Merge branch 'security-fixes' into fixes
This commit is contained in:
commit
e35ac62d22
|
@ -130,8 +130,10 @@ struct mm_struct;
|
|||
extern unsigned long arch_randomize_brk(struct mm_struct *mm);
|
||||
#define arch_randomize_brk arch_randomize_brk
|
||||
|
||||
#ifdef CONFIG_MMU
|
||||
#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
|
||||
struct linux_binprm;
|
||||
int arch_setup_additional_pages(struct linux_binprm *, int);
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
|
|
@ -474,17 +474,18 @@ const char *arch_vma_name(struct vm_area_struct *vma)
|
|||
"[sigpage]" : NULL;
|
||||
}
|
||||
|
||||
static struct page *signal_page;
|
||||
extern struct page *get_signal_page(void);
|
||||
|
||||
int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
|
||||
{
|
||||
struct mm_struct *mm = current->mm;
|
||||
struct page *page;
|
||||
unsigned long addr;
|
||||
int ret;
|
||||
|
||||
page = get_signal_page();
|
||||
if (!page)
|
||||
if (!signal_page)
|
||||
signal_page = get_signal_page();
|
||||
if (!signal_page)
|
||||
return -ENOMEM;
|
||||
|
||||
down_write(&mm->mmap_sem);
|
||||
|
@ -496,7 +497,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
|
|||
|
||||
ret = install_special_mapping(mm, addr, PAGE_SIZE,
|
||||
VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
|
||||
&page);
|
||||
&signal_page);
|
||||
|
||||
if (ret == 0)
|
||||
mm->context.sigpage = addr;
|
||||
|
|
|
@ -402,7 +402,8 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
|
|||
__put_user(sigreturn_codes[idx+1], rc+1))
|
||||
return 1;
|
||||
|
||||
if ((cpsr & MODE32_BIT) && !IS_ENABLED(CONFIG_ARM_MPU)) {
|
||||
#ifdef CONFIG_MMU
|
||||
if (cpsr & MODE32_BIT) {
|
||||
struct mm_struct *mm = current->mm;
|
||||
|
||||
/*
|
||||
|
@ -412,7 +413,9 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
|
|||
*/
|
||||
retcode = mm->context.sigpage + signal_return_offset +
|
||||
(idx << 2) + thumb;
|
||||
} else {
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
/*
|
||||
* Ensure that the instruction cache sees
|
||||
* the return code written onto the stack.
|
||||
|
@ -614,35 +617,32 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
|
|||
return 0;
|
||||
}
|
||||
|
||||
static struct page *signal_page;
|
||||
|
||||
struct page *get_signal_page(void)
|
||||
{
|
||||
if (!signal_page) {
|
||||
unsigned long ptr;
|
||||
unsigned offset;
|
||||
void *addr;
|
||||
unsigned long ptr;
|
||||
unsigned offset;
|
||||
struct page *page;
|
||||
void *addr;
|
||||
|
||||
signal_page = alloc_pages(GFP_KERNEL, 0);
|
||||
page = alloc_pages(GFP_KERNEL, 0);
|
||||
|
||||
if (!signal_page)
|
||||
return NULL;
|
||||
if (!page)
|
||||
return NULL;
|
||||
|
||||
addr = page_address(signal_page);
|
||||
addr = page_address(page);
|
||||
|
||||
/* Give the signal return code some randomness */
|
||||
offset = 0x200 + (get_random_int() & 0x7fc);
|
||||
signal_return_offset = offset;
|
||||
/* Give the signal return code some randomness */
|
||||
offset = 0x200 + (get_random_int() & 0x7fc);
|
||||
signal_return_offset = offset;
|
||||
|
||||
/*
|
||||
* Copy signal return handlers into the vector page, and
|
||||
* set sigreturn to be a pointer to these.
|
||||
*/
|
||||
memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
|
||||
/*
|
||||
* Copy signal return handlers into the vector page, and
|
||||
* set sigreturn to be a pointer to these.
|
||||
*/
|
||||
memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
|
||||
|
||||
ptr = (unsigned long)addr + offset;
|
||||
flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
|
||||
}
|
||||
ptr = (unsigned long)addr + offset;
|
||||
flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
|
||||
|
||||
return signal_page;
|
||||
return page;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue