public inbox for linux-arm-kernel@lists.infradead.org
 help / color / mirror / Atom feed
From: Kevin Brodsky <kevin.brodsky@arm.com>
To: linux-arm-kernel@lists.infradead.org
Cc: Kevin Brodsky <kevin.brodsky@arm.com>,
	 Andrew Morton <akpm@linux-foundation.org>,
	 Catalin Marinas <catalin.marinas@arm.com>,
	 "David Hildenbrand (Arm)" <david@kernel.org>,
	 Joey Gouly <joey.gouly@arm.com>, Mark Brown <broonie@kernel.org>,
	 Shuah Khan <shuah@kernel.org>, Will Deacon <will@kernel.org>,
	 linux-kselftest@vger.kernel.org, linux-mm@kvack.org,
	 linux-kernel@vger.kernel.org
Subject: [PATCH v2 2/5] selftests/mm: Fix resv_sz when parsing arm64 signal frame
Date: Mon, 27 Apr 2026 13:03:34 +0100	[thread overview]
Message-ID: <20260427-poe_signal-v2-2-2bd9d6f16ab4@arm.com> (raw)
In-Reply-To: <20260427-poe_signal-v2-0-2bd9d6f16ab4@arm.com>

get_header() wants the size of the reserved area in struct
sigcontext, but instead we pass it the size of the entire struct.
This could in theory result in an out-of-bounds read (if the signal
frame is malformed).

Fix this using one of the existing macros from
tools/testing/selftests/arm64/signal/testcases/testcases.h.

This issue was reported by Sashiko on a patch that copied this
portion of the code.

Link: https://sashiko.dev/#/patchset/20260421144252.1440365-1-kevin.brodsky%40arm.com
Fixes: f5b5ea51f78f ("selftests: mm: make protection_keys test work on arm64")
Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
---
 tools/testing/selftests/mm/pkey-arm64.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/mm/pkey-arm64.h b/tools/testing/selftests/mm/pkey-arm64.h
index 8e9685e03c44..c5a78a2f211d 100644
--- a/tools/testing/selftests/mm/pkey-arm64.h
+++ b/tools/testing/selftests/mm/pkey-arm64.h
@@ -130,9 +130,10 @@ static inline u64 get_pkey_bits(u64 reg, int pkey)
 static inline void aarch64_write_signal_pkey(ucontext_t *uctxt, u64 pkey)
 {
 	struct _aarch64_ctx *ctx = GET_UC_RESV_HEAD(uctxt);
+	size_t resv_size = GET_UCP_RESV_SIZE(uctxt);
 	struct poe_context *poe_ctx =
 		(struct poe_context *) get_header(ctx, POE_MAGIC,
-						sizeof(uctxt->uc_mcontext), NULL);
+						  resv_size, NULL);
 	if (poe_ctx)
 		poe_ctx->por_el0 = pkey;
 }

-- 
2.51.2



  parent reply	other threads:[~2026-04-27 12:04 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-27 12:03 [PATCH v2 0/5] POE sigreturn fix and extra tests Kevin Brodsky
2026-04-27 12:03 ` [PATCH v2 1/5] arm64: signal: Preserve POR_EL0 if poe_context is missing Kevin Brodsky
2026-04-27 12:03 ` Kevin Brodsky [this message]
2026-04-27 22:46   ` [PATCH v2 2/5] selftests/mm: Fix resv_sz when parsing arm64 signal frame Mark Brown
2026-04-27 12:03 ` [PATCH v2 3/5] kselftest/arm64: Add POE as a feature in the signal tests Kevin Brodsky
2026-04-27 12:03 ` [PATCH v2 4/5] kselftest/arm64: Move/add POE helpers to test_signals_utils.h Kevin Brodsky
2026-04-27 12:03 ` [PATCH v2 5/5] kselftest/arm64: Add tests for POR_EL0 save/reset/restore Kevin Brodsky
2026-05-01 16:48 ` (subset) [PATCH v2 0/5] POE sigreturn fix and extra tests Catalin Marinas

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260427-poe_signal-v2-2-2bd9d6f16ab4@arm.com \
    --to=kevin.brodsky@arm.com \
    --cc=akpm@linux-foundation.org \
    --cc=broonie@kernel.org \
    --cc=catalin.marinas@arm.com \
    --cc=david@kernel.org \
    --cc=joey.gouly@arm.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=shuah@kernel.org \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox