linux-kernel - [PATCH] microblaze: restore r4 in sys_rt_sigreturn to fix corruption after signal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <7C4D11B3-1F5C-4061-8D4E-5AF64C09936E@rdtheil.de>
Date:	Mon, 7 Apr 2014 19:58:51 +0200
From:	Richard Theil <linux@...heil.de>
To:	Michal Simek <monstr@...str.eu>
Cc:	linux-kernel@...r.kernel.org,
	Wolfgang Steinebach <wolfgang.steinebach@...mens.com>,
	Endric Schubert <endric@...singlinkelectronics.com>,
	Uwe Gertheinrich <uwe.gertheinrich@...inx.com>
Subject: [PATCH] microblaze: restore r4 in sys_rt_sigreturn to fix corruption after signal

From: Richard Theil <linux@...heil.de>

As already identified in http://marc.info/?l=microblaze-uclinux&m=126203029729306 ,
the Microblaze signal handling code will corrupt r4 on a signal return. This was never
fixed upstream. ret_from_trap in entry.S expects both r3 and r4, but sys_rt_sigreturn
will only provide r3 by means of a 32-bit return value. The patch explicitly loads r4 instead
of returning a 64 bit compound to avoid surprises from the compiler. Applicable at least
from 3.6 on to today's git master.

Signed-off-by: Richard Theil <linux@...heil.de>
---
--- linux-3.13.5/arch/microblaze/kernel/signal.c.orig	2014-02-22 22:35:30.000000000 +0100
+++ linux-3.13.5/arch/microblaze/kernel/signal.c	2014-04-07 19:20:54.282023372 +0200
@@ -105,6 +105,10 @@ asmlinkage long sys_rt_sigreturn(struct
 	if (restore_altstack(&frame->uc.uc_stack))
 		goto badframe;
 
+	/* after signal, ret_from_trap needs r3 _and_ r4 from context */
+	__asm__ __volatile__("lwi r4,%0,%1"::
+		"r"(regs),"i"(offsetof(struct pt_regs,r4)));
+
 	return rval;
 
 badframe:

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/