On 32-bit kernels, the rseq->rseq_cs_padding field is never read by the kernel. However, 64-bit kernels dealing with 32-bit compat tasks read the full 64-bit in its entirety, and terminates the offending process with a segmentation fault if the upper 32 bits are set due to failure of copy_from_user().
Ensure that both 32-bit and 64-bit kernels dealing with 32-bit tasks end up terminating offending tasks with a segmentation fault if the upper 32-bit padding bits (rseq->rseq_cs_padding) are set by explicitly ensuring that padding is zero on 32-bit kernels. Signed-off-by: Mathieu Desnoyers <mathieu.desnoy...@efficios.com> CC: "Paul E. McKenney" <paul...@linux.vnet.ibm.com> CC: Peter Zijlstra <pet...@infradead.org> CC: Paul Turner <p...@google.com> CC: Thomas Gleixner <t...@linutronix.de> CC: Andy Lutomirski <l...@amacapital.net> CC: Andi Kleen <a...@firstfloor.org> CC: Dave Watson <davejwat...@fb.com> CC: Chris Lameter <c...@linux.com> CC: Ingo Molnar <mi...@redhat.com> CC: "H. Peter Anvin" <h...@zytor.com> CC: Ben Maurer <bmau...@fb.com> CC: Steven Rostedt <rost...@goodmis.org> CC: Josh Triplett <j...@joshtriplett.org> CC: Linus Torvalds <torva...@linux-foundation.org> CC: Andrew Morton <a...@linux-foundation.org> CC: Russell King <li...@arm.linux.org.uk> CC: Catalin Marinas <catalin.mari...@arm.com> CC: Will Deacon <will.dea...@arm.com> CC: Michael Kerrisk <mtk.manpa...@gmail.com> CC: Boqun Feng <boqun.f...@gmail.com> CC: linux-...@vger.kernel.org --- kernel/rseq.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/kernel/rseq.c b/kernel/rseq.c index 2e5d88f09baf..c4c48157198f 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -112,6 +112,29 @@ static int rseq_reset_rseq_cpu_id(struct task_struct *t) return 0; } +#ifndef __LP64__ +/* + * Ensure that padding is zero. + */ +static int check_rseq_cs_padding(struct task_struct *t) +{ + unsigned long pad; + int ret; + + ret = __get_user(pad, &t->rseq->rseq_cs_padding); + if (ret) + return ret; + if (pad) + return -EFAULT; + return 0; +} +#else +static int check_rseq_cs_padding(struct task_struct *t) +{ + return 0; +} +#endif + static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) { struct rseq_cs __user *urseq_cs; @@ -123,6 +146,9 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) ret = __get_user(ptr, &t->rseq->rseq_cs); if (ret) return ret; + ret = check_rseq_cs_padding(t); + if (ret) + return ret; if (!ptr) { memset(rseq_cs, 0, sizeof(*rseq_cs)); return 0; -- 2.11.0