Commit ea64d5ac authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

signal: Unify and correct copy_siginfo_to_user32 



Among the existing architecture specific versions of
copy_siginfo_to_user32 there are several different implementation
problems.  Some architectures fail to handle all of the cases in in
the siginfo union.  Some architectures perform a blind copy of the
siginfo union when the si_code is negative.  A blind copy suggests the
data is expected to be in 32bit siginfo format, which means that
receiving such a signal via signalfd won't work, or that the data is
in 64bit siginfo and the code is copying nonsense to userspace.

Create a single instance of copy_siginfo_to_user32 that all of the
architectures can share, and teach it to handle all of the cases in
the siginfo union correctly, with the assumption that siginfo is
stored internally to the kernel is 64bit siginfo format.

A special case is made for x86 x32 format.  This is needed as presence
of both x32 and ia32 on x86_64 results in two different 32bit signal
formats.  By allowing this small special case there winds up being
exactly one code base that needs to be maintained between all of the
architectures.  Vastly increasing the testing base and the chances of
finding bugs.

As the x86 copy of copy_siginfo_to_user32 the call of the x86
signal_compat_build_tests were moved into sigaction_compat_abi, so
that they will keep running.

Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
parent eb5346c3

arch/arm64/kernel/signal32.c

+0 −70
Original line number Diff line number Diff line
@@ -125,76 +125,6 @@ static inline int get_sigset_t(sigset_t *set, 
	return 0;

}



int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)

{

	int err;



	if (!access_ok(VERIFY_WRITE, to, sizeof(*to)))

		return -EFAULT;



	/* If you change siginfo_t structure, please be sure

	 * this code is fixed accordingly.

	 * It should never copy any pad contained in the structure

	 * to avoid security leaks, but must copy the generic

	 * 3 ints plus the relevant union member.

	 * This routine must convert siginfo from 64bit to 32bit as well

	 * at the same time.

	 */

	err = __put_user(from->si_signo, &to->si_signo);

	err |= __put_user(from->si_errno, &to->si_errno);

	err |= __put_user(from->si_code, &to->si_code);

	if (from->si_code < 0)

		err |= __copy_to_user(&to->_sifields._pad, &from->_sifields._pad,

				      SI_PAD_SIZE);

	else switch (siginfo_layout(from->si_signo, from->si_code)) {

	case SIL_KILL:

		err |= __put_user(from->si_pid, &to->si_pid);

		err |= __put_user(from->si_uid, &to->si_uid);

		break;

	case SIL_TIMER:

		 err |= __put_user(from->si_tid, &to->si_tid);

		 err |= __put_user(from->si_overrun, &to->si_overrun);

		 err |= __put_user(from->si_int, &to->si_int);

		break;

	case SIL_POLL:

		err |= __put_user(from->si_band, &to->si_band);

		err |= __put_user(from->si_fd, &to->si_fd);

		break;

	case SIL_FAULT:

		err |= __put_user((compat_uptr_t)(unsigned long)from->si_addr,

				  &to->si_addr);

#ifdef BUS_MCEERR_AO

		/*

		 * Other callers might not initialize the si_lsb field,

		 * so check explicitly for the right codes here.

		 */

		if (from->si_signo == SIGBUS &&

		    (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO))

			err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb);

#endif

		break;

	case SIL_CHLD:

		err |= __put_user(from->si_pid, &to->si_pid);

		err |= __put_user(from->si_uid, &to->si_uid);

		err |= __put_user(from->si_status, &to->si_status);

		err |= __put_user(from->si_utime, &to->si_utime);

		err |= __put_user(from->si_stime, &to->si_stime);

		break;

	case SIL_RT:

		err |= __put_user(from->si_pid, &to->si_pid);

		err |= __put_user(from->si_uid, &to->si_uid);

		err |= __put_user(from->si_int, &to->si_int);

		break;

	case SIL_SYS:

		err |= __put_user((compat_uptr_t)(unsigned long)

				from->si_call_addr, &to->si_call_addr);

		err |= __put_user(from->si_syscall, &to->si_syscall);

		err |= __put_user(from->si_arch, &to->si_arch);

		break;

	}

	return err;

}



/*

 * VFP save/restore code.

 *

arch/mips/include/asm/compat.h

+0 −2
Original line number Diff line number Diff line
@@ -126,8 +126,6 @@ typedef u32 compat_old_sigset_t; /* at least 32 bits */ 


typedef u32		compat_sigset_word;



#define SI_PAD_SIZE32	(128/sizeof(int) - 3)



#define COMPAT_OFF_T_MAX	0x7fffffff



/*

arch/mips/kernel/signal32.c

+0 −57
Original line number Diff line number Diff line
@@ -76,60 +76,3 @@ SYSCALL_DEFINE3(32_sigaction, long, sig, const struct compat_sigaction __user *, 


	return ret;

}
 


int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)

{

	int err;



	if (!access_ok (VERIFY_WRITE, to, sizeof(compat_siginfo_t)))

		return -EFAULT;



	/* If you change siginfo_t structure, please be sure

	   this code is fixed accordingly.

	   It should never copy any pad contained in the structure

	   to avoid security leaks, but must copy the generic

	   3 ints plus the relevant union member.

