Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7798bf21 authored by Al Viro's avatar Al Viro
Browse files

arc: don't leak bits of kernel stack into coredump 



On faulting sigreturn we do get SIGSEGV, all right, but anything
we'd put into pt_regs could end up in the coredump.  And since
__copy_from_user() never zeroed on arc, we'd better bugger off
on its failure without copying random uninitialized bits of
kernel stack into pt_regs...

Cc: stable@vger.kernel.org
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 085354f9

arch/arc/kernel/signal.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -107,13 +107,13 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf) 
	struct user_regs_struct uregs;

	struct user_regs_struct uregs;





	err = __copy_from_user(&set, &sf->uc.uc_sigmask, sizeof(set));

	err = __copy_from_user(&set, &sf->uc.uc_sigmask, sizeof(set));

	if (!err)

		set_current_blocked(&set);



	err |= __copy_from_user(&uregs.scratch,

	err |= __copy_from_user(&uregs.scratch,

				&(sf->uc.uc_mcontext.regs.scratch),

				&(sf->uc.uc_mcontext.regs.scratch),

				sizeof(sf->uc.uc_mcontext.regs.scratch));

				sizeof(sf->uc.uc_mcontext.regs.scratch));

	if (err)

		return err;





	set_current_blocked(&set);

	regs->bta	= uregs.scratch.bta;

	regs->bta	= uregs.scratch.bta;

	regs->lp_start	= uregs.scratch.lp_start;

	regs->lp_start	= uregs.scratch.lp_start;

	regs->lp_end	= uregs.scratch.lp_end;

	regs->lp_end	= uregs.scratch.lp_end;
@@ -138,7 +138,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf) 
	regs->r0	= uregs.scratch.r0;

	regs->r0	= uregs.scratch.r0;

	regs->sp	= uregs.scratch.sp;

	regs->sp	= uregs.scratch.sp;





	return err;

	return 0;

}

}





static inline int is_do_ss_needed(unsigned int magic)

static inline int is_do_ss_needed(unsigned int magic)