linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
	Zwane Mwaikambo <zwane@arm.linux.org.uk>,
	"Theodore Ts'o" <tytso@mit.edu>,
	Randy Dunlap <rdunlap@xenotime.net>,
	Dave Jones <davej@redhat.com>,
	Chuck Wolber <chuckw@quantumlinux.com>,
	Chris Wedgwood <reviews@ml.cw.f00f.org>,
	Michael Krufky <mkrufky@linuxtv.org>,
	Chuck Ebbert <cebbert@redhat.com>,
	Domenico Andreoli <cavokz@gmail.com>,
	torvalds@linux-foundation.org, akpm@linux-foundation.org,
	alan@lxorguk.ukuu.org.uk, "David S. Miller" <davem@davemloft.net>
Subject: [patch 07/37] sparc: Fix SA_ONSTACK signal handling.
Date: Tue, 13 May 2008 13:11:47 -0700	[thread overview]
Message-ID: <20080513201147.GH31167@suse.de> (raw)
In-Reply-To: <20080513201053.GA31167@suse.de>

[-- Attachment #1: sparc-fix-sa_onstack-signal-handling.patch --]
[-- Type: text/plain, Size: 4734 bytes --]

2.6.25-stable review patch.  If anyone has any objections, please let us
know.

------------------
From: David S. Miller <davem@davemloft.net>

[ Upstream commit: dc5dc7e6d71ca9fd1ea01a1418150af3b2937489 ]

We need to be more liberal about the alignment of the buffer given to
us by sigaltstack().  The user should not need to be mindful of all of
the alignment constraints we have for the stack frame.

This mirrors how we handle this situation in clone() as well.

Also, we align the stack even in non-SA_ONSTACK cases so that signals
due to bad stack alignment can be delivered properly.  This makes such
errors easier to debug and recover from.

Finally, add the sanity check x86 has to make sure we won't overflow
the signal stack.

This fixes glibc testcases nptl/tst-cancel20.c and
nptl/tst-cancelx20.c

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/sparc/kernel/signal.c     |   20 +++++++++++++++++---
 arch/sparc64/kernel/signal.c   |   21 +++++++++++++++++----
 arch/sparc64/kernel/signal32.c |   18 +++++++++++++++++-
 3 files changed, 51 insertions(+), 8 deletions(-)

--- a/arch/sparc64/kernel/signal32.c
+++ b/arch/sparc64/kernel/signal32.c
@@ -497,11 +497,27 @@ static void __user *get_sigframe(struct 
 	regs->u_regs[UREG_FP] &= 0x00000000ffffffffUL;
 	sp = regs->u_regs[UREG_FP];
 	
+	/*
+	 * If we are on the alternate signal stack and would overflow it, don't.
+	 * Return an always-bogus address instead so we will die with SIGSEGV.
+	 */
+	if (on_sig_stack(sp) && !likely(on_sig_stack(sp - framesize)))
+		return (void __user *) -1L;
+
 	/* This is the X/Open sanctioned signal stack switching.  */
 	if (sa->sa_flags & SA_ONSTACK) {
-		if (!on_sig_stack(sp) && !((current->sas_ss_sp + current->sas_ss_size) & 7))
+		if (sas_ss_flags(sp) == 0)
 			sp = current->sas_ss_sp + current->sas_ss_size;
 	}
+
+	/* Always align the stack frame.  This handles two cases.  First,
+	 * sigaltstack need not be mindful of platform specific stack
+	 * alignment.  Second, if we took this signal because the stack
+	 * is not aligned properly, we'd like to take the signal cleanly
+	 * and report that.
+	 */
+	sp &= ~7UL;
+
 	return (void __user *)(sp - framesize);
 }
 
--- a/arch/sparc64/kernel/signal.c
+++ b/arch/sparc64/kernel/signal.c
@@ -377,16 +377,29 @@ save_fpu_state(struct pt_regs *regs, __s
 
 static inline void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, unsigned long framesize)
 {
-	unsigned long sp;
+	unsigned long sp = regs->u_regs[UREG_FP] + STACK_BIAS;
 
-	sp = regs->u_regs[UREG_FP] + STACK_BIAS;
+	/*
+	 * If we are on the alternate signal stack and would overflow it, don't.
+	 * Return an always-bogus address instead so we will die with SIGSEGV.
+	 */
+	if (on_sig_stack(sp) && !likely(on_sig_stack(sp - framesize)))
+		return (void __user *) -1L;
 
 	/* This is the X/Open sanctioned signal stack switching.  */
 	if (ka->sa.sa_flags & SA_ONSTACK) {
-		if (!on_sig_stack(sp) &&
-		    !((current->sas_ss_sp + current->sas_ss_size) & 7))
+		if (sas_ss_flags(sp) == 0)
 			sp = current->sas_ss_sp + current->sas_ss_size;
 	}
+
+	/* Always align the stack frame.  This handles two cases.  First,
+	 * sigaltstack need not be mindful of platform specific stack
+	 * alignment.  Second, if we took this signal because the stack
+	 * is not aligned properly, we'd like to take the signal cleanly
+	 * and report that.
+	 */
+	sp &= ~7UL;
+
 	return (void __user *)(sp - framesize);
 }
 
--- a/arch/sparc/kernel/signal.c
+++ b/arch/sparc/kernel/signal.c
@@ -345,15 +345,29 @@ static inline int invalid_frame_pointer(
 
 static inline void __user *get_sigframe(struct sigaction *sa, struct pt_regs *regs, unsigned long framesize)
 {
-	unsigned long sp;
+	unsigned long sp = regs->u_regs[UREG_FP];
 
-	sp = regs->u_regs[UREG_FP];
+	/*
+	 * If we are on the alternate signal stack and would overflow it, don't.
+	 * Return an always-bogus address instead so we will die with SIGSEGV.
+	 */
+	if (on_sig_stack(sp) && !likely(on_sig_stack(sp - framesize)))
+		return (void __user *) -1L;
 
 	/* This is the X/Open sanctioned signal stack switching.  */
 	if (sa->sa_flags & SA_ONSTACK) {
-		if (!on_sig_stack(sp) && !((current->sas_ss_sp + current->sas_ss_size) & 7))
+		if (sas_ss_flags(sp) == 0)
 			sp = current->sas_ss_sp + current->sas_ss_size;
 	}
+
+	/* Always align the stack frame.  This handles two cases.  First,
+	 * sigaltstack need not be mindful of platform specific stack
+	 * alignment.  Second, if we took this signal because the stack
+	 * is not aligned properly, we'd like to take the signal cleanly
+	 * and report that.
+	 */
+	sp &= ~7UL;
+
 	return (void __user *)(sp - framesize);
 }
 

