• Vineet Gupta's avatar
    ARC: signal handling robustify · 4a5abf78
    Vineet Gupta authored
    commit e4140819 upstream.
    
    A malicious signal handler / restorer can DOS the system by fudging the
    user regs saved on stack, causing weird things such as sigreturn returning
    to user mode PC but cpu state still being kernel mode....
    
    Ensure that in sigreturn path status32 always has U bit; any other bogosity
    (gargbage PC etc) will be taken care of by normal user mode exceptions mechanisms.
    
    Reproducer signal handler:
    
        void handle_sig(int signo, siginfo_t *info, void *context)
        {
    	ucontext_t *uc = context;
    	struct user_regs_struct *regs = &(uc->uc_mcontext.regs);
    
    	regs->scratch.status32 = 0;
        }
    
    Before the fix, kernel would go off to weeds like below:
    
        --------->8-----------
        [ARCLinux]$ ./signal-test
        Path: /signal-test
        CPU: 0 PID: 61 Comm: signal-test Not tainted 4.0.0-rc5+ #65
        task: 8f177880 ti: 5ffe6000 task.ti: 8f15c000
    
        [ECR   ]: 0x00220200 => Invalid Write @ 0x00000010 by insn @ 0x00010698
        [EFA   ]: 0x00000010
        [BLINK ]: 0x2007c1ee
        [ERET  ]: 0x10698
        [STAT32]: 0x00000000 :                                   <--------
        BTA: 0x00010680	 SP: 0x5ffe7e48	 FP: 0x00000000
        LPS: 0x20003c6c	LPE: 0x20003c70	LPC: 0x00000000
        ...
        --------->8-----------
    Reported-by: default avatarAlexey Brodkin <abrodkin@synopsys.com>
    Signed-off-by: default avatarVineet Gupta <vgupta@synopsys.com>
    [ luis: backported to 3.16: used Vineet's backport to 3.14 ]
    Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
    4a5abf78
signal.c 10.1 KB