Changes in 4.9.326 Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put ntfs: fix use-after-free in ntfs_ucsncmp() scsi: ufs: host: Hold reference returned by of_parse_phandle() net: ping6: Fix memleak in ipv6_renew_options(). net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() netfilter: nf_queue: do not allow packet truncation below transport header offset ARM: crypto: comment out gcc warning that breaks clang builds mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle. ion: Make user_ion_handle_put_nolock() a void function selinux: Minor cleanups proc: Pass file mode to proc_pid_make_inode selinux: Clean up initialization of isec->sclass selinux: Convert isec->lock into a spinlock selinux: fix error initialization in inode_doinit_with_dentry() selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap init/main: Fix double "the" in comment init/main: properly align the multi-line comment init: move stack canary initialization after setup_arch init/main.c: extract early boot entropy from the passed cmdline ACPI: video: Force backlight native for some TongFang devices ACPI: video: Shortening quirk list by identifying Clevo by board_name only random: only call boot_init_stack_canary() once macintosh/adb: fix oob read in do_adb_query() function ALSA: bcd2000: Fix a UAF bug on the error path of probing add barriers to buffer_uptodate and set_buffer_uptodate KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: hda/cirrus - support for iMac 12,1 model vfs: Check the truncate maximum size in inode_newsize_ok() usbnet: Fix linkwatch use-after-free on disconnect parisc: Fix device names in /proc/iomem drm/nouveau: fix another off-by-one in nvbios_addr bpf: fix overflow in prog accounting fuse: limit nsec md-raid10: fix KASAN warning ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() PCI: Add defines for normal and subtractive PCI bridges powerpc/fsl-pci: Fix Class Code of PCIe Root Port powerpc/powernv: Avoid crashing if rng is NULL MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK USB: HCD: Fix URB giveback issue in tasklet function netfilter: nf_tables: fix null deref due to zeroed list head scsi: zfcp: Fix missing auto port scan and thus missing target ports x86/olpc: fix 'logical not is only applied to the left hand side' spmi: trace: fix stack-out-of-bound access in SPMI tracing functions ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h ext4: make sure ext4_append() always allocates new block ext4: fix use-after-free in ext4_xattr_set_entry ext4: update s_overhead_clusters in the superblock during an on-line resize ext4: fix extent status tree race in writeback error recovery path ext4: correct max_inline_xattr_value_size computing dm raid: fix address sanitizer warning in raid_status net_sched: cls_route: remove from list when handle is 0 btrfs: reject log replay if there is unsupported RO compat flag tcp: fix over estimation in sk_forced_mem_schedule() scsi: sg: Allow waiting for commands to complete on removed device Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression nios2: time: Read timer in get_cycles only if initialized net/9p: Initialize the iounit field during fid creation net_sched: cls_route: disallow handle of 0 ALSA: info: Fix llseek return value when using callback rds: add missing barrier to release_refill ata: libata-eh: Add missing command name btrfs: fix lost error handling when looking up extended ref on log replay can: ems_usb: fix clang's -Wunaligned-access warning NFSv4.1: RECLAIM_COMPLETE must handle EACCES SUNRPC: Reinitialise the backchannel request buffers before reuse pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed vsock: Fix memory leak in vsock_connect() xen/xenbus: fix return type in xenbus_file_read() atm: idt77252: fix use-after-free bugs caused by tst_timer nios2: page fault et.al. are *not* restartable syscalls... nios2: don't leave NULLs in sys_call_table[] nios2: traced syscall does need to check the syscall number nios2: fix syscall restart checks nios2: restarts apply only to the first sigframe we build... nios2: add force_successful_syscall_return() netfilter: nf_tables: really skip inactive sets when allocating name fec: Fix timer capture timing in `fec_ptp_enable_pps()` irqchip/tegra: Fix overflow implicit truncation warnings usb: host: ohci-ppc-of: Fix refcount leak bug gadgetfs: ep_io - wait until IRQ finishes cxl: Fix a memory leak in an error handling path drivers:md:fix a potential use-after-free bug ext4: avoid remove directory when directory is corrupted ext4: avoid resizing to a partial cluster size tty: serial: Fix refcount leak bug in ucc_uart.c vfio: Clear the caps->buf to NULL after free mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start ALSA: core: Add async signal helpers ALSA: timer: Use deferred fasync helper powerpc/64: Init jump labels before parse_early_param() video: fbdev: i740fb: Check the argument of i740_calc_vclk() MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Linux 4.9.326 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3ca17af58cd0c61bd81028c496849592cfd22f0f
325 lines
8.5 KiB
C
325 lines
8.5 KiB
C
/*
|
|
* Copyright (C) 2013-2014 Altera Corporation
|
|
* Copyright (C) 2011-2012 Tobias Klauser <tklauser@distanz.ch>
|
|
* Copyright (C) 2004 Microtronix Datacom Ltd
|
|
* Copyright (C) 1991, 1992 Linus Torvalds
|
|
*
|
|
* This file is subject to the terms and conditions of the GNU General Public
|
|
* License. See the file COPYING in the main directory of this archive
|
|
* for more details.