-- 

  parent reply	other threads:[~2008-05-13 20:15 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20080513200453.064446337@mini.kroah.org>
2008-05-13 20:10 ` [patch 00/37] 2.6.25.4 -stable review Greg KH
2008-05-13 20:11   ` [patch 01/37] V4L/DVB (7473): PATCH for various Dibcom based devices Greg KH
2008-05-14  1:27     ` Michael Krufky
2008-05-14  2:03       ` Greg KH
2008-05-14  2:34         ` Michael Krufky
2008-05-14  2:59           ` Greg KH
2008-05-13 20:11   ` [patch 02/37] vt: fix canonical input in UTF-8 mode Greg KH
2008-05-13 20:11   ` [patch 03/37] serial: access after NULL check in uart_flush_buffer() Greg KH
2008-05-13 20:11   ` [patch 04/37] OHCI: fix regression upon awakening from hibernation Greg KH
2008-05-13 20:11   ` [patch 05/37] XFRM: AUDIT: Fix flowlabel text format ambibuity Greg KH
2008-05-13 20:11   ` [patch 06/37] sparc: sunzilog uart order Greg KH
2008-05-13 20:11   ` Greg KH [this message]
2008-05-13 20:11   ` [patch 08/37] sparc: Fix fork/clone/vfork system call restart Greg KH
2008-05-13 20:11   ` [patch 09/37] sparc64: Stop creating dummy root PCI host controller devices Greg KH
2008-05-13 20:11   ` [patch 10/37] sparc64: Fix wedged irq regression Greg KH
2008-05-13 20:11   ` [patch 11/37] SPARC64: Fix args to 64-bit sys_semctl() via sys_ipc() Greg KH
2008-05-13 20:11   ` [patch 12/37] serial: Fix sparc driver name strings Greg KH
2008-05-13 20:12   ` [patch 13/37] sch_htb: remove from event queue in htb_parent_to_leaf() Greg KH
2008-05-13 20:12   ` [patch 14/37] macvlan: Fix memleak on device removal/crash on module removal Greg KH
2008-05-13 20:12   ` [patch 15/37] ipvs: fix oops in backup for fwmark conn templates Greg KH
2008-05-13 20:12   ` [patch 16/37] dccp: return -EINVAL on invalid feature length Greg KH
2008-05-13 20:12   ` [patch 17/37] can: Fix can_send() handling on dev_queue_xmit() failures Greg KH
2008-05-13 20:12   ` [patch 18/37] x86: use defconfigs from x86/configs/* Greg KH
2008-05-13 20:12   ` [patch 19/37] nf_conntrack: padding breaks conntrack hash on ARM Greg KH
2008-05-13 20:12   ` [patch 20/37] {nfnetlink, ip, ip6}_queue: fix skb_over_panic when enlarging packets Greg KH
2008-05-13 23:45     ` Arnaud Ebalard
2008-05-13 22:06       ` Greg KH
2008-05-14 16:45         ` Gustavo Guillermo Perez
2008-05-14 17:08           ` Patrick McHardy
2008-05-13 20:12   ` [patch 21/37] ata_piix: verify SIDPR access before enabling it Greg KH
2008-05-13 20:12   ` [patch 22/37] x86: sysfs cpu?/topology is empty in 2.6.25 (32-bit Intel system) Greg KH
2008-05-15 18:06     ` Vaidyanathan Srinivasan
2008-05-15 20:07       ` Greg KH
2008-05-13 20:12   ` [patch 23/37] i2c-piix4: Blacklist two mainboards Greg KH
2008-05-14 19:52     ` Hardware designt to prevent Damages... [WAS: [patch 23/37] i2c-piix4: Blacklist two mainboards] Michelle Konzack
2008-05-15 17:57       ` linux-os (Dick Johnson)
2008-05-16  9:55         ` Michelle Konzack
2008-05-15 18:49       ` Jean Delvare
2008-05-16 15:22         ` Michelle Konzack
2008-05-13 20:12   ` [patch 24/37] sparc: Fix ptrace() detach Greg KH
2008-05-13 20:12   ` [patch 25/37] sparc: Fix mremap address range validation Greg KH
2008-05-13 20:28     ` Linus Torvalds
2008-05-13 20:37       ` Greg KH
2008-05-14  1:04         ` David Miller
2008-05-14  1:03       ` David Miller
2008-05-13 20:12   ` [patch 26/37] sparc: Fix debugger syscall restart interactions Greg KH
2008-05-13 20:12   ` [patch 27/37] sparc32: Dont twiddle PT_DTRACE in exec Greg KH
2008-05-13 20:12   ` [patch 28/37] USB: airprime: unlock mutex instead of trying to lock it again Greg KH
2008-05-13 20:12   ` [patch 29/37] r8169: fix past rtl_chip_info array size for unknown chipsets Greg KH
2008-05-13 20:12   ` [patch 30/37] r8169: fix oops in r8169_get_mac_version Greg KH
2008-05-13 20:12   ` [patch 31/37] SCSI: qla1280: Fix queue depth problem Greg KH
2008-05-13 20:12   ` [patch 32/37] SCSI: libiscsi regression in 2.6.25: fix nop timer handling Greg KH
2008-05-13 20:12   ` [patch 33/37] SCSI: libiscsi regression in 2.6.25: fix setting of recv timer Greg KH
2008-05-13 20:12   ` [patch 34/37] SCSI: aha152x: Fix oops on module removal Greg KH
2008-05-13 20:12   ` [patch 35/37] SCSI: aha152x: fix init suspiciously returned 1, it should follow 0/-E convention Greg KH
2008-05-13 20:12   ` [patch 36/37] rtc: rtc_time_to_tm: use unsigned arithmetic Greg KH
2008-05-13 20:12   ` [patch 37/37] md: fix raid5 repair operations Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20080513201147.GH31167@suse.de \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=cavokz@gmail.com \
    --cc=cebbert@redhat.com \
    --cc=chuckw@quantumlinux.com \
    --cc=davej@redhat.com \
    --cc=davem@davemloft.net \
    --cc=jmforbes@linuxtx.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mkrufky@linuxtv.org \
    --cc=rdunlap@xenotime.net \
    --cc=reviews@ml.cw.f00f.org \
    --cc=stable@kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=tytso@mit.edu \
    --cc=zwane@arm.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).