From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Martin Schwidefsky <schwidefsky@de.ibm.com>
Subject: [PATCH 3.15 12/37] s390/ptrace: fix PSW mask check
Date: Tue, 29 Jul 2014 18:48:48 -0700 [thread overview]
Message-ID: <20140730014828.258081449@linuxfoundation.org> (raw)
In-Reply-To: <20140730014827.565626091@linuxfoundation.org>
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
commit dab6cf55f81a6e16b8147aed9a843e1691dcd318 upstream.
The PSW mask check of the PTRACE_POKEUSR_AREA command is incorrect.
The PSW_MASK_USER define contains the PSW_MASK_ASC bits, the ptrace
interface accepts all combinations for the address-space-control
bits. To protect the kernel space the PSW mask check in ptrace needs
to reject the address-space-control bit combination for home space.
Fixes CVE-2014-3534
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/ptrace.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -334,9 +334,14 @@ static int __poke_user(struct task_struc
unsigned long mask = PSW_MASK_USER;
mask |= is_ri_task(child) ? PSW_MASK_RI : 0;
- if ((data & ~mask) != PSW_USER_BITS)
+ if ((data ^ PSW_USER_BITS) & ~mask)
+ /* Invalid psw mask. */
+ return -EINVAL;
+ if ((data & PSW_MASK_ASC) == PSW_ASC_HOME)
+ /* Invalid address-space-control bits */
return -EINVAL;
if ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA))
+ /* Invalid addressing mode bits */
return -EINVAL;
}
*(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data;
@@ -672,9 +677,12 @@ static int __poke_user_compat(struct tas
mask |= is_ri_task(child) ? PSW32_MASK_RI : 0;
/* Build a 64 bit psw mask from 31 bit mask. */
- if ((tmp & ~mask) != PSW32_USER_BITS)
+ if ((tmp ^ PSW32_USER_BITS) & ~mask)
/* Invalid psw mask. */
return -EINVAL;
+ if ((data & PSW32_MASK_ASC) == PSW32_ASC_HOME)
+ /* Invalid address-space-control bits */
+ return -EINVAL;
regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
(regs->psw.mask & PSW_MASK_BA) |
(__u64)(tmp & mask) << 32;
next prev parent reply other threads:[~2014-07-30 1:59 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-07-30 1:48 [PATCH 3.15 00/37] 3.15.8-stable review Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 01/37] media: staging: tighten omap4iss dependencies Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 02/37] media: media: v4l2-core: v4l2-dv-timings.c: Cleaning up code wrong value used in aspect ratio Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 03/37] media: af9035: override tuner id when bad value set into eeprom Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 04/37] media: hdpvr: fix two audio bugs Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 05/37] media: tda10071: force modulation to QPSK on DVB-S Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 06/37] nfs: only show Posix ACLs in listxattr if actually present Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 07/37] xtensa: fix sysmem reservation at the end of existing block Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 08/37] block: provide compat ioctl for BLKZEROOUT Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 09/37] block: dont assume last put of shared tags is for the host Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 10/37] libata: support the ata host which implements a queue depth less than 32 Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 11/37] libata: introduce ata_host->n_tags to avoid oops on SAS controllers Greg Kroah-Hartman
2014-07-30 1:48 ` Greg Kroah-Hartman [this message]
2014-07-30 1:48 ` [PATCH 3.15 13/37] ahci: add support for the Promise FastTrak TX8660 SATA HBA (ahci mode) Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 14/37] blkcg: dont call into policy draining if root_blkg is already gone Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 15/37] tracing: Fix wraparound problems in "uptime" trace clock Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 16/37] zram: avoid lockdep splat by revalidate_disk Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 17/37] powerpc/pseries: dynamically added OF nodes need to call of_node_init Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 18/37] slab_common: fix the check for duplicate slab names Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 19/37] Input: synaptics - add min/max quirk for pnp-id LEN2002 (Edge E531) Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 20/37] Input: fix defuzzing logic Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 21/37] coredump: fix the setting of PF_DUMPCORE Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 22/37] fuse: s_time_gran fix Greg Kroah-Hartman
2014-07-30 1:48 ` [PATCH 3.15 23/37] fuse: add FUSE_NO_OPEN_SUPPORT flag to INIT Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 24/37] pinctrl: st: Fix irqmux handler Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 25/37] parisc: Remove SA_RESTORER define Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 26/37] hwmon: (smsc47m192) Fix temperature limit and vrm write operations Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 27/37] parport: fix menu breakage Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 28/37] fs: umount on symlink leaks mnt count Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 29/37] x86_32, entry: Store badsys error code in %eax Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 32/37] mm: hugetlb: fix copy_hugetlb_page_range() Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 34/37] hwrng: virtio - ensure reads happen after successful probe Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 35/37] mm: do not call do_fault_around for non-linear fault Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 36/37] nl80211: move set_qos_map command into split state Greg Kroah-Hartman
2014-07-30 1:49 ` [PATCH 3.15 37/37] platform_get_irq: Revert to platform_get_resource if of_irq_get fails Greg Kroah-Hartman
[not found] ` <20140730014829.344302554@linuxfoundation.org>
2014-07-30 6:53 ` [PATCH 3.15 33/37] Fix gcc-4.9.0 miscompilation of load_balance() in scheduler Jakub Jelinek
2014-07-30 7:13 ` Markus Trippelsdorf
2014-07-30 7:21 ` Jakub Jelinek
2014-07-30 7:27 ` Markus Trippelsdorf
2014-07-30 15:47 ` Linus Torvalds
2014-08-05 11:31 ` Josh Boyer
2014-08-05 11:46 ` Markus Trippelsdorf
2014-08-05 15:24 ` Jakub Jelinek
2014-08-05 15:19 ` Greg Kroah-Hartman
2014-08-05 16:49 ` Linus Torvalds
2014-08-05 20:57 ` Josh Boyer
2014-08-05 21:07 ` Frank Ch. Eigler
2014-08-05 22:36 ` Linus Torvalds
2014-08-05 23:30 ` Frank Ch. Eigler
2014-08-05 23:59 ` Linus Torvalds
2014-10-06 21:05 ` [PATCH] Kbuild: Add an option to enable GCC VTA Josh Stone
2014-08-06 8:14 ` [PATCH 3.15 33/37] Fix gcc-4.9.0 miscompilation of load_balance() in scheduler Jakub Jelinek
2014-08-06 10:23 ` Måns Rullgård
2014-08-06 16:34 ` Alexei Starovoitov
2014-07-30 11:58 ` [PATCH 3.15 00/37] 3.15.8-stable review Satoru Takeuchi
2014-07-30 15:50 ` Greg Kroah-Hartman
2014-07-30 16:09 ` Guenter Roeck
2014-07-30 22:23 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140730014828.258081449@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=schwidefsky@de.ibm.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome