Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752512AbdLKW5S (ORCPT ); Mon, 11 Dec 2017 17:57:18 -0500 Received: from 9pmail.ess.barracuda.com ([64.235.150.225]:35639 "EHLO 9pmail.ess.barracuda.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752275AbdLKW5N (ORCPT ); Mon, 11 Dec 2017 17:57:13 -0500 Date: Mon, 11 Dec 2017 22:56:54 +0000 From: "Maciej W. Rozycki" To: Ralf Baechle , James Hogan CC: Paul Burton , Alex Smith , Dave Martin , , , Subject: [PATCH v2 6/6] MIPS: Disallow outsized PTRACE_SETREGSET NT_PRFPREG regset accesses In-Reply-To: Message-ID: References: User-Agent: Alpine 2.00 (DEB 1167 2008-08-23) MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" X-BESS-ID: 1513033025-298552-12287-338299-1 X-BESS-VER: 2017.14-r1710272128 X-BESS-Apparent-Source-IP: 12.201.5.28 X-BESS-Outbound-Spam-Score: 0.00 X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.187879 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------- 0.00 BSF_BESS_OUTBOUND META: BESS Outbound X-BESS-Outbound-Spam-Status: SCORE=0.00 using account:ESS59374 scores of KILL_LEVEL=7.0 tests=BSF_BESS_OUTBOUND X-BESS-BRTS-Status: 1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1089 Lines: 33 Complement commit c23b3d1a5311 ("MIPS: ptrace: Change GP regset to use correct core dump register layout") and also reject outsized PTRACE_SETREGSET requests to the NT_PRFPREG regset, like with the NT_PRSTATUS regset. Cc: stable@vger.kernel.org # v3.17+ Fixes: c23b3d1a5311 ("MIPS: ptrace: Change GP regset to use correct core dump register layout") Signed-off-by: Maciej W. Rozycki --- Changes from v1: - regenerated. --- arch/mips/kernel/ptrace.c | 3 +++ 1 file changed, 3 insertions(+) linux-mips-nt-prfpreg-size.diff Index: linux-sfr-test/arch/mips/kernel/ptrace.c =================================================================== --- linux-sfr-test.orig/arch/mips/kernel/ptrace.c 2017-12-08 16:22:08.062741000 +0000 +++ linux-sfr-test/arch/mips/kernel/ptrace.c 2017-12-08 16:22:17.727811000 +0000 @@ -541,6 +541,9 @@ static int fpr_set(struct task_struct *t BUG_ON(count % sizeof(elf_fpreg_t)); + if (pos + count > sizeof(elf_fpregset_t)) + return -EIO; + init_fp_ctx(target); if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t))