	   This routine must convert siginfo from 64bit to 32bit as well

	   at the same time.  */

	err = __put_user(from->si_signo, &to->si_signo);

	err |= __put_user(from->si_errno, &to->si_errno);

	err |= __put_user(from->si_code, &to->si_code);

	if (from->si_code < 0)

		err |= __copy_to_user(&to->_sifields._pad, &from->_sifields._pad, SI_PAD_SIZE);

	else {

		switch (siginfo_layout(from->si_signo, from->si_code)) {

		case SIL_TIMER:

			err |= __put_user(from->si_tid, &to->si_tid);

			err |= __put_user(from->si_overrun, &to->si_overrun);

			err |= __put_user(from->si_int, &to->si_int);

			break;

		case SIL_CHLD:

			err |= __put_user(from->si_utime, &to->si_utime);

			err |= __put_user(from->si_stime, &to->si_stime);

			err |= __put_user(from->si_status, &to->si_status);

		case SIL_KILL:

			err |= __put_user(from->si_pid, &to->si_pid);

			err |= __put_user(from->si_uid, &to->si_uid);

			break;

		case SIL_FAULT:

			err |= __put_user((unsigned long)from->si_addr, &to->si_addr);

			break;

		case SIL_POLL:

			err |= __put_user(from->si_band, &to->si_band);

			err |= __put_user(from->si_fd, &to->si_fd);

			break;

		case SIL_RT:

			err |= __put_user(from->si_pid, &to->si_pid);

			err |= __put_user(from->si_uid, &to->si_uid);

			err |= __put_user(from->si_int, &to->si_int);

			break;

		case SIL_SYS:

			err |= __copy_to_user(&to->si_call_addr, &from->si_call_addr,

					      sizeof(compat_uptr_t));

			err |= __put_user(from->si_syscall, &to->si_syscall);

			err |= __put_user(from->si_arch, &to->si_arch);

			break;

		}

	}

	return err;

}

arch/parisc/kernel/signal32.c

+0 −62
Original line number Diff line number Diff line
@@ -260,65 +260,3 @@ setup_sigcontext32(struct compat_sigcontext __user *sc, struct compat_regfile __ 


	return err;

}
 


int

copy_siginfo_to_user32 (compat_siginfo_t __user *to, const siginfo_t *from)

{

	compat_uptr_t addr;

	compat_int_t val;

	int err;



	if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t)))

		return -EFAULT;



	/* If you change siginfo_t structure, please be sure

	   this code is fixed accordingly.

	   It should never copy any pad contained in the structure

	   to avoid security leaks, but must copy the generic

	   3 ints plus the relevant union member.

	   This routine must convert siginfo from 64bit to 32bit as well

	   at the same time.  */

	err = __put_user(from->si_signo, &to->si_signo);

	err |= __put_user(from->si_errno, &to->si_errno);

	err |= __put_user(from->si_code, &to->si_code);

	if (from->si_code < 0)

		err |= __copy_to_user(&to->_sifields._pad, &from->_sifields._pad, SI_PAD_SIZE);

	else {

		switch (siginfo_layout(from->si_signo, from->si_code)) {

		case SIL_CHLD:

			err |= __put_user(from->si_utime, &to->si_utime);

			err |= __put_user(from->si_stime, &to->si_stime);

			err |= __put_user(from->si_status, &to->si_status);

		case SIL_KILL:

			err |= __put_user(from->si_pid, &to->si_pid);

			err |= __put_user(from->si_uid, &to->si_uid);

			break;

		case SIL_FAULT:

			addr = ptr_to_compat(from->si_addr);

			err |= __put_user(addr, &to->si_addr);

			break;

		case SIL_POLL:

			err |= __put_user(from->si_band, &to->si_band);

			err |= __put_user(from->si_fd, &to->si_fd);

			break;

		case SIL_TIMER:

			err |= __put_user(from->si_tid, &to->si_tid);

			err |= __put_user(from->si_overrun, &to->si_overrun);

			val = (compat_int_t)from->si_int;

			err |= __put_user(val, &to->si_int);

			break;

		case SIL_RT:

			err |= __put_user(from->si_uid, &to->si_uid);

			err |= __put_user(from->si_pid, &to->si_pid);

			val = (compat_int_t)from->si_int;

			err |= __put_user(val, &to->si_int);

			break;

		case SIL_SYS:

			err |= __put_user(ptr_to_compat(from->si_call_addr), &to->si_call_addr);

			err |= __put_user(from->si_syscall, &to->si_syscall);

			err |= __put_user(from->si_arch, &to->si_arch);

			break;

		}

	}

	return err;

}

arch/parisc/kernel/signal32.h

+0 −2
Original line number Diff line number Diff line
@@ -34,8 +34,6 @@ struct compat_ucontext { 


/* ELF32 signal handling */



int copy_siginfo_to_user32 (compat_siginfo_t __user *to, const siginfo_t *from);



/* In a deft move of uber-hackery, we decide to carry the top half of all

 * 64-bit registers in a non-portable, non-ABI, hidden structure.

 * Userspace can read the hidden structure if it *wants* but is never

CRA Git | Maintained and supported by SUSTech CRA and CCSE