]> git.baikalelectronics.ru Git - kernel.git/commit
csky: don't let sigreturn play with priveleged bits of status register
authorAl Viro <viro@zeniv.linux.org.uk>
Fri, 24 Sep 2021 00:35:42 +0000 (00:35 +0000)
committerGuo Ren <guoren@linux.alibaba.com>
Fri, 15 Oct 2021 23:20:12 +0000 (07:20 +0800)
commit4ea2d734c0447eef770ab7a1d050e928c9ab09d4
tree9f452d718901cf5786f42de5f8401ba295a65970
parent9ca0986666178f71c70ba0652ce4f64d53ea42de
csky: don't let sigreturn play with priveleged bits of status register

csky restore_sigcontext() blindly overwrites regs->sr with the value
it finds in sigcontext.  Attacker can store whatever they want in there,
which includes things like S-bit.  Userland shouldn't be able to set
that, or anything other than C flag (bit 0).

Do the same thing other architectures with protected bits in flags
register do - preserve everything that shouldn't be settable in
user mode, picking the rest from the value saved is sigcontext.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Guo Ren <guoren@kernel.org>
Cc: stable@vger.kernel.org
arch/csky/kernel/signal.c