From 8420f71943ae96dcd78da5bd4a5c2827419d340c Mon Sep 17 00:00:00 2001 From: "Eric W. Biederman" Date: Mon, 2 Apr 2018 14:45:42 -0500 Subject: [PATCH 1/2] signal: Correct the offset of si_pkey and si_lower in struct siginfo on m68k The change moving addr_lsb into the _sigfault union failed to take into account that _sigfault._addr_bnd._lower being a pointer forced the entire union to have pointer alignment. The fix for _sigfault._addr_bnd._lower having pointer alignment failed to take into account that m68k has a pointer alignment less than the size of a pointer. So simply making the padding members pointers changed the location of later members in the structure. Fix this by directly computing the needed size of the padding members, and making the padding members char arrays of the needed size. AKA if __alignof__(void *) is 1 sizeof(short) otherwise __alignof__(void *). Which should be exactly the same rules the compiler whould have used when computing the padding. I have tested this change by adding BUILD_BUG_ONs to m68k to verify the offset of every member of struct siginfo, and with those testing that the offsets of the fields in struct siginfo is the same before I changed the generic _sigfault member and after the correction to the _sigfault member. I have also verified that the x86 with it's own BUILD_BUG_ONs to verify the offsets of the siginfo members also compiles cleanly. Cc: stable@vger.kernel.org Reported-by: Eugene Syromiatnikov Fixes: 859d880cf544 ("signal: Correct the offset of si_pkey in struct siginfo") Fixes: b68a68d3dcc1 ("signal: Move addr_lsb into the _sigfault union for clarity") Signed-off-by: "Eric W. Biederman" --- include/linux/compat.h | 6 ++++-- include/uapi/asm-generic/siginfo.h | 7 +++++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/include/linux/compat.h b/include/linux/compat.h index e16d07eb08cf..d770e62632d7 100644 --- a/include/linux/compat.h +++ b/include/linux/compat.h @@ -221,6 +221,8 @@ typedef struct compat_siginfo { #ifdef __ARCH_SI_TRAPNO int _trapno; /* TRAP # which caused the signal */ #endif +#define __COMPAT_ADDR_BND_PKEY_PAD (__alignof__(compat_uptr_t) < sizeof(short) ? \ + sizeof(short) : __alignof__(compat_uptr_t)) union { /* * used when si_code=BUS_MCEERR_AR or @@ -229,13 +231,13 @@ typedef struct compat_siginfo { short int _addr_lsb; /* Valid LSB of the reported address. */ /* used when si_code=SEGV_BNDERR */ struct { - compat_uptr_t _dummy_bnd; + char _dummy_bnd[__COMPAT_ADDR_BND_PKEY_PAD]; compat_uptr_t _lower; compat_uptr_t _upper; } _addr_bnd; /* used when si_code=SEGV_PKUERR */ struct { - compat_uptr_t _dummy_pkey; + char _dummy_pkey[__COMPAT_ADDR_BND_PKEY_PAD]; u32 _pkey; } _addr_pkey; }; diff --git a/include/uapi/asm-generic/siginfo.h b/include/uapi/asm-generic/siginfo.h index 4b3520bf67ba..6d789648473d 100644 --- a/include/uapi/asm-generic/siginfo.h +++ b/include/uapi/asm-generic/siginfo.h @@ -94,6 +94,9 @@ typedef struct siginfo { unsigned int _flags; /* see ia64 si_flags */ unsigned long _isr; /* isr */ #endif + +#define __ADDR_BND_PKEY_PAD (__alignof__(void *) < sizeof(short) ? \ + sizeof(short) : __alignof__(void *)) union { /* * used when si_code=BUS_MCEERR_AR or @@ -102,13 +105,13 @@ typedef struct siginfo { short _addr_lsb; /* LSB of the reported address */ /* used when si_code=SEGV_BNDERR */ struct { - void *_dummy_bnd; + char _dummy_bnd[__ADDR_BND_PKEY_PAD]; void __user *_lower; void __user *_upper; } _addr_bnd; /* used when si_code=SEGV_PKUERR */ struct { - void *_dummy_pkey; + char _dummy_pkey[__ADDR_BND_PKEY_PAD]; __u32 _pkey; } _addr_pkey; }; From 4be33329d46f80e87afe7db61271d1370607260a Mon Sep 17 00:00:00 2001 From: "Eric W. Biederman" Date: Mon, 2 Apr 2018 15:10:57 -0500 Subject: [PATCH 2/2] m68k: Verify the offsets in struct siginfo never change. A change to the generic struct siginfo accidentally changed the offset of si_offset. Add build time checks to ensure the offsets of all known fields in struct siginfo never change. This copies the form of similar changes on x86. Signed-off-by: "Eric W. Biederman" --- arch/m68k/kernel/signal.c | 62 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c index e79421f5b9cd..f7cd5ecfacd3 100644 --- a/arch/m68k/kernel/signal.c +++ b/arch/m68k/kernel/signal.c @@ -574,6 +574,66 @@ static inline int rt_save_fpu_state(struct ucontext __user *uc, struct pt_regs * #endif /* CONFIG_FPU */ +static inline void siginfo_build_tests(void) +{ + /* This needs to be tested on m68k as it has a lesser + * alignment requirment than x86 and that can cause surprises. + */ + + /* This is part of the ABI and can never change in size: */ + BUILD_BUG_ON(sizeof(siginfo_t) != 128); + + /* Ensure the know fields never change in location */ + BUILD_BUG_ON(offsetof(siginfo_t, si_signo) != 0); + BUILD_BUG_ON(offsetof(siginfo_t, si_errno) != 4); + BUILD_BUG_ON(offsetof(siginfo_t, si_code) != 8); + + /* _kill */ + BUILD_BUG_ON(offsetof(siginfo_t, si_pid) != 0x0C); + BUILD_BUG_ON(offsetof(siginfo_t, si_uid) != 0x10); + + /* _timer */ + BUILD_BUG_ON(offsetof(siginfo_t, si_tid) != 0x0C); + BUILD_BUG_ON(offsetof(siginfo_t, si_overrun) != 0x10); + BUILD_BUG_ON(offsetof(siginfo_t, si_value) != 0x14); + + /* _rt */ + BUILD_BUG_ON(offsetof(siginfo_t, si_pid) != 0x0C); + BUILD_BUG_ON(offsetof(siginfo_t, si_uid) != 0x10); + BUILD_BUG_ON(offsetof(siginfo_t, si_value) != 0x14); + + /* _sigchld */ + BUILD_BUG_ON(offsetof(siginfo_t, si_pid) != 0x0C); + BUILD_BUG_ON(offsetof(siginfo_t, si_uid) != 0x10); + BUILD_BUG_ON(offsetof(siginfo_t, si_status) != 0x14); + BUILD_BUG_ON(offsetof(siginfo_t, si_utime) != 0x18); + BUILD_BUG_ON(offsetof(siginfo_t, si_stime) != 0x1C); + + /* _sigfault */ + BUILD_BUG_ON(offsetof(siginfo_t, si_addr) != 0x0C); + + /* _sigfault._mcerr */ + BUILD_BUG_ON(offsetof(siginfo_t, si_addr_lsb) != 0x10); + + /* _sigfault._addr_bnd */ + BUILD_BUG_ON(offsetof(siginfo_t, si_lower) != 0x12); + BUILD_BUG_ON(offsetof(siginfo_t, si_upper) != 0x16); + + /* _sigfault._addr_pkey */ + BUILD_BUG_ON(offsetof(siginfo_t, si_pkey) != 0x12); + + /* _sigpoll */ + BUILD_BUG_ON(offsetof(siginfo_t, si_band) != 0x0C); + BUILD_BUG_ON(offsetof(siginfo_t, si_fd) != 0x10); + + /* _sigsys */ + BUILD_BUG_ON(offsetof(siginfo_t, si_call_addr) != 0x0C); + BUILD_BUG_ON(offsetof(siginfo_t, si_syscall) != 0x10); + BUILD_BUG_ON(offsetof(siginfo_t, si_arch) != 0x14); + + /* any new si_fields should be added here */ +} + static int mangle_kernel_stack(struct pt_regs *regs, int formatvec, void __user *fp) { @@ -635,6 +695,8 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *usc, void __u struct sigcontext context; int err = 0; + siginfo_build_tests(); + /* Always make any pending restarted system calls return -EINTR */ current->restart_block.fn = do_no_restart_syscall;