|
|
*/
|
|
|
|
#include <linux/signal.h>
|
|
#include <linux/errno.h>
|
|
#include <linux/ptrace.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/unistd.h>
|
|
#include <linux/personality.h>
|
|
#include <linux/tracehook.h>
|
|
|
|
#include <asm/ucontext.h>
|
|
#include <asm/cacheflush.h>
|
|
|
|
#define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
|
|
|
|
/*
|
|
* Do a signal return; undo the signal stack.
|
|
*
|
|
* Keep the return code on the stack quadword aligned!
|
|
* That makes the cache flush below easier.
|
|
*/
|
|
|
|
struct rt_sigframe {
|
|
struct siginfo info;
|
|
struct ucontext uc;
|
|
};
|
|
|
|
static inline int rt_restore_ucontext(struct pt_regs *regs,
|
|
struct switch_stack *sw,
|
|
struct ucontext *uc, int *pr2)
|
|
{
|
|
int temp;
|
|
unsigned long *gregs = uc->uc_mcontext.gregs;
|
|
int err;
|
|
|
|
/* Always make any pending restarted system calls return -EINTR */
|
|
current->restart_block.fn = do_no_restart_syscall;
|
|
|
|
err = __get_user(temp, &uc->uc_mcontext.version);
|
|
if (temp != MCONTEXT_VERSION)
|
|
goto badframe;
|
|
/* restore passed registers */
|
|
err |= __get_user(regs->r1, &gregs[0]);
|
|
err |= __get_user(regs->r2, &gregs[1]);
|
|
err |= __get_user(regs->r3, &gregs[2]);
|
|
err |= __get_user(regs->r4, &gregs[3]);
|
|
err |= __get_user(regs->r5, &gregs[4]);
|
|
err |= __get_user(regs->r6, &gregs[5]);
|
|
err |= __get_user(regs->r7, &gregs[6]);
|
|
err |= __get_user(regs->r8, &gregs[7]);
|
|
err |= __get_user(regs->r9, &gregs[8]);
|
|
err |= __get_user(regs->r10, &gregs[9]);
|
|
err |= __get_user(regs->r11, &gregs[10]);
|
|
err |= __get_user(regs->r12, &gregs[11]);
|
|
err |= __get_user(regs->r13, &gregs[12]);
|
|
err |= __get_user(regs->r14, &gregs[13]);
|
|
err |= __get_user(regs->r15, &gregs[14]);
|
|
err |= __get_user(sw->r16, &gregs[15]);
|
|
err |= __get_user(sw->r17, &gregs[16]);
|
|
err |= __get_user(sw->r18, &gregs[17]);
|
|
err |= __get_user(sw->r19, &gregs[18]);
|
|
err |= __get_user(sw->r20, &gregs[19]);
|
|
err |= __get_user(sw->r21, &gregs[20]);
|
|
err |= __get_user(sw->r22, &gregs[21]);
|
|
err |= __get_user(sw->r23, &gregs[22]);
|
|
/* gregs[23] is handled below */
|
|
err |= __get_user(sw->fp, &gregs[24]); /* Verify, should this be
|
|
settable */
|
|
err |= __get_user(sw->gp, &gregs[25]); /* Verify, should this be
|
|
settable */
|
|
|
|
err |= __get_user(temp, &gregs[26]); /* Not really necessary no user
|
|
settable bits */
|
|
err |= __get_user(regs->ea, &gregs[27]);
|
|
|
|
err |= __get_user(regs->ra, &gregs[23]);
|
|
err |= __get_user(regs->sp, &gregs[28]);
|
|
|
|
regs->orig_r2 = -1; /* disable syscall checks */
|
|
|
|
err |= restore_altstack(&uc->uc_stack);
|
|
if (err)
|
|
goto badframe;
|
|
|
|
*pr2 = regs->r2;
|
|
return err;
|
|
|
|
badframe:
|
|
return 1;
|
|
}
|
|
|
|
asmlinkage int do_rt_sigreturn(struct switch_stack *sw)
|
|
{
|
|
struct pt_regs *regs = (struct pt_regs *)(sw + 1);
|
|
/* Verify, can we follow the stack back */
|
|
struct rt_sigframe *frame = (struct rt_sigframe *) regs->sp;
|
|
