[PATCH 3.19.y-ckt 36/56] parisc: Fix kernel crash with reversed copy_from_user()

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.19.y-ckt 36/56] parisc: Fix kernel crash with reversed copy_from_user()
Date	2016-04-12 23:20 +0200
Message-ID	<rndT7-5HZ-73@gated-at.bofh.it> (permalink)
References	<rndzI-5be-21@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.19.8-ckt19 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Helge Deller <deller@gmx.de>

commit ef72f3110d8b19f4c098a0bff7ed7d11945e70c6 upstream.

The kernel module testcase (lib/test_user_copy.c) exhibited a kernel
crash on parisc if the parameters for copy_from_user were reversed
("illegal reversed copy_to_user" testcase).

Fix this potential crash by checking the fault handler if the faulting
address is in the exception table.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/parisc/kernel/traps.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 7f67c4c..bbf2265 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -798,6 +798,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
 
 	    if (fault_space == 0 && !in_atomic())
 	    {
+		/* Clean up and return if in exception table. */
+		if (fixup_exception(regs))
+			return;
 		pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
 		parisc_terminate("Kernel Fault", regs, code, fault_address);
 	    }
-- 
2.7.4

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt19 stable review Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:00 +0200
  [PATCH 3.19.y-ckt 04/56] ALSA: hda - Fix white noise on Asus N750JV headphone Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:00 +0200
  [PATCH 3.19.y-ckt 01/56] [stable-only] Revert "spi: rockchip: modify DMA max burst to 1" Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:00 +0200
  [PATCH 3.19.y-ckt 10/56] pinctrl: sh-pfc: only use dummy states for non-DT platforms Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:00 +0200
  [PATCH 3.19.y-ckt 47/56] efi: Make our variable validation list include the guid Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 55/56] mwifiex: fix corner case association failure Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 53/56] perf/x86/intel: Fix PEBS data source interpretation on Nehalem/Westmere Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 42/56] Drivers: hv: vmbus: prevent cpu offlining on newer hypervisors Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 50/56] lib/ucs2_string: Correct ucs2 -> utf8 conversion Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 40/56] pinctrl: nomadik: fix pull debug print inversion Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 54/56] ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 27/56] ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 15/56] USB: digi_acceleport: do sanity checking for the number of ports Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 44/56] lib/ucs2_string: Add ucs2 -> utf8 helper functions Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 51/56] ipr: Fix out-of-bounds null overwrite Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 43/56] KVM: x86: move steal time initialization to vcpu entry time Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 30/56] drm/dp: move hw_mutex up the call stack Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 49/56] efi: Add pstore variables to the deletion whitelist Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 45/56] efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 41/56] ipv6: udp: fix UDP_MIB_IGNOREDMULTI updates Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 14/56] USB: cypress_m8: add endpoint sanity check Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 52/56] ipr: Fix regression when loading firmware Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 48/56] efi: Make efivarfs entries immutable by default Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 56/56] net: phy: at803x: Request 'reset' GPIO only for AT8030 PHY Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 46/56] efi: Do variable name validation tests in utf8 Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 38/56] ip6_tunnel: set rtnl_link_ops before calling register_netdevice Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 28/56] ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:10 +0200
  [PATCH 3.19.y-ckt 12/56] usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 16/56] ext4: add lockdep annotations for i_data_sem Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 25/56] parisc: Avoid function pointers for kernel exception routines Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 18/56] mm: fix invalid node in alloc_migrate_target() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 19/56] iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 35/56] gpio: pca953x: Use correct u16 value for register word write Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 23/56] USB: serial: cp210x: Adding GE Healthcare Device ID Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 22/56] USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 34/56] ext4: ignore quota mount options if the quota feature is enabled Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 13/56] USB: mct_u232: add sanity checking in probe Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 29/56] sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 20/56] xen/events: Mask a moving irq Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 17/56] ALSA: timer: Use mod_timer() for rearming the system timer Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 26/56] drm/radeon: add a dpm quirk for all R7 370 parts Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 37/56] parisc: Unbreak handling exceptions from kernel modules Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 32/56] ALSA: hda - fix front mic problem for a HP desktop Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 39/56] net: bcmgenet: fix skb_len in bcmgenet_xmit_single() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 09/56] powerpc/mm: Fixup preempt underflow with huge pages Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 33/56] KVM: x86: Inject pending interrupt even if pending nmi exist Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 21/56] rbd: use GFP_NOIO consistently for request allocations Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 24/56] USB: option: add "D-Link DWM-221 B1" device id Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 31/56] drm/udl: Use unlocked gem unreferencing Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 36/56] parisc: Fix kernel crash with reversed copy_from_user() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 11/56] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler() Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:20 +0200
  [PATCH 3.19.y-ckt 05/56] ALSA: hda - Apply fix for white noise on Asus N550JV, too Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 07/56] hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 02/56] PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 08/56] drm/radeon: add another R7 370 quirk Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 06/56] drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5 Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200
  [PATCH 3.19.y-ckt 03/56] ALSA: hda - Asus N750JV external subwoofer fixup Kamal Mostafa <kamal@canonical.com> - 2016-04-12 23:30 +0200

csiph-web