| From acff96ceed86abd7d62e6293b48f9612a2e5fedf Mon Sep 17 00:00:00 2001 |
| From: Mathias Krause <minipli@googlemail.com> |
| Date: Mon, 10 Apr 2017 17:14:27 +0200 |
| Subject: [PATCH] x86/vdso: Ensure vdso32_enabled gets set to valid values only |
| |
| commit c06989da39cdb10604d572c8c7ea8c8c97f3c483 upstream. |
| |
| vdso_enabled can be set to arbitrary integer values via the kernel command |
| line 'vdso32=' parameter or via 'sysctl abi.vsyscall32'. |
| |
| load_vdso32() only maps VDSO if vdso_enabled == 1, but ARCH_DLINFO_IA32 |
| merily checks for vdso_enabled != 0. As a consequence the AT_SYSINFO_EHDR |
| auxiliary vector for the VDSO_ENTRY is emitted with a NULL pointer which |
| causes a segfault when the application tries to use the VDSO. |
| |
| Restrict the valid arguments on the command line and the sysctl to 0 and 1. |
| |
| Fixes: b0b49f2673f0 ("x86, vdso: Remove compat vdso support") |
| Signed-off-by: Mathias Krause <minipli@googlemail.com> |
| Acked-by: Andy Lutomirski <luto@amacapital.net> |
| Cc: Peter Zijlstra <peterz@infradead.org> |
| Cc: stable@vger.kernel.org |
| Cc: Roland McGrath <roland@redhat.com> |
| Link: http://lkml.kernel.org/r/1491424561-7187-1-git-send-email-minipli@googlemail.com |
| Link: http://lkml.kernel.org/r/20170410151723.518412863@linutronix.de |
| Signed-off-by: Thomas Gleixner <tglx@linutronix.de> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c |
| index 7853b53959cd..3f9d1a83891a 100644 |
| --- a/arch/x86/entry/vdso/vdso32-setup.c |
| +++ b/arch/x86/entry/vdso/vdso32-setup.c |
| @@ -30,8 +30,10 @@ static int __init vdso32_setup(char *s) |
| { |
| vdso32_enabled = simple_strtoul(s, NULL, 0); |
| |
| - if (vdso32_enabled > 1) |
| + if (vdso32_enabled > 1) { |
| pr_warn("vdso32 values other than 0 and 1 are no longer allowed; vdso disabled\n"); |
| + vdso32_enabled = 0; |
| + } |
| |
| return 1; |
| } |
| @@ -62,13 +64,18 @@ subsys_initcall(sysenter_setup); |
| /* Register vsyscall32 into the ABI table */ |
| #include <linux/sysctl.h> |
| |
| +static const int zero; |
| +static const int one = 1; |
| + |
| static struct ctl_table abi_table2[] = { |
| { |
| .procname = "vsyscall32", |
| .data = &vdso32_enabled, |
| .maxlen = sizeof(int), |
| .mode = 0644, |
| - .proc_handler = proc_dointvec |
| + .proc_handler = proc_dointvec_minmax, |
| + .extra1 = (int *)&zero, |
| + .extra2 = (int *)&one, |
| }, |
| {} |
| }; |
| -- |
| 2.12.0 |
| |