sigset_t set;
|
|
int rval;
|
|
|
|
if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
|
|
goto badframe;
|
|
|
|
if (__copy_from_user(&set, &frame->uc.uc_sigmask, sizeof(set)))
|
|
goto badframe;
|
|
|
|
set_current_blocked(&set);
|
|
|
|
if (rt_restore_ucontext(regs, sw, &frame->uc, &rval))
|
|
goto badframe;
|
|
|
|
return rval;
|
|
|
|
badframe:
|
|
force_sig(SIGSEGV, current);
|
|
return 0;
|
|
}
|
|
|
|
static inline int rt_setup_ucontext(struct ucontext *uc, struct pt_regs *regs)
|
|
{
|
|
struct switch_stack *sw = (struct switch_stack *)regs - 1;
|
|
unsigned long *gregs = uc->uc_mcontext.gregs;
|
|
int err = 0;
|
|
|
|
err |= __put_user(MCONTEXT_VERSION, &uc->uc_mcontext.version);
|
|
err |= __put_user(regs->r1, &gregs[0]);
|
|
err |= __put_user(regs->r2, &gregs[1]);
|
|
err |= __put_user(regs->r3, &gregs[2]);
|
|
err |= __put_user(regs->r4, &gregs[3]);
|
|
err |= __put_user(regs->r5, &gregs[4]);
|
|
err |= __put_user(regs->r6, &gregs[5]);
|
|
err |= __put_user(regs->r7, &gregs[6]);
|
|
err |= __put_user(regs->r8, &gregs[7]);
|
|
err |= __put_user(regs->r9, &gregs[8]);
|
|
err |= __put_user(regs->r10, &gregs[9]);
|
|
err |= __put_user(regs->r11, &gregs[10]);
|
|
err |= __put_user(regs->r12, &gregs[11]);
|
|
err |= __put_user(regs->r13, &gregs[12]);
|
|
err |= __put_user(regs->r14, &gregs[13]);
|
|
err |= __put_user(regs->r15, &gregs[14]);
|
|
err |= __put_user(sw->r16, &gregs[15]);
|
|
err |= __put_user(sw->r17, &gregs[16]);
|
|
err |= __put_user(sw->r18, &gregs[17]);
|
|
err |= __put_user(sw->r19, &gregs[18]);
|
|
err |= __put_user(sw->r20, &gregs[19]);
|
|
err |= __put_user(sw->r21, &gregs[20]);
|
|
err |= __put_user(sw->r22, &gregs[21]);
|
|
err |= __put_user(sw->r23, &gregs[22]);
|
|
err |= __put_user(regs->ra, &gregs[23]);
|
|
err |= __put_user(sw->fp, &gregs[24]);
|
|
err |= __put_user(sw->gp, &gregs[25]);
|
|
err |= __put_user(regs->ea, &gregs[27]);
|
|
err |= __put_user(regs->sp, &gregs[28]);
|
|
return err;
|
|
}
|
|
|
|
static inline void *get_sigframe(struct ksignal *ksig, struct pt_regs *regs,
|
|
size_t frame_size)
|
|
{
|
|
unsigned long usp;
|
|
|
|
/* Default to using normal stack. */
|
|
usp = regs->sp;
|
|
|
|
/* This is the X/Open sanctioned signal stack switching. */
|
|
usp = sigsp(usp, ksig);
|
|
|
|
/* Verify, is it 32 or 64 bit aligned */
|
|
return (void *)((usp - frame_size) & -8UL);
|
|
}
|
|
|
|
static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
|
|
struct pt_regs *regs)
|
|
{
|
|
struct rt_sigframe *frame;
|
|
int err = 0;
|
|
|
|
frame = get_sigframe(ksig, regs, sizeof(*frame));
|
|
|
|
if (ksig->ka.sa.sa_flags & SA_SIGINFO)
|
|
err |= copy_siginfo_to_user(&frame->info, &ksig->info);
|
|
|
|
/* Create the ucontext. */
|
|
err |= __put_user(0, &frame->uc.uc_flags);
|
|
err |= __put_user(0, &frame->uc.uc_link);
|
|
err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
|
|
err |= rt_setup_ucontext(&frame->uc, regs);
|
|
err |= copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
|
|
|
|
if (err)
|
|
goto give_sigsegv;
|
|
|
|
