Commit 77eb50aefa5dd2337246dce8b66e18e837c1a8bc
Committed by
Paul Mackerras
1 parent
ec5d7657f7
Exists in
master
and in
7 other branches
powerpc: Fix msr check in compat_sys_swapcontext
The new context may not be 16-byte aligned, so the real address of the mcontext structure should be read from the uc_regs pointer instead of directly using the (unaligned) uc_mcontext field. Signed-off-by: Andreas Schwab <schwab@suse.de> Signed-off-by: Paul Mackerras <paulus@samba.org>
Showing 1 changed file with 15 additions and 3 deletions Side-by-side Diff
arch/powerpc/kernel/signal_32.c
... | ... | @@ -941,9 +941,21 @@ |
941 | 941 | #ifdef CONFIG_PPC64 |
942 | 942 | unsigned long new_msr = 0; |
943 | 943 | |
944 | - if (new_ctx && | |
945 | - get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR])) | |
946 | - return -EFAULT; | |
944 | + if (new_ctx) { | |
945 | + struct mcontext __user *mcp; | |
946 | + u32 cmcp; | |
947 | + | |
948 | + /* | |
949 | + * Get pointer to the real mcontext. No need for | |
950 | + * access_ok since we are dealing with compat | |
951 | + * pointers. | |
952 | + */ | |
953 | + if (__get_user(cmcp, &new_ctx->uc_regs)) | |
954 | + return -EFAULT; | |
955 | + mcp = (struct mcontext __user *)(u64)cmcp; | |
956 | + if (__get_user(new_msr, &mcp->mc_gregs[PT_MSR])) | |
957 | + return -EFAULT; | |
958 | + } | |
947 | 959 | /* |
948 | 960 | * Check that the context is not smaller than the original |
949 | 961 | * size (with VMX but without VSX) |