From: Al Viro Date: Fri, 24 Sep 2021 00:35:42 +0000 (+0000) Subject: csky: don't let sigreturn play with priveleged bits of status register X-Git-Tag: accepted/tizen/unified/20230118.172025~6180^2~4 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=fbd63c08cdcca5fb1315aca3172b3c9c272cfb4f;p=platform%2Fkernel%2Flinux-rpi.git csky: don't let sigreturn play with priveleged bits of status register csky restore_sigcontext() blindly overwrites regs->sr with the value it finds in sigcontext. Attacker can store whatever they want in there, which includes things like S-bit. Userland shouldn't be able to set that, or anything other than C flag (bit 0). Do the same thing other architectures with protected bits in flags register do - preserve everything that shouldn't be settable in user mode, picking the rest from the value saved is sigcontext. Signed-off-by: Al Viro Signed-off-by: Guo Ren Cc: stable@vger.kernel.org --- diff --git a/arch/csky/kernel/signal.c b/arch/csky/kernel/signal.c index bc4238b..c7b763d2 100644 --- a/arch/csky/kernel/signal.c +++ b/arch/csky/kernel/signal.c @@ -52,10 +52,14 @@ static long restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc) { int err = 0; + unsigned long sr = regs->sr; /* sc_pt_regs is structured the same as the start of pt_regs */ err |= __copy_from_user(regs, &sc->sc_pt_regs, sizeof(struct pt_regs)); + /* BIT(0) of regs->sr is Condition Code/Carry bit */ + regs->sr = (sr & ~1) | (regs->sr & 1); + /* Restore the floating-point state. */ err |= restore_fpu_state(sc);