From de553438eb6c487f72d46019eb3821f6687ce011 Mon Sep 17 00:00:00 2001 From: Heiko Carstens Date: Thu, 17 Apr 2008 07:45:57 +0200 Subject: [PATCH] [S390] Protect against sigaltstack wraparound. This is just a port of 83bd01024b1fdfc41d9b758e5669e80fca72df66 "x86: protect against sigaltstack wraparound". Signed-off-by: Martin Schwidefsky Signed-off-by: Heiko Carstens --- arch/s390/kernel/compat_signal.c | 10 ++++++++++ arch/s390/kernel/signal.c | 10 ++++++++++ 2 files changed, 20 insertions(+) diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c index a5692c460b..ae2f2d3139 100644 --- a/arch/s390/kernel/compat_signal.c +++ b/arch/s390/kernel/compat_signal.c @@ -428,6 +428,10 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs * regs, size_t frame_size) /* Default to using normal stack */ sp = (unsigned long) A(regs->gprs[15]); + /* Overflow on alternate signal stack gives SIGSEGV. */ + if (on_sig_stack(sp) && !on_sig_stack((sp - frame_size) & -8UL)) + return (void __user *) -1UL; + /* This is the X/Open sanctioned signal stack switching. */ if (ka->sa.sa_flags & SA_ONSTACK) { if (! sas_ss_flags(sp)) @@ -461,6 +465,9 @@ static int setup_frame32(int sig, struct k_sigaction *ka, if (!access_ok(VERIFY_WRITE, frame, sizeof(sigframe32))) goto give_sigsegv; + if (frame == (void __user *) -1UL) + goto give_sigsegv; + if (__copy_to_user(&frame->sc.oldmask, &set->sig, _SIGMASK_COPY_SIZE32)) goto give_sigsegv; @@ -514,6 +521,9 @@ static int setup_rt_frame32(int sig, struct k_sigaction *ka, siginfo_t *info, if (!access_ok(VERIFY_WRITE, frame, sizeof(rt_sigframe32))) goto give_sigsegv; + if (frame == (void __user *) -1UL) + goto give_sigsegv; + if (copy_siginfo_to_user32(&frame->info, info)) goto give_sigsegv; diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c index 4449bf32cb..8c92191949 100644 --- a/arch/s390/kernel/signal.c +++ b/arch/s390/kernel/signal.c @@ -235,6 +235,10 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs * regs, size_t frame_size) /* Default to using normal stack */ sp = regs->gprs[15]; + /* Overflow on alternate signal stack gives SIGSEGV. */ + if (on_sig_stack(sp) && !on_sig_stack((sp - frame_size) & -8UL)) + return (void __user *) -1UL; + /* This is the X/Open sanctioned signal stack switching. */ if (ka->sa.sa_flags & SA_ONSTACK) { if (! sas_ss_flags(sp)) @@ -270,6 +274,9 @@ static int setup_frame(int sig, struct k_sigaction *ka, if (!access_ok(VERIFY_WRITE, frame, sizeof(sigframe))) goto give_sigsegv; + if (frame == (void __user *) -1UL) + goto give_sigsegv; + if (__copy_to_user(&frame->sc.oldmask, &set->sig, _SIGMASK_COPY_SIZE)) goto give_sigsegv; @@ -327,6 +334,9 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, if (!access_ok(VERIFY_WRITE, frame, sizeof(rt_sigframe))) goto give_sigsegv; + if (frame == (void __user *) -1UL) + goto give_sigsegv; + if (copy_siginfo_to_user(&frame->info, info)) goto give_sigsegv; -- 2.39.5