mirror of
https://github.com/Fishwaldo/Star64_linux.git
synced 2025-07-23 23:32:14 +00:00
adcc81f148
Mapping the delay slot emulation page as both writeable & executable
presents a security risk, in that if an exploit can write to & jump into
the page then it can be used as an easy way to execute arbitrary code.
Prevent this by mapping the page read-only for userland, and using
access_process_vm() with the FOLL_FORCE flag to write to it from
mips_dsemul().
This will likely be less efficient due to copy_to_user_page() performing
cache maintenance on a whole page, rather than a single line as in the
previous use of flush_cache_sigtramp(). However this delay slot
emulation code ought not to be running in any performance critical paths
anyway so this isn't really a problem, and we can probably do better in
copy_to_user_page() anyway in future.
A major advantage of this approach is that the fix is small & simple to
backport to stable kernels.
Reported-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| syscalls | ||
| .gitignore | ||
| 8250-platform.c | ||
| asm-offsets.c | ||
| binfmt_elfn32.c | ||
| binfmt_elfo32.c | ||
| bmips_5xxx_init.S | ||
| bmips_vec.S | ||
| branch.c | ||
| cacheinfo.c | ||
| cevt-bcm1480.c | ||
| cevt-ds1287.c | ||
| cevt-gt641xx.c | ||
| cevt-r4k.c | ||
| cevt-sb1250.c | ||
| cevt-txx9.c | ||
| cmpxchg.c | ||
| cps-vec-ns16550.S | ||
| cps-vec.S | ||
| cpu-bugs64.c | ||
| cpu-probe.c | ||
| crash.c | ||
| crash_dump.c | ||
| csrc-bcm1480.c | ||
| csrc-ioasic.c | ||
| csrc-r4k.c | ||
| csrc-sb1250.c | ||
| early_printk.c | ||
| early_printk_8250.c | ||
| elf.c | ||
| entry.S | ||
| ftrace.c | ||
| genex.S | ||
| gpio_txx9.c | ||
| head.S | ||
| i8253.c | ||
| idle.c | ||
| irq-gt641xx.c | ||
| irq-msc01.c | ||
| irq-rm7000.c | ||
| irq.c | ||
| irq_txx9.c | ||
| jump_label.c | ||
| kgdb.c | ||
| kprobes.c | ||
| linux32.c | ||
| machine_kexec.c | ||
| Makefile | ||
| mcount.S | ||
| mips-cm.c | ||
| mips-cpc.c | ||
| mips-mt-fpaff.c | ||
| mips-mt.c | ||
| mips-r2-to-r6-emul.c | ||
| mips_machine.c | ||
| module.c | ||
| octeon_switch.S | ||
| perf_event.c | ||
| perf_event_mipsxx.c | ||
| pm-cps.c | ||
| pm.c | ||
| probes-common.h | ||
| proc.c | ||
| process.c | ||
| prom.c | ||
| ptrace.c | ||
| ptrace32.c | ||
| r4k_fpu.S | ||
| r4k_switch.S | ||
| r2300_fpu.S | ||
| r2300_switch.S | ||
| relocate.c | ||
| relocate_kernel.S | ||
| reset.c | ||
| rtlx-cmp.c | ||
| rtlx-mt.c | ||
| rtlx.c | ||
| scall32-o32.S | ||
| scall64-n32.S | ||
| scall64-n64.S | ||
| scall64-o32.S | ||
| segment.c | ||
| setup.c | ||
| signal-common.h | ||
| signal.c | ||
| signal32.c | ||
| signal_n32.c | ||
| signal_o32.c | ||
| smp-bmips.c | ||
| smp-cmp.c | ||
| smp-cps.c | ||
| smp-mt.c | ||
| smp-up.c | ||
| smp.c | ||
| spinlock_test.c | ||
| spram.c | ||
| stacktrace.c | ||
| sync-r4k.c | ||
| syscall.c | ||
| sysrq.c | ||
| time.c | ||
| topology.c | ||
| traps.c | ||
| unaligned.c | ||
| uprobes.c | ||
| vdso.c | ||
| vmlinux.lds.S | ||
| vpe-cmp.c | ||
| vpe-mt.c | ||
| vpe.c | ||
| watch.c | ||