All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Martin Schwidefsky <schwidefsky@de.ibm.com>
Subject: [PATCH 3.15 12/37] s390/ptrace: fix PSW mask check
Date: Tue, 29 Jul 2014 18:48:48 -0700	[thread overview]
Message-ID: <20140730014828.258081449@linuxfoundation.org> (raw)
In-Reply-To: <20140730014827.565626091@linuxfoundation.org>

3.15-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

commit dab6cf55f81a6e16b8147aed9a843e1691dcd318 upstream.

The PSW mask check of the PTRACE_POKEUSR_AREA command is incorrect.
The PSW_MASK_USER define contains the PSW_MASK_ASC bits, the ptrace
interface accepts all combinations for the address-space-control
bits. To protect the kernel space the PSW mask check in ptrace needs
to reject the address-space-control bit combination for home space.

Fixes CVE-2014-3534

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/kernel/ptrace.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -334,9 +334,14 @@ static int __poke_user(struct task_struc
 			unsigned long mask = PSW_MASK_USER;
 
 			mask |= is_ri_task(child) ? PSW_MASK_RI : 0;
-			if ((data & ~mask) != PSW_USER_BITS)
+			if ((data ^ PSW_USER_BITS) & ~mask)
+				/* Invalid psw mask. */
+				return -EINVAL;
+			if ((data & PSW_MASK_ASC) == PSW_ASC_HOME)
+				/* Invalid address-space-control bits */
 				return -EINVAL;
 			if ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA))
+				/* Invalid addressing mode bits */
 				return -EINVAL;
 		}
 		*(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data;
@@ -672,9 +677,12 @@ static int __poke_user_compat(struct tas
 
 			mask |= is_ri_task(child) ? PSW32_MASK_RI : 0;
 			/* Build a 64 bit psw mask from 31 bit mask. */
-			if ((tmp & ~mask) != PSW32_USER_BITS)
+			if ((tmp ^ PSW32_USER_BITS) & ~mask)
 				/* Invalid psw mask. */
 				return -EINVAL;
+			if ((data & PSW32_MASK_ASC) == PSW32_ASC_HOME)
+				/* Invalid address-space-control bits */
+				return -EINVAL;
 			regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
 				(regs->psw.mask & PSW_MASK_BA) |
 				(__u64)(tmp & mask) << 32;



  parent reply	other threads:[~2014-07-30  1:59 UTC|newest]

Thread overview: 60+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-07-30  1:48 [PATCH 3.15 00/37] 3.15.8-stable review Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 01/37] media: staging: tighten omap4iss dependencies Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 02/37] media: media: v4l2-core: v4l2-dv-timings.c: Cleaning up code wrong value used in aspect ratio Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 03/37] media: af9035: override tuner id when bad value set into eeprom Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 04/37] media: hdpvr: fix two audio bugs Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 05/37] media: tda10071: force modulation to QPSK on DVB-S Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 06/37] nfs: only show Posix ACLs in listxattr if actually present Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 07/37] xtensa: fix sysmem reservation at the end of existing block Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 08/37] block: provide compat ioctl for BLKZEROOUT Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 09/37] block: dont assume last put of shared tags is for the host Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 10/37] libata: support the ata host which implements a queue depth less than 32 Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 11/37] libata: introduce ata_host->n_tags to avoid oops on SAS controllers Greg Kroah-Hartman
2014-07-30  1:48 ` Greg Kroah-Hartman [this message]
2014-07-30  1:48 ` [PATCH 3.15 13/37] ahci: add support for the Promise FastTrak TX8660 SATA HBA (ahci mode) Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 14/37] blkcg: dont call into policy draining if root_blkg is already gone Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 15/37] tracing: Fix wraparound problems in "uptime" trace clock Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 16/37] zram: avoid lockdep splat by revalidate_disk Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 17/37] powerpc/pseries: dynamically added OF nodes need to call of_node_init Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 18/37] slab_common: fix the check for duplicate slab names Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 19/37] Input: synaptics - add min/max quirk for pnp-id LEN2002 (Edge E531) Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 20/37] Input: fix defuzzing logic Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 21/37] coredump: fix the setting of PF_DUMPCORE Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 22/37] fuse: s_time_gran fix Greg Kroah-Hartman
2014-07-30  1:48 ` [PATCH 3.15 23/37] fuse: add FUSE_NO_OPEN_SUPPORT flag to INIT Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 24/37] pinctrl: st: Fix irqmux handler Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 25/37] parisc: Remove SA_RESTORER define Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 26/37] hwmon: (smsc47m192) Fix temperature limit and vrm write operations Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 27/37] parport: fix menu breakage Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 28/37] fs: umount on symlink leaks mnt count Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 29/37] x86_32, entry: Store badsys error code in %eax Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 32/37] mm: hugetlb: fix copy_hugetlb_page_range() Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 34/37] hwrng: virtio - ensure reads happen after successful probe Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 35/37] mm: do not call do_fault_around for non-linear fault Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 36/37] nl80211: move set_qos_map command into split state Greg Kroah-Hartman
2014-07-30  1:49 ` [PATCH 3.15 37/37] platform_get_irq: Revert to platform_get_resource if of_irq_get fails Greg Kroah-Hartman
     [not found] ` <20140730014829.344302554@linuxfoundation.org>
2014-07-30  6:53   ` [PATCH 3.15 33/37] Fix gcc-4.9.0 miscompilation of load_balance() in scheduler Jakub Jelinek
2014-07-30  7:13     ` Markus Trippelsdorf
2014-07-30  7:21       ` Jakub Jelinek
2014-07-30  7:27         ` Markus Trippelsdorf
2014-07-30 15:47     ` Linus Torvalds
2014-08-05 11:31       ` Josh Boyer
2014-08-05 11:46         ` Markus Trippelsdorf
2014-08-05 15:24           ` Jakub Jelinek
2014-08-05 15:19         ` Greg Kroah-Hartman
2014-08-05 16:49         ` Linus Torvalds
2014-08-05 20:57           ` Josh Boyer
2014-08-05 21:07             ` Frank Ch. Eigler
2014-08-05 22:36               ` Linus Torvalds
2014-08-05 23:30                 ` Frank Ch. Eigler
2014-08-05 23:59                   ` Linus Torvalds
2014-10-06 21:05                     ` [PATCH] Kbuild: Add an option to enable GCC VTA Josh Stone
2014-08-06  8:14                 ` [PATCH 3.15 33/37] Fix gcc-4.9.0 miscompilation of load_balance() in scheduler Jakub Jelinek
2014-08-06 10:23                   ` Måns Rullgård
2014-08-06 10:23                     ` Måns Rullgård
2014-08-06 16:34                   ` Alexei Starovoitov
2014-07-30 11:58 ` [PATCH 3.15 00/37] 3.15.8-stable review Satoru Takeuchi
2014-07-30 11:58   ` Satoru Takeuchi
2014-07-30 15:50   ` Greg Kroah-Hartman
2014-07-30 16:09 ` Guenter Roeck
2014-07-30 22:23   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20140730014828.258081449@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=schwidefsky@de.ibm.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.