before* checking the frame you've
decided to use with access_ok(), lest sigaltstack() becomes a
convenient roothole.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Howells <dhowells@redhat.com>
---
arch/frv/kernel/signal.c | 38 ++++++++++++++++++++++----------------
1 files changed, 22 insertions(+), 16 deletions(-)
diff --git a/arch/frv/kernel/signal.c b/arch/frv/kernel/signal.c
index 7fc2961..5fb2d06 100644
--- a/arch/frv/kernel/signal.c
+++ b/arch/frv/kernel/signal.c
@@ -253,6 +253,8 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
struct sigframe __user *frame;
int rsig;
+ set_fs(USER_DS);
+
frame = get_sigframe(ka, sizeof(*frame));
if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
@@ -296,22 +298,23 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
(unsigned long) (frame->retcode + 2));
}
- /* set up registers for signal handler */
- __frame->sp = (unsigned long) frame;
- __frame->lr = (unsigned long) &frame->retcode;
- __frame->gr8 = sig;
-
+ /* Set up registers for the signal handler */
if (current->personality & FDPIC_FUNCPTRS) {
struct fdpic_func_descriptor __user *funcptr =
(struct fdpic_func_descriptor __user *) ka->sa.sa_handler;
- __get_user(__frame->pc, &funcptr->text);
- __get_user(__frame->gr15, &funcptr->GOT);
+ struct fdpic_func_descriptor desc;
+ if (copy_from_user(&desc, funcptr, sizeof(desc)))
+ goto give_sigsegv;
+ __frame->pc = desc.text;
+ __frame->gr15 = desc.GOT;
} else {
__frame->pc = (unsigned long) ka->sa.sa_handler;
__frame->gr15 = 0;
}
- set_fs(USER_DS);
+ __frame->sp = (unsigned long) frame;
+ __frame->lr = (unsigned long) &frame->retcode;
+ __frame->gr8 = sig;
/* the tracer may want to single-step inside the handler */
if (test_thread_flag(TIF_SINGLESTEP))
@@ -341,6 +344,8 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
struct rt_sigframe __user *frame;
int rsig;
+ set_fs(USER_DS);
+
frame = get_sigframe(ka, sizeof(*frame));
if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
@@ -395,22 +400,23 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
}
/* Set up registers for signal handler */
- __frame->sp = (unsigned long) frame;
- __frame->lr = (unsigned long) &frame->retcode;
- __frame->gr8 = sig;
- __frame->gr9 = (unsigned long) &frame->info;
-
if (current->personality & FDPIC_FUNCPTRS) {
struct fdpic_func_descriptor __user *funcptr =
(struct fdpic_func_descriptor __user *) ka->sa.sa_handler;
- __get_user(__frame->pc, &funcptr->text);
- __get_user(__frame->gr15, &funcptr->GOT);
+ struct fdpic_func_descriptor desc;
+ if (copy_from_user(&desc, funcptr, sizeof(desc)))
+ goto give_sigsegv;
+ __frame->pc = desc.text;
+ __frame->gr15 = desc.GOT;
} else {
__frame->pc = (unsigned long) ka->sa.sa_handler;
__frame->gr15 = 0;
}
- set_fs(USER_DS);
+ __frame->sp = (unsigned long) frame;
+ __frame->lr = (unsigned long) &frame->retcode;
+ __frame->gr8 = sig;
+ __frame->gr9 = (unsigned long) &frame->info;
/* the tracer may want to single-step inside the handler */
if (test_thread_flag(TIF_SINGLESTEP))
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 3/5] frv: avoid infinite loop of SIGSEGV delivery
2010-09-20 14:13 [PATCH 1/5] frv: restart_block.fn needs to be reset on sigreturn David Howells
2010-09-20 14:13 ` [PATCH 2/5] frv: fix address verification holes in setup_frame/setup_rt_frame David Howells
@ 2010-09-20 14:13 ` David Howells
2010-09-20 14:13 ` [PATCH 4/5] frv: handling of restart into restart_syscall is fscked David Howells
2010-09-20 14:13 ` [PATCH 5/5] frv: double syscall restarts, syscall restart in sigreturn() David Howells
3 siblings, 0 replies; 6+ messages in thread
From: David Howells @ 2010-09-20 14:13 UTC (permalink / raw)
To: torvalds, akpm; +Cc: linux-kernel, Al Viro, David Howells
From: Al Viro <viro@ftp.linux.org.uk>
Use force_sigsegv() rather than force_sig(SIGSEGV, ...) as the former resets
the SEGV handler pointer which will kill the process, rather than leaving it
open to an infinite loop if the SEGV handler itself caused a SEGV signal.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Howells <dhowells@redhat.com>
---
arch/frv/kernel/signal.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/frv/kernel/signal.c b/arch/frv/kernel/signal.c
index 5fb2d06..48203c6 100644
--- a/arch/frv/kernel/signal.c
+++ b/arch/frv/kernel/signal.c
@@ -329,7 +329,7 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
return 0;
give_sigsegv:
- force_sig(SIGSEGV, current);
+ force_sigsegv(sig, current);
return -EFAULT;
} /* end setup_frame() */
@@ -431,7 +431,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
return 0;
give_sigsegv:
- force_sig(SIGSEGV, current);
+ force_sigsegv(sig, current);
return -EFAULT;
} /* end setup_rt_frame() */
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 4/5] frv: handling of restart into restart_syscall is fscked
