diff options
| author | Chris Metcalf <cmetcalf@tilera.com> | 2010-10-28 15:47:06 -0400 |
|---|---|---|
| committer | Chris Metcalf <cmetcalf@tilera.com> | 2010-11-01 15:31:17 -0400 |
| commit | 1deb9c5dfb179819ecdbf80a1d121e26c63caab3 (patch) | |
| tree | c6f6ec6030eb22f094a65c07e63312758d079794 /arch/tile/kernel/signal.c | |
| parent | 34a89d26bdc4ba46a406fa3842239e921c493d44 (diff) | |
| download | kernel_samsung_tuna-1deb9c5dfb179819ecdbf80a1d121e26c63caab3.zip kernel_samsung_tuna-1deb9c5dfb179819ecdbf80a1d121e26c63caab3.tar.gz kernel_samsung_tuna-1deb9c5dfb179819ecdbf80a1d121e26c63caab3.tar.bz2 | |
arch/tile: don't allow user code to set the PL via ptrace or signal return
The kernel was allowing any component of the pt_regs to be updated either
by signal handlers writing to the stack, or by processes writing via
PTRACE_POKEUSR or PTRACE_SETREGS, which meant they could set their PL
up from 0 to 1 and get access to kernel code and data (or, in practice,
cause a kernel panic). We now always reset the ex1 field, allowing the
user to set their ICS bit only.
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
Diffstat (limited to 'arch/tile/kernel/signal.c')
| -rw-r--r-- | arch/tile/kernel/signal.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/tile/kernel/signal.c b/arch/tile/kernel/signal.c index 704ce0b..687719d 100644 --- a/arch/tile/kernel/signal.c +++ b/arch/tile/kernel/signal.c @@ -71,6 +71,9 @@ int restore_sigcontext(struct pt_regs *regs, for (i = 0; i < sizeof(struct pt_regs)/sizeof(long); ++i) err |= __get_user(regs->regs[i], &sc->gregs[i]); + /* Ensure that the PL is always set to USER_PL. */ + regs->ex1 = PL_ICS_EX1(USER_PL, EX1_ICS(regs->ex1)); + regs->faultnum = INT_SWINT_1_SIGRETURN; err |= __get_user(*pr0, &sc->gregs[0]); |