From nobody Tue Apr 23 13:12:35 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1523892061186137.1904084571479; Mon, 16 Apr 2018 08:21:01 -0700 (PDT) Received: from localhost ([::1]:52571 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1f85w4-0005Xb-5h for importer@patchew.org; Mon, 16 Apr 2018 11:20:52 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58392) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1f85uw-0004rY-7l for qemu-devel@nongnu.org; Mon, 16 Apr 2018 11:19:48 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1f85uv-0008Cj-AF for qemu-devel@nongnu.org; Mon, 16 Apr 2018 11:19:42 -0400 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:40860) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1f85uo-00084b-1b; Mon, 16 Apr 2018 11:19:34 -0400 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.89) (envelope-from ) id 1f85ue-0002Kg-U0; Mon, 16 Apr 2018 16:19:24 +0100 From: Peter Maydell To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Date: Mon, 16 Apr 2018 16:19:23 +0100 Message-Id: <20180416151923.22588-1-peter.maydell@linaro.org> X-Mailer: git-send-email 2.17.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:8b0:1d0::2 Subject: [Qemu-devel] [prefix=PATCH for-2.12?] linux-user: check that all of AArch64 SVE extended sigframe is writable X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Richard Henderson , Riku Voipio , Laurent Vivier , patches@linaro.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" In commit 8c5931de0ac7738809 we added support for SVE extended sigframe records. These mean that the signal frame might now be larger than the size of the target_rt_sigframe record, so make sure we call lock_user on the entire frame size when we're creating it. (The code for restoring the signal frame already correctly handles the extended records by locking the 'extra' section separately to the main section.) In particular, this fixes a bug even for non-SVE signal frames, because it extends the locked section to cover the target_rt_frame_record. Previously this was part of 'struct target_rt_sigframe', but in commit e1eecd1d9d4c1ade3 we pulled it out into its own struct, and so locking the target_rt_sigframe alone doesn't cover it. This bug would mean that we would fail to correctly handle the case where a signal was taken with SP pointing 16 bytes into an unwritable page, with the page immediately below it in memory being writable. Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson --- The requirements to trigger the bug sound implausible, except that the stack page might be unwritable because we just executed some trampoline code from it, so perhaps not so unlikely as it first seems? Not sure whether to put into 2.12 or not... --- linux-user/signal.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/linux-user/signal.c b/linux-user/signal.c index e6dfe0adfd..b283270391 100644 --- a/linux-user/signal.c +++ b/linux-user/signal.c @@ -1858,7 +1858,8 @@ static void target_setup_frame(int usig, struct targe= t_sigaction *ka, =20 frame_addr =3D get_sigframe(ka, env, layout.total_size); trace_user_setup_frame(env, frame_addr); - if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0)) { + frame =3D lock_user(VERIFY_WRITE, frame_addr, layout.total_size, 0); + if (!frame) { goto give_sigsegv; } =20 @@ -1904,11 +1905,11 @@ static void target_setup_frame(int usig, struct tar= get_sigaction *ka, env->xregs[2] =3D frame_addr + offsetof(struct target_rt_sigframe,= uc); } =20 - unlock_user_struct(frame, frame_addr, 1); + unlock_user(frame, frame_addr, layout.total_size); return; =20 give_sigsegv: - unlock_user_struct(frame, frame_addr, 1); + unlock_user(frame, frame_addr, layout.total_size); force_sigsegv(usig); } =20 --=20 2.17.0