2010-09-20 14:13 [PATCH 1/5] frv: restart_block.fn needs to be reset on sigreturn David Howells
2010-09-20 14:13 ` [PATCH 2/5] frv: fix address verification holes in setup_frame/setup_rt_frame David Howells
2010-09-20 14:13 ` [PATCH 3/5] frv: avoid infinite loop of SIGSEGV delivery David Howells
@ 2010-09-20 14:13 ` David Howells
2010-09-20 14:13 ` [PATCH 5/5] frv: double syscall restarts, syscall restart in sigreturn() David Howells
3 siblings, 0 replies; 6+ messages in thread
From: David Howells @ 2010-09-20 14:13 UTC (permalink / raw)
To: torvalds, akpm; +Cc: linux-kernel, Al Viro, David Howells
From: Al Viro <viro@ftp.linux.org.uk>
do_signal() should place the syscall number in gr7, not gr8 when handling
ERESTART_WOULDBLOCK.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Howells <dhowells@redhat.com>
---
arch/frv/kernel/signal.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/arch/frv/kernel/signal.c b/arch/frv/kernel/signal.c
index 48203c6..bd13b57 100644
--- a/arch/frv/kernel/signal.c
+++ b/arch/frv/kernel/signal.c
@@ -547,7 +547,7 @@ no_signal:
break;
case -ERESTART_RESTARTBLOCK:
- __frame->gr8 = __NR_restart_syscall;
+ __frame->gr7 = __NR_restart_syscall;
__frame->pc -= 4;
break;
}
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 5/5] frv: double syscall restarts, syscall restart in sigreturn()
2010-09-20 14:13 [PATCH 1/5] frv: restart_block.fn needs to be reset on sigreturn David Howells
` (2 preceding siblings ...)
2010-09-20 14:13 ` [PATCH 4/5] frv: handling of restart into restart_syscall is fscked David Howells
@ 2010-09-20 14:13 ` David Howells
3 siblings, 0 replies; 6+ messages in thread
From: David Howells @ 2010-09-20 14:13 UTC (permalink / raw)
To: torvalds, akpm; +Cc: linux-kernel, Al Viro, David Howells
From: Al Viro <viro@ftp.linux.org.uk>
We need to make sure that only the first do_signal() to be handled
on the way out syscall will bother with syscall restarts; additionally,
the check on the "signal has user handler" path had been wrong -
compare with restart prevention in sigreturn()...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Howells <dhowells@redhat.com>
---
arch/frv/kernel/signal.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/arch/frv/kernel/signal.c b/arch/frv/kernel/signal.c
index bd13b57..bab0129 100644
--- a/arch/frv/kernel/signal.c
+++ b/arch/frv/kernel/signal.c
@@ -446,7 +446,7 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
int ret;
/* Are we from a system call? */
- if (in_syscall(__frame)) {
+ if (__frame->syscallno != -1) {
/* If so, check system call restarting.. */
switch (__frame->gr8) {
case -ERESTART_RESTARTBLOCK:
@@ -465,6 +465,7 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
__frame->gr8 = __frame->orig_gr8;
__frame->pc -= 4;
}
+ __frame->syscallno = -1;
}
/* Set up the stack frame */
@@ -551,6 +552,7 @@ no_signal:
__frame->pc -= 4;
break;
}
+ __frame->syscallno = -1;
}
/* if there's no signal to deliver, we just put the saved sigmask
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 3/5] frv: avoid infinite loop of SIGSEGV delivery
@ 2010-09-18 19:41 Al Viro
0 siblings, 0 replies; 6+ messages in thread
From: Al Viro @ 2010-09-18 19:41 UTC (permalink / raw)
To: linux-arch; +Cc: dhowells, linux-kernel
force_sigsegv() exists for a good reason...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
arch/frv/kernel/signal.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/frv/kernel/signal.c b/arch/frv/kernel/signal.c
index d06226b..fa40d54 100644
--- a/arch/frv/kernel/signal.c
+++ b/arch/frv/kernel/signal.c
@@ -329,7 +329,7 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
return 0;
give_sigsegv:
- force_sig(SIGSEGV, current);
+ force_sigsegv(sig, current);
return -EFAULT;
} /* end setup_frame() */
@@ -431,7 +431,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
return 0;
give_sigsegv:
- force_sig(SIGSEGV, current);
+ force_sigsegv(sig, current);
return -EFAULT;
} /* end setup_rt_frame() */
--
1.5.6.5
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-09-20 14:13 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-09-20 14:13 [PATCH 1/5] frv: restart_block.fn needs to be reset on sigreturn David Howells
2010-09-20 14:13 ` [PATCH 2/5] frv: fix address verification holes in setup_frame/setup_rt_frame David Howells
2010-09-20 14:13 ` [PATCH 3/5] frv: avoid infinite loop of SIGSEGV delivery David Howells
2010-09-20 14:13 ` [PATCH 4/5] frv: handling of restart into restart_syscall is fscked David Howells
2010-09-20 14:13 ` [PATCH 5/5] frv: double syscall restarts, syscall restart in sigreturn() David Howells
-- strict thread matches above, loose matches on Subject: below --
2010-09-18 19:41 [PATCH 3/5] frv: avoid infinite loop of SIGSEGV delivery Al Viro
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®