Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 3c1532df5c1b54b5f6246cdef94eeb73a39fe43a

Authored by AKASHI Takahiro
Committed by Russell King
1 parent bc41b8724f
Exists in smarc-imx_3.14.28_1.0.0_ga and in 1 other branch imx_3.14.28_1.0.0_ga

ARM: 7851/1: check for number of arguments in syscall_get/set_arguments() 

In ftrace_syscall_enter(),
    syscall_get_arguments(..., 0, n, ...)
        if (i == 0) { <handle ORIG_r0> ...; n--;}
        memcpy(..., n * sizeof(args[0]));
If 'number of arguments(n)' is zero and 'argument index(i)' is also zero in
syscall_get_arguments(), none of arguments should be copied by memcpy().
Otherwise 'n--' can be a big positive number and unexpected amount of data
will be copied. Tracing system calls which take no argument, say sync(void),
may hit this case and eventually make the system corrupted.
This patch fixes the issue both in syscall_get_arguments() and
syscall_set_arguments().

Cc: <stable@vger.kernel.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Showing 1 changed file with 6 additions and 0 deletions Side-by-side Diff

arch/arm/include/asm/syscall.h
Diff comments   View file @ 3c1532d
... ... @@ -57,6 +57,9 @@
57 57 unsigned int i, unsigned int n,
58 58 unsigned long *args)
59 59 {
  60 + if (n == 0)
  61 + return;
  62 +
60 63 if (i + n > SYSCALL_MAX_ARGS) {
61 64 unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
62 65 unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
... ... @@ -81,6 +84,9 @@
81 84 unsigned int i, unsigned int n,
82 85 const unsigned long *args)
83 86 {
  87 + if (n == 0)
  88 + return;
  89 +
84 90 if (i + n > SYSCALL_MAX_ARGS) {
85 91 pr_warning("%s called with max args %d, handling only %d\n",
86 92 __func__, i + n, SYSCALL_MAX_ARGS);