From: "Dmitry V. Levin" <ldv@altlinux.org>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: Ingo Molnar <mingo@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Andrew Morton <akpm@linux-foundation.org>,
sparclinux@vger.kernel.org, linux-kernel@vger.kernel.org,
Anatoly Pugachev <matorola@gmail.com>,
Eugene Syromyatnikov <evgsyr@gmail.com>
Subject: [PATCH] Fix compat_sys_sigpending breakage introduced by v4.13-rc1~6^2~12
Date: Sat, 05 Aug 2017 20:00:50 +0000 [thread overview]
Message-ID: <20170805200050.GA24804@altlinux.org> (raw)
The latest change of compat_sys_sigpending has broken it in two ways.
First, it tries to write 4 bytes more than userspace expects:
sizeof(old_sigset_t) = sizeof(long) = 8 instead of
sizeof(compat_old_sigset_t) = sizeof(u32) = 4.
Second, on big endian architectures these bytes are being written
in the wrong order.
This bug was found by strace test suite.
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Inspired-by: Eugene Syromyatnikov <evgsyr@gmail.com>
Fixes: 8f13621abced ("sigpending(): move compat to native")
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
---
kernel/signal.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/kernel/signal.c b/kernel/signal.c
index caed913..7e33f8c 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3303,12 +3303,15 @@ SYSCALL_DEFINE1(sigpending, old_sigset_t __user *, set)
#ifdef CONFIG_COMPAT
COMPAT_SYSCALL_DEFINE1(sigpending, compat_old_sigset_t __user *, set32)
{
+#ifdef __BIG_ENDIAN
sigset_t set;
- int err = do_sigpending(&set, sizeof(old_sigset_t));
- if (err = 0)
- if (copy_to_user(set32, &set, sizeof(old_sigset_t)))
- err = -EFAULT;
+ int err = do_sigpending(&set, sizeof(set.sig[0]));
+ if (!err)
+ err = put_user(set.sig[0], set32);
return err;
+#else
+ return sys_rt_sigpending((sigset_t __user *)set32, sizeof(*set32));
+#endif
}
#endif
--
ldv
WARNING: multiple messages have this Message-ID (diff)
From: "Dmitry V. Levin" <ldv@altlinux.org>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: Ingo Molnar <mingo@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Andrew Morton <akpm@linux-foundation.org>,
sparclinux@vger.kernel.org, linux-kernel@vger.kernel.org,
Anatoly Pugachev <matorola@gmail.com>,
Eugene Syromyatnikov <evgsyr@gmail.com>
Subject: [PATCH] Fix compat_sys_sigpending breakage introduced by v4.13-rc1~6^2~12
Date: Sat, 5 Aug 2017 23:00:50 +0300 [thread overview]
Message-ID: <20170805200050.GA24804@altlinux.org> (raw)
The latest change of compat_sys_sigpending has broken it in two ways.
First, it tries to write 4 bytes more than userspace expects:
sizeof(old_sigset_t) == sizeof(long) == 8 instead of
sizeof(compat_old_sigset_t) == sizeof(u32) == 4.
Second, on big endian architectures these bytes are being written
in the wrong order.
This bug was found by strace test suite.
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Inspired-by: Eugene Syromyatnikov <evgsyr@gmail.com>
Fixes: 8f13621abced ("sigpending(): move compat to native")
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
---
kernel/signal.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/kernel/signal.c b/kernel/signal.c
index caed913..7e33f8c 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3303,12 +3303,15 @@ SYSCALL_DEFINE1(sigpending, old_sigset_t __user *, set)
#ifdef CONFIG_COMPAT
COMPAT_SYSCALL_DEFINE1(sigpending, compat_old_sigset_t __user *, set32)
{
+#ifdef __BIG_ENDIAN
sigset_t set;
- int err = do_sigpending(&set, sizeof(old_sigset_t));
- if (err == 0)
- if (copy_to_user(set32, &set, sizeof(old_sigset_t)))
- err = -EFAULT;
+ int err = do_sigpending(&set, sizeof(set.sig[0]));
+ if (!err)
+ err = put_user(set.sig[0], set32);
return err;
+#else
+ return sys_rt_sigpending((sigset_t __user *)set32, sizeof(*set32));
+#endif
}
#endif
--
ldv
next reply other threads:[~2017-08-05 20:00 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-05 20:00 Dmitry V. Levin [this message]
2017-08-05 20:00 ` [PATCH] Fix compat_sys_sigpending breakage introduced by v4.13-rc1~6^2~12 Dmitry V. Levin
2017-08-06 18:22 ` Al Viro
2017-08-06 18:22 ` Al Viro
2017-08-06 18:46 ` Linus Torvalds
2017-08-06 18:46 ` Linus Torvalds
2017-08-21 23:09 ` Dmitry V. Levin
2017-08-21 23:16 ` [PATCH 1/3] signal: replace sigset_to_compat() with put_compat_sigset() Dmitry V. Levin
2017-08-21 23:16 ` Dmitry V. Levin
2017-08-21 23:16 ` [PATCH 2/3] signal: simplify compat_sigpending() Dmitry V. Levin
2017-08-21 23:16 ` [PATCH 3/3] signal: lift sigset size check out of do_sigpending() Dmitry V. Levin
2017-08-28 4:41 ` [PATCH] Fix compat_sys_sigpending breakage introduced by v4.13-rc1~6^2~12 Al Viro
2017-08-28 4:41 ` Al Viro
2017-08-28 15:27 ` Sam Ravnborg
2017-08-28 15:27 ` Sam Ravnborg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170805200050.GA24804@altlinux.org \
--to=ldv@altlinux.org \
--cc=akpm@linux-foundation.org \
--cc=evgsyr@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=matorola@gmail.com \
--cc=mingo@kernel.org \
--cc=sparclinux@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.