/* Set up to return from userspace; jump to fixed address sigreturn
|
|
trampoline on kuser page. */
|
|
regs->ra = (unsigned long) (0x1044);
|
|
|
|
/* Set up registers for signal handler */
|
|
regs->sp = (unsigned long) frame;
|
|
regs->r4 = (unsigned long) ksig->sig;
|
|
regs->r5 = (unsigned long) &frame->info;
|
|
regs->r6 = (unsigned long) &frame->uc;
|
|
regs->ea = (unsigned long) ksig->ka.sa.sa_handler;
|
|
return 0;
|
|
|
|
give_sigsegv:
|
|
force_sigsegv(ksig->sig, current);
|
|
return -EFAULT;
|
|
}
|
|
|
|
/*
|
|
* OK, we're invoking a handler
|
|
*/
|
|
static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
|
|
{
|
|
int ret;
|
|
sigset_t *oldset = sigmask_to_save();
|
|
|
|
/* set up the stack frame */
|
|
ret = setup_rt_frame(ksig, oldset, regs);
|
|
|
|
signal_setup_done(ret, ksig, 0);
|
|
}
|
|
|
|
static int do_signal(struct pt_regs *regs)
|
|
{
|
|
unsigned int retval = 0, continue_addr = 0, restart_addr = 0;
|
|
int restart = 0;
|
|
struct ksignal ksig;
|
|
|
|
current->thread.kregs = regs;
|
|
|
|
/*
|
|
* If we were from a system call, check for system call restarting...
|
|
*/
|
|
if (regs->orig_r2 >= 0 && regs->r1) {
|
|
continue_addr = regs->ea;
|
|
restart_addr = continue_addr - 4;
|
|
retval = regs->r2;
|
|
|
|
/*
|
|
* Prepare for system call restart. We do this here so that a
|
|
* debugger will see the already changed PC.
|
|
*/
|
|
switch (retval) {
|
|
case ERESTART_RESTARTBLOCK:
|
|
restart = -2;
|
|
case ERESTARTNOHAND:
|
|
case ERESTARTSYS:
|
|
case ERESTARTNOINTR:
|
|
restart++;
|
|
regs->r2 = regs->orig_r2;
|
|
regs->r7 = regs->orig_r7;
|
|
regs->ea = restart_addr;
|
|
break;
|
|
}
|
|
regs->orig_r2 = -1;
|
|
}
|
|
|
|
if (get_signal(&ksig)) {
|
|
/* handler */
|
|
if (unlikely(restart && regs->ea == restart_addr)) {
|
|
if (retval == ERESTARTNOHAND ||
|
|
retval == ERESTART_RESTARTBLOCK ||
|
|
(retval == ERESTARTSYS
|
|
&& !(ksig.ka.sa.sa_flags & SA_RESTART))) {
|
|
regs->r2 = EINTR;
|
|
regs->r7 = 1;
|
|
regs->ea = continue_addr;
|
|
}
|
|
}
|
|
handle_signal(&ksig, regs);
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* No handler present
|
|
*/
|
|
if (unlikely(restart) && regs->ea == restart_addr) {
|
|
regs->ea = continue_addr;
|
|
regs->r2 = __NR_restart_syscall;
|
|
}
|
|
|
|
/*
|
|
* If there's no signal to deliver, we just put the saved sigmask back.
|
|
*/
|
|
restore_saved_sigmask();
|
|
|
|
return restart;
|
|
}
|
|
|
|
asmlinkage int do_notify_resume(struct pt_regs *regs)
|
|
{
|
|
/*
|
|
* We want the common case to go fast, which is why we may in certain
|
|
* cases get here from kernel mode. Just return without doing anything
|
|
* if so.
|
|
*/
|
|
if (!user_mode(regs))
|
|
return 0;
|
|
|
|
if (test_thread_flag(TIF_SIGPENDING)) {
|
|
int restart = do_signal(regs);
|
|
|
|
if (unlikely(restart)) {
|
|
/*
|
|
* Restart without handlers.
|
|
* Deal with it without leaving
|
|
* the kernel space.
|
|
*/
|
|
return restart;
|
|
}
|
|
} else if (test_and_clear_thread_flag(TIF_NOTIFY_RESUME))
|
|
tracehook_notify_resume(regs);
|
|
|
|
return 0;
|
|
}
|