On Tue, Jul 29, 2014 at 03:37:32PM +0100, Ben Hutchings wrote: > On Mon, 2014-07-28 at 21:45 -0700, gregkh@xxxxxxxxxxxxxxxxxxx wrote: > > This is a note to let you know that I've just added the patch titled > > > > s390/ptrace: fix PSW mask check > > > > to the 3.4-stable tree which can be found at: > > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary > > > > The filename of the patch is: > > s390-ptrace-fix-psw-mask-check.patch > > and it can be found in the queue-3.4 subdirectory. > > > > If you, or anyone else, feels it should not be added to the stable tree, > > please let <stable@xxxxxxxxxxxxxxx> know about it. > [...] > > This backport is wrong. I think Martin's version for 3.2 (attached) > should also work for 3.4 and 3.10. > > Ben. > Thanks, I'll use this backport for the 3.11 kernel as well. Cheers, -- Luís > -- > Ben Hutchings > Larkinson's Law: All laws are basically false. > From: Martin Schwidefsky <schwidefsky@xxxxxxxxxx> > Date: Mon, 23 Jun 2014 14:43:06 +0200 > Subject: s390/ptrace: fix PSW mask check > > commit dab6cf55f81a6e16b8147aed9a843e1691dcd318 upstream. > > The PSW mask check of the PTRACE_POKEUSR_AREA command is incorrect. > For the default user_mode=home address space layout the psw_user_bits > variable has the home space address-space-control bits set. But the > PSW_MASK_USER contains PSW_MASK_ASC, the ptrace validity check for the > PSW mask will therefore always fail. > > Fixes CVE-2014-3534 > > Signed-off-by: Martin Schwidefsky <schwidefsky@xxxxxxxxxx> > --- > > --- a/arch/s390/kernel/ptrace.c > +++ b/arch/s390/kernel/ptrace.c > @@ -292,7 +292,9 @@ static int __poke_user(struct task_struc > * psw and gprs are stored on the stack > */ > if (addr == (addr_t) &dummy->regs.psw.mask && > - ((data & ~PSW_MASK_USER) != psw_user_bits || > + (((data^psw_user_bits) & ~PSW_MASK_USER) || > + (((data^psw_user_bits) & PSW_MASK_ASC) && > + ((data|psw_user_bits) & PSW_MASK_ASC) == PSW_MASK_ASC) || > ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA)))) > /* Invalid psw mask. */ > return -EINVAL; > @@ -595,7 +597,10 @@ static int __poke_user_compat(struct tas > */ > if (addr == (addr_t) &dummy32->regs.psw.mask) { > /* Build a 64 bit psw mask from 31 bit mask. */ > - if ((tmp & ~PSW32_MASK_USER) != psw32_user_bits) > + if (((tmp^psw32_user_bits) & ~PSW32_MASK_USER) || > + (((tmp^psw32_user_bits) & PSW32_MASK_ASC) && > + ((tmp|psw32_user_bits) & PSW32_MASK_ASC) > + == PSW32_MASK_ASC)) > /* Invalid psw mask. */ > return -EINVAL; > regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) | -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html