From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-by2nam03on0126.outbound.protection.outlook.com ([104.47.42.126]:24363 "EHLO NAM03-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S933421AbeDIAlZ (ORCPT ); Sun, 8 Apr 2018 20:41:25 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Dave Martin , Will Deacon , Sasha Levin Subject: [PATCH AUTOSEL for 3.18 057/101] arm64: ptrace: Avoid setting compat FP[SC]R to garbage if get_user fails Date: Mon, 9 Apr 2018 00:41:21 +0000 Message-ID: <20180409004042.164920-7-alexander.levin@microsoft.com> References: <20180409004042.164920-1-alexander.levin@microsoft.com> In-Reply-To: <20180409004042.164920-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Dave Martin [ Upstream commit 53b1a742ed251780267a57415bc955bd50f40c3d ] If get_user() fails when reading the new FPSCR value from userspace in compat_vfp_get(), then garbage* will be written to the task's FPSR and FPCR registers. This patch prevents this by checking the return from get_user() first. [*] Actually, zero, due to the behaviour of get_user() on error, but that's still not what userspace expects. Fixes: 478fcb2cdb23 ("arm64: Debugging support") Signed-off-by: Dave Martin Signed-off-by: Will Deacon Signed-off-by: Sasha Levin --- arch/arm64/kernel/ptrace.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 2e845f5c8ab2..a12eb17e7985 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -785,8 +785,10 @@ static int compat_vfp_set(struct task_struct *target, =20 if (count && !ret) { ret =3D get_user(fpscr, (compat_ulong_t *)ubuf); - uregs->fpsr =3D fpscr & VFP_FPSCR_STAT_MASK; - uregs->fpcr =3D fpscr & VFP_FPSCR_CTRL_MASK; + if (!ret) { + uregs->fpsr =3D fpscr & VFP_FPSCR_STAT_MASK; + uregs->fpcr =3D fpscr & VFP_FPSCR_CTRL_MASK; + } } =20 fpsimd_flush_task_state(target); --=20 2.15.1