On 32-bit kernels, the rseq->rseq_cs_padding field is never read by the kernel. However, 64-bit kernels dealing with 32-bit compat tasks read the full 64-bit in its entirety, and terminates the offending process with a segmentation fault if the upper 32 bits are set due to failure of copy_from_user().
Ensure that both 32-bit and 64-bit kernels dealing with 32-bit tasks end up terminating offending tasks with a segmentation fault if the upper 32-bit padding bits (rseq->rseq_cs_padding) are set by adding an explicit check that padding is zero on 32-bit kernels. Signed-off-by: Mathieu Desnoyers <[email protected]> CC: "Paul E. McKenney" <[email protected]> CC: Peter Zijlstra <[email protected]> CC: Paul Turner <[email protected]> CC: Thomas Gleixner <[email protected]> CC: Andy Lutomirski <[email protected]> CC: Andi Kleen <[email protected]> CC: Dave Watson <[email protected]> CC: Chris Lameter <[email protected]> CC: Ingo Molnar <[email protected]> CC: "H. Peter Anvin" <[email protected]> CC: Ben Maurer <[email protected]> CC: Steven Rostedt <[email protected]> CC: Josh Triplett <[email protected]> CC: Linus Torvalds <[email protected]> CC: Andrew Morton <[email protected]> CC: Russell King <[email protected]> CC: Catalin Marinas <[email protected]> CC: Will Deacon <[email protected]> CC: Michael Kerrisk <[email protected]> CC: Boqun Feng <[email protected]> CC: [email protected] --- kernel/rseq.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/kernel/rseq.c b/kernel/rseq.c index 4ba582046fcd..b038f35a60d6 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -112,6 +112,29 @@ static int rseq_reset_rseq_cpu_id(struct task_struct *t) return 0; } +#ifndef __LP64__ +/* + * Ensure that padding is zero. + */ +static int check_rseq_cs_padding(struct task_struct *t) +{ + unsigned long pad; + int ret; + + ret = __get_user(pad, &t->rseq->rseq_cs_padding); + if (ret) + return ret; + if (pad) + return -EFAULT; + return 0; +} +#else +static int check_rseq_cs_padding(struct task_struct *t) +{ + return 0; +} +#endif + static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) { struct rseq_cs __user *urseq_cs; @@ -123,6 +146,8 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) ret = __get_user(ptr, &t->rseq->rseq_cs); if (ret) return ret; + if (check_rseq_cs_padding(t)) + return -EFAULT; if (!ptr) { memset(rseq_cs, 0, sizeof(*rseq_cs)); return 0; -- 2.11.0
