Re: [PATCH v2] MIPS: Prevent "restoration" of MSA context in non-MSA kernels

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

On Thu, Apr 21, 2016 at 06:04:53PM +0100, Paul Burton wrote:
> If a kernel doesn't support MSA context (ie. CONFIG_CPU_HAS_MSA=n) then
> it will only keep 64 bits per FP register in thread context, and the
> calls to set_fpr64 in restore_msa_extcontext will overrun the end of the
> FP register context into the FCSR & MSACSR values. GCC 6.x has become
> smart enough to detect this & complain like so:
> 
>     arch/mips/kernel/signal.c: In function 'protected_restore_fp_context':
>     ./arch/mips/include/asm/processor.h:114:17: error: array subscript is above array bounds [-Werror=array-bounds]
>       fpr->val##width[FPR_IDX(width, idx)] = val;   \
>       ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~
>     ./arch/mips/include/asm/processor.h:118:1: note: in expansion of macro 'BUILD_FPR_ACCESS'
>      BUILD_FPR_ACCESS(64)
> 
> The only way to trigger this code to run would be for a program to set
> up an artificial extended MSA context structure following a sigframe &
> execute sigreturn. Whilst this doesn't allow a program to write to any
> state that it couldn't already, it makes little sense to allow this
> "restoration" of MSA context in a system that doesn't support MSA.
> 
> Fix this by killing a program with SIGSYS if it tries something as crazy
> as "restoring" fake MSA context in this way, also fixing the build error
> & allowing for most of restore_msa_extcontext to be optimised out of
> kernels without support for MSA.
> 
> Signed-off-by: Paul Burton <paul.burton@xxxxxxxxxx>
> Reported-by: Michal Toman <michal.toman@xxxxxxxxxx>
> Fixes: bf82cb30c7e5 ("MIPS: Save MSA extended context around signals")
> Cc: James Hogan <james.hogan@xxxxxxxxxx>
> Cc: stable <stable@xxxxxxxxxxxxxxx> # v4.3+

This patch is needed to build MIPS kernel with GCC 6.1.

Tested-by: Aaro Koskinen <aaro.koskinen@xxxxxx>

Thanks,

A.


> ---
> 
> Changes in v2:
> - Prevent potential for malformed errno/signal from protected_restore_fp_context.
> 
>  arch/mips/kernel/signal.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
> index bf792e2..fc7c1f0 100644
> --- a/arch/mips/kernel/signal.c
> +++ b/arch/mips/kernel/signal.c
> @@ -195,6 +195,9 @@ static int restore_msa_extcontext(void __user *buf, unsigned int size)
>  	unsigned int csr;
>  	int i, err;
>  
> +	if (!config_enabled(CONFIG_CPU_HAS_MSA))
> +		return SIGSYS;
> +
>  	if (size != sizeof(*msa))
>  		return -EINVAL;
>  
> @@ -398,8 +401,8 @@ int protected_restore_fp_context(void __user *sc)
>  	}
>  
>  fp_done:
> -	if (used & USED_EXTCONTEXT)
> -		err |= restore_extcontext(sc_to_extcontext(sc));
> +	if (!err && (used & USED_EXTCONTEXT))
> +		err = restore_extcontext(sc_to_extcontext(sc));
>  
>  	return err ?: sig;
>  }
> -- 
> 2.8.0
> 
> 
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]