powerpc: Sanitize stack pointer in signal handling code

[deliverable/linux.git] / arch / powerpc / kernel / signal_32.c

diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index a6a43103655e8625865b021b5cf3d59e2cee0221..d670429a1608fe32a37a0b645df09aff7b904107 100644 (file)
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -836,7 +836,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
 
        /* Set up Signal Frame */
        /* Put a Real Time Context onto stack */
-       rt_sf = get_sigframe(ka, regs, sizeof(*rt_sf));
+       rt_sf = get_sigframe(ka, regs, sizeof(*rt_sf), 1);
        addr = rt_sf;
        if (unlikely(rt_sf == NULL))
                goto badframe;
@@ -941,9 +941,21 @@ long sys_swapcontext(struct ucontext __user *old_ctx,
 #ifdef CONFIG_PPC64
        unsigned long new_msr = 0;
 
-       if (new_ctx &&
-           get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR]))
-               return -EFAULT;
+       if (new_ctx) {
+               struct mcontext __user *mcp;
+               u32 cmcp;
+
+               /*
+                * Get pointer to the real mcontext.  No need for
+                * access_ok since we are dealing with compat
+                * pointers.
+                */
+               if (__get_user(cmcp, &new_ctx->uc_regs))
+                       return -EFAULT;
+               mcp = (struct mcontext __user *)(u64)cmcp;
+               if (__get_user(new_msr, &mcp->mc_gregs[PT_MSR]))
+                       return -EFAULT;
+       }
        /*
         * Check that the context is not smaller than the original
         * size (with VMX but without VSX)
@@ -1170,7 +1182,7 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
        unsigned long newsp = 0;
 
        /* Set up Signal Frame */
-       frame = get_sigframe(ka, regs, sizeof(*frame));
+       frame = get_sigframe(ka, regs, sizeof(*frame), 1);
        if (unlikely(frame == NULL))
                goto badframe;
        sc = (struct sigcontext __user *) &frame->sctx;