[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 01/15] linux-user: Restrict usage of sa_restorer
From: |
riku . voipio |
Subject: |
[Qemu-devel] [PULL 01/15] linux-user: Restrict usage of sa_restorer |
Date: |
Mon, 20 Nov 2017 23:21:29 +0200 |
From: Richard Henderson <address@hidden>
Reading and writing to an sa_restorer member that isn't supposed to
exist corrupts user memory. Introduce TARGET_ARCH_HAS_SA_RESTORER,
similar to the kernel's __ARCH_HAS_SA_RESTORER.
Reported-by: Helge Deller <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Riku Voipio <address@hidden>
---
linux-user/signal.c | 4 ++--
linux-user/syscall_defs.h | 13 +++++++++++++
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/linux-user/signal.c b/linux-user/signal.c
index 7a238aaea1..cf35473671 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -777,7 +777,7 @@ int do_sigaction(int sig, const struct target_sigaction
*act,
if (oact) {
__put_user(k->_sa_handler, &oact->_sa_handler);
__put_user(k->sa_flags, &oact->sa_flags);
-#if !defined(TARGET_MIPS)
+#ifdef TARGET_ARCH_HAS_SA_RESTORER
__put_user(k->sa_restorer, &oact->sa_restorer);
#endif
/* Not swapped. */
@@ -787,7 +787,7 @@ int do_sigaction(int sig, const struct target_sigaction
*act,
/* FIXME: This is not threadsafe. */
__get_user(k->_sa_handler, &act->_sa_handler);
__get_user(k->sa_flags, &act->sa_flags);
-#if !defined(TARGET_MIPS)
+#ifdef TARGET_ARCH_HAS_SA_RESTORER
__get_user(k->sa_restorer, &act->sa_restorer);
#endif
/* To be swapped in target_to_host_sigset. */
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 450960bb54..e366183419 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -445,6 +445,7 @@ int do_sigaction(int sig, const struct target_sigaction
*act,
#define TARGET_SA_RESTART 2u
#define TARGET_SA_NODEFER 0x20u
#define TARGET_SA_RESETHAND 4u
+#define TARGET_ARCH_HAS_SA_RESTORER 1
#elif defined(TARGET_MIPS)
#define TARGET_SA_NOCLDSTOP 0x00000001
#define TARGET_SA_NOCLDWAIT 0x00010000
@@ -483,6 +484,10 @@ int do_sigaction(int sig, const struct target_sigaction
*act,
#define TARGET_SA_RESTORER 0x04000000
#endif
+#ifdef TARGET_SA_RESTORER
+#define TARGET_ARCH_HAS_SA_RESTORER 1
+#endif
+
#if defined(TARGET_ALPHA)
#define TARGET_SIGHUP 1
@@ -718,19 +723,27 @@ struct target_sigaction {
abi_ulong _sa_handler;
#endif
target_sigset_t sa_mask;
+#ifdef TARGET_ARCH_HAS_SA_RESTORER
+ /* ??? This is always present, but ignored unless O32. */
+ abi_ulong sa_restorer;
+#endif
};
#else
struct target_old_sigaction {
abi_ulong _sa_handler;
abi_ulong sa_mask;
abi_ulong sa_flags;
+#ifdef TARGET_ARCH_HAS_SA_RESTORER
abi_ulong sa_restorer;
+#endif
};
struct target_sigaction {
abi_ulong _sa_handler;
abi_ulong sa_flags;
+#ifdef TARGET_ARCH_HAS_SA_RESTORER
abi_ulong sa_restorer;
+#endif
target_sigset_t sa_mask;
};
#endif
--
2.14.2
- [Qemu-devel] [PULL 00/15] late linux-user fixes for 2.11, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 01/15] linux-user: Restrict usage of sa_restorer,
riku . voipio <=
- [Qemu-devel] [PULL 03/15] linux-user/hppa: Fix cpu_clone_regs, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 04/15] linux-user/hppa: Fix typo for TARGET_NR_epoll_wait, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 02/15] linux-user/hppa: Fix TARGET_SA_* defines, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 05/15] linux-user/hppa: Fix TARGET_MAP_TYPE, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 06/15] linux-user/hppa: Fix TARGET_F_RDLCK, TARGET_F_WRLCK, TARGET_F_UNLCK, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 08/15] linux-user/syscall.c: Handle SH4's exceptional alignment for p{read, write}64, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 11/15] linux-user/s390x: Mask si_addr for SIGSEGV, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 07/15] linux-user: Handle TARGET_MAP_STACK and TARGET_MAP_HUGETLB, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 09/15] linux-user: fix 'finshed' typo in comment, riku . voipio, 2017/11/20
- [Qemu-devel] [PULL 10/15] linux-user: return EINVAL from prctl(PR_*_SECCOMP), riku . voipio, 2017/11/20