csky: don't let sigreturn play with priveleged bits of status register
authorAl Viro <viro@zeniv.linux.org.uk>
Fri, 24 Sep 2021 00:35:42 +0000 (00:35 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Oct 2021 09:44:58 +0000 (11:44 +0200)
commit5dab6e8f141a305030b37d9e6fcbe7c27b3513ab
treef90dcd8a7cf492d8f83b8c6862e8a059e2a5b0d7
parente3c37135c9ca9d7a31a8fbb6520947d5406c44c1
csky: don't let sigreturn play with priveleged bits of status register

commit fbd63c08cdcca5fb1315aca3172b3c9c272cfb4f upstream.

csky restore_sigcontext() blindly overwrites regs->sr with the value
it finds in sigcontext.  Attacker can store whatever they want in there,
which includes things like S-bit.  Userland shouldn't be able to set
that, or anything other than C flag (bit 0).

Do the same thing other architectures with protected bits in flags
register do - preserve everything that shouldn't be settable in
user mode, picking the rest from the value saved is sigcontext.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Guo Ren <guoren@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/csky/kernel/signal.c