lkml.org 
[lkml]   [2017]   [Sep]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4/4] arm64/syscalls: Move address limit check in loop
    Date
    From: Thomas Garnier <thgarnie@google.com>

    A bug was reported on ARM where set_fs might be called after it was
    checked on the work pending function. ARM64 is not affected by this bug
    but has a similar construct. In order to avoid any similar problems in
    the future, the addr_limit_user_check function is moved at the beginning
    of the loop.

    Fixes: cf7de27ab351 ("arm64/syscalls: Check address limit on user-mode return")
    Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
    Signed-off-by: Thomas Garnier <thgarnie@google.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    arch/arm64/kernel/signal.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
    index c45214f8fb54..0bdc96c61bc0 100644
    --- a/arch/arm64/kernel/signal.c
    +++ b/arch/arm64/kernel/signal.c
    @@ -751,10 +751,10 @@ asmlinkage void do_notify_resume(struct pt_regs *regs,
    */
    trace_hardirqs_off();

    - /* Check valid user FS if needed */
    - addr_limit_user_check();
    -
    do {
    + /* Check valid user FS if needed */
    + addr_limit_user_check();
    +
    if (thread_flags & _TIF_NEED_RESCHED) {
    schedule();
    } else {
    --
    2.7.4
    \
     
     \ /
      Last update: 2017-09-07 17:31    [W:14.073 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site