From nobody Thu Nov 6 16:04:55 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1489203831606681.0612082056623; Fri, 10 Mar 2017 19:43:51 -0800 (PST) Received: from localhost ([::1]:41787 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cmXwa-0001aO-Ar for importer@patchew.org; Fri, 10 Mar 2017 22:43:48 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60445) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cmXvg-0001Zh-U7 for qemu-devel@nongnu.org; Fri, 10 Mar 2017 22:42:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cmXvf-00048R-Aj for qemu-devel@nongnu.org; Fri, 10 Mar 2017 22:42:52 -0500 Received: from mail-qt0-x243.google.com ([2607:f8b0:400d:c0d::243]:35971) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cmXvf-000487-6G for qemu-devel@nongnu.org; Fri, 10 Mar 2017 22:42:51 -0500 Received: by mail-qt0-x243.google.com with SMTP id n37so543734qtb.3 for ; Fri, 10 Mar 2017 19:42:51 -0800 (PST) Received: from bigtime.twiddle.net.com ([101.165.234.197]) by smtp.gmail.com with ESMTPSA id l6sm7670101qkd.66.2017.03.10.19.42.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 Mar 2017 19:42:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=CLyCoPnLDDQnnuXy6xGR6c8LqTxrdmjGer6zMe+vgZ4=; b=VKv0sxMG9COfcHXzf4d7Ytl6OJ3IESNZrOPgX6LUGQ73BL62Y+KOxdgONfLBCQIGC3 pL7+oq2Wrrf88wHk9oRsjP33O5844kKwr1RmPYq68oAJpX1igFgDb2ighsJI2tsSW/Ml vCd/MsTHhjcEp4y1cthCVlYPJhVueRVa6E+RgzBLN2okPwG6/981ZX5mSxwLXvcAmrMn WvSSjSvdGNomH4tpUFn+Nhz2ZZOthw+PBvq/9oa8TfX3MjKIQLyCxflv5pqHxpAPCUE7 4uKyv3uIQDRohnlseaSa0IDPPm8uDkPgQckTr8qlbLdD+mOIV3aGf4tfRjJCmcWLp73s 0Q+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=CLyCoPnLDDQnnuXy6xGR6c8LqTxrdmjGer6zMe+vgZ4=; b=B0Okp7qYsxqsyrIHzJUkgqZVa8MK75e+Oo4eUhrIB5Pt5f1SZnO7gOd9yDnw4jC+ZD FyYZ8d4b/uscxhWbaOoF4VTJfatDC6IL2nVxoYs6KWVrexxyS5QZDA+usi5E62IMPQns JI+o4jbEu72Y5xbAYUYP9IXhUdZcExUaw9hu5VcITFGsSbBaQuDiXsnvf+Vqvkfcvq6y J3YX6k77OAv5mW8UtIJOJ+qV0n54d8Rzse6Qca+mUF0L+qe4qPgx3nnuc5ihutiXW2KV CPk+2+cdpS6UmNiItpgBKjPqiP3TIp/5aMEkTc0MraeLTrUiZY80EAn56zmOcouSK9wO ZYxA== X-Gm-Message-State: AMke39kK0i4fOkpnjAHeSzVGlnDuFZTMFQLf5P3iZwfYOEFfopgu1PouM1/FLm0rQkPa2w== X-Received: by 10.200.39.136 with SMTP id w8mr23699528qtw.284.1489203770612; Fri, 10 Mar 2017 19:42:50 -0800 (PST) From: Richard Henderson To: qemu-devel@nongnu.org Date: Sat, 11 Mar 2017 13:42:30 +1000 Message-Id: <20170311034232.14213-2-rth@twiddle.net> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170311034232.14213-1-rth@twiddle.net> References: <20170311034232.14213-1-rth@twiddle.net> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2607:f8b0:400d:c0d::243 Subject: [Qemu-devel] [PATCH 1/3] linux-user: Restrict usage of sa_restorer X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org, deller@gmx.de, riku.voipio@iki.fi Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Reading and writing to an sa_restorer member that isn't supposed to exist corrupts user memory. Introduce TARGET_ARCH_HAS_SA_RESTORER, similar to the kernel's __ARCH_HAS_SA_RESTORER. Reported-by: Helge Deller Signed-off-by: Richard Henderson --- linux-user/signal.c | 4 ++-- linux-user/syscall_defs.h | 13 +++++++++++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/linux-user/signal.c b/linux-user/signal.c index a67db04..c6b043b 100644 --- a/linux-user/signal.c +++ b/linux-user/signal.c @@ -777,7 +777,7 @@ int do_sigaction(int sig, const struct target_sigaction= *act, if (oact) { __put_user(k->_sa_handler, &oact->_sa_handler); __put_user(k->sa_flags, &oact->sa_flags); -#if !defined(TARGET_MIPS) +#ifdef TARGET_ARCH_HAS_SA_RESTORER __put_user(k->sa_restorer, &oact->sa_restorer); #endif /* Not swapped. */ @@ -787,7 +787,7 @@ int do_sigaction(int sig, const struct target_sigaction= *act, /* FIXME: This is not threadsafe. */ __get_user(k->_sa_handler, &act->_sa_handler); __get_user(k->sa_flags, &act->sa_flags); -#if !defined(TARGET_MIPS) +#ifdef TARGET_ARCH_HAS_SA_RESTORER __get_user(k->sa_restorer, &act->sa_restorer); #endif /* To be swapped in target_to_host_sigset. */ diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h index 40c5027..8b1ad74 100644 --- a/linux-user/syscall_defs.h +++ b/linux-user/syscall_defs.h @@ -445,6 +445,7 @@ int do_sigaction(int sig, const struct target_sigaction= *act, #define TARGET_SA_RESTART 2u #define TARGET_SA_NODEFER 0x20u #define TARGET_SA_RESETHAND 4u +#define TARGET_ARCH_HAS_SA_RESTORER 1 #elif defined(TARGET_MIPS) #define TARGET_SA_NOCLDSTOP 0x00000001 #define TARGET_SA_NOCLDWAIT 0x00010000 @@ -483,6 +484,10 @@ int do_sigaction(int sig, const struct target_sigactio= n *act, #define TARGET_SA_RESTORER 0x04000000 #endif =20 +#ifdef TARGET_SA_RESTORER +#define TARGET_ARCH_HAS_SA_RESTORER 1 +#endif + #if defined(TARGET_ALPHA) =20 #define TARGET_SIGHUP 1 @@ -718,19 +723,27 @@ struct target_sigaction { abi_ulong _sa_handler; #endif target_sigset_t sa_mask; +#ifdef TARGET_ARCH_HAS_SA_RESTORER + /* ??? This is always present, but ignored unless O32. */ + abi_ulong sa_restorer; +#endif }; #else struct target_old_sigaction { abi_ulong _sa_handler; abi_ulong sa_mask; abi_ulong sa_flags; +#ifdef TARGET_ARCH_HAS_SA_RESTORER abi_ulong sa_restorer; +#endif }; =20 struct target_sigaction { abi_ulong _sa_handler; abi_ulong sa_flags; +#ifdef TARGET_ARCH_HAS_SA_RESTORER abi_ulong sa_restorer; +#endif target_sigset_t sa_mask; }; #endif --=20 2.9.3