This is a note to let you know that I've just added the patch titled
ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path
to the 3.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
arm-7526-1-traps-send-sigill-if-get_user-fails-on-undef-handling-path.patch
and it can be found in the queue-3.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 2b2040af0b64cd93e5d4df2494c4486cf604090d Mon Sep 17 00:00:00 2001
From: Will Deacon <[email protected]>
Date: Fri, 7 Sep 2012 18:21:44 +0100
Subject: ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling
path
From: Will Deacon <[email protected]>
commit 2b2040af0b64cd93e5d4df2494c4486cf604090d upstream.
get_user may fail to load from the provided __user address due to an
unhandled fault generated by the access.
In the case of the undefined instruction trap, this results in failure
to load the faulting instruction, in which case we should send SIGILL to
the task rather than continue with potentially uninitialised data.
Signed-off-by: Will Deacon <[email protected]>
Signed-off-by: Russell King <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/arm/kernel/traps.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -388,20 +388,23 @@ asmlinkage void __exception do_undefinst
#endif
instr = *(u32 *) pc;
} else if (thumb_mode(regs)) {
- get_user(instr, (u16 __user *)pc);
+ if (get_user(instr, (u16 __user *)pc))
+ goto die_sig;
if (is_wide_instruction(instr)) {
unsigned int instr2;
- get_user(instr2, (u16 __user *)pc+1);
+ if (get_user(instr2, (u16 __user *)pc+1))
+ goto die_sig;
instr <<= 16;
instr |= instr2;
}
- } else {
- get_user(instr, (u32 __user *)pc);
+ } else if (get_user(instr, (u32 __user *)pc)) {
+ goto die_sig;
}
if (call_undef_hook(regs, instr) == 0)
return;
+die_sig:
#ifdef CONFIG_DEBUG_USER
if (user_debug & UDBG_UNDEFINED) {
printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",
Patches currently in stable-queue which might be from [email protected] are
queue-3.5/arm-7527-1-uaccess-explicitly-check-__user-pointer-when-cpu_use_domains.patch
queue-3.5/arm-7526-1-traps-send-sigill-if-get_user-fails-on-undef-handling-path.patch
queue-3.5/arm-7496-1-hw_breakpoint-don-t-rely-on-dfsr-to-show-watchpoint-access-type.patch
queue-3.5/arm-7501-1-decompressor-reset-ttbcr-for-vmsa-armv7-cores.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
