• Michael Neuling's avatar
    powerpc/tm: Fix oops on sigreturn on systems without TM · f16d80b7
    Michael Neuling authored
    On systems like P9 powernv where we have no TM (or P8 booted with
    ppc_tm=off), userspace can construct a signal context which still has
    the MSR TS bits set. The kernel tries to restore this context which
    results in the following crash:
    
      Unexpected TM Bad Thing exception at c0000000000022fc (msr 0x8000000102a03031) tm_scratch=800000020280f033
      Oops: Unrecoverable exception, sig: 6 [#1]
      LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
      Modules linked in:
      CPU: 0 PID: 1636 Comm: sigfuz Not tainted 5.2.0-11043-g0a8ad0ff #69
      NIP:  c0000000000022fc LR: 00007fffb2d67e48 CTR: 0000000000000000
      REGS: c00000003fffbd70 TRAP: 0700   Not tainted  (5.2.0-11045-g7142b497d8)
      MSR:  8000000102a03031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[E]>  CR: 42004242  XER: 00000000
      CFAR: c0000000000022e0 IRQMASK: 0
      GPR00: 0000000000000072 00007fffb2b6e560 00007fffb2d87f00 0000000000000669
      GPR04: 00007fffb2b6e728 0000000000000000 0000000000000000 00007fffb2b6f2a8
      GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
      GPR12: 0000000000000000 00007fffb2b76900 0000000000000000 0000000000000000
      GPR16: 00007fffb2370000 00007fffb2d84390 00007fffea3a15ac 000001000a250420
      GPR20: 00007fffb2b6f260 0000000010001770 0000000000000000 0000000000000000
      GPR24: 00007fffb2d843a0 00007fffea3a14a0 0000000000010000 0000000000800000
      GPR28: 00007fffea3a14d8 00000000003d0f00 0000000000000000 00007fffb2b6e728
      NIP [c0000000000022fc] rfi_flush_fallback+0x7c/0x80
      LR [00007fffb2d67e48] 0x7fffb2d67e48
      Call Trace:
      Instruction dump:
      e96a0220 e96a02a8 e96a0330 e96a03b8 394a0400 4200ffdc 7d2903a6 e92d0c00
      e94d0c08 e96d0c10 e82d0c18 7db242a6 <4c000024> 7db243a6 7db142a6 f82d0c18
    
    The problem is the signal code assumes TM is enabled when
    CONFIG_PPC_TRANSACTIONAL_MEM is enabled. This may not be the case as
    with P9 powernv or if `ppc_tm=off` is used on P8.
    
    This means any local user can crash the system.
    
    Fix the problem by returning a bad stack frame to the user if they try
    to set the MSR TS bits with sigreturn() on systems where TM is not
    supported.
    
    Found with sigfuz kernel selftest on P9.
    
    This fixes CVE-2019-13648.
    
    Fixes: 2b0a576d ("powerpc: Add new transactional memory state to the signal context")
    Cc: stable@vger.kernel.org # v3.9
    Reported-by: default avatarPraveen Pandey <Praveen.Pandey@in.ibm.com>
    Signed-off-by: default avatarMichael Neuling <mikey@neuling.org>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    Link: https://lore.kernel.org/r/20190719050502.405-1-mikey@neuling.org
    f16d80b7
signal_32.c 41.6 KB