Commit 562d55ef authored by Paul Burton's avatar Paul Burton Committed by Greg Kroah-Hartman

MIPS: Prevent user from setting FCSR cause bits

commit b1442d39 upstream.

If one or more matching FCSR cause & enable bits are set in saved thread
context then when that context is restored the kernel will take an FP
exception. This is of course undesirable and considered an oops, leading
to the kernel writing a backtrace to the console and potentially
rebooting depending upon the configuration. Thus the kernel avoids this
situation by clearing the cause bits of the FCSR register when handling
FP exceptions and after emulating FP instructions.

However the kernel does not prevent userland from setting arbitrary FCSR
cause & enable bits via ptrace, using either the PTRACE_POKEUSR or
PTRACE_SETFPREGS requests. This means userland can trivially cause the
kernel to oops on any system with an FPU. Prevent this from happening
by clearing the cause bits when writing to the saved FCSR context via
ptrace.

This problem appears to exist at least back to the beginning of the git
era in the PTRACE_POKEUSR case.
Signed-off-by: default avatarPaul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/7438/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 488cba87
...@@ -151,6 +151,7 @@ int ptrace_setfpregs(struct task_struct *child, __u32 __user *data) ...@@ -151,6 +151,7 @@ int ptrace_setfpregs(struct task_struct *child, __u32 __user *data)
} }
__get_user(child->thread.fpu.fcr31, data + 64); __get_user(child->thread.fpu.fcr31, data + 64);
child->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
/* FIR may not be written. */ /* FIR may not be written. */
...@@ -696,7 +697,7 @@ long arch_ptrace(struct task_struct *child, long request, ...@@ -696,7 +697,7 @@ long arch_ptrace(struct task_struct *child, long request,
break; break;
#endif #endif
case FPC_CSR: case FPC_CSR:
child->thread.fpu.fcr31 = data; child->thread.fpu.fcr31 = data & ~FPU_CSR_ALL_X;
break; break;
case DSP_BASE ... DSP_BASE + 5: { case DSP_BASE ... DSP_BASE + 5: {
dspreg_t *dregs; dspreg_t *dregs;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment