ARM: signal: check the FDPIC function descriptor address

When a task has FDPIC_FUNCPTRS in its personality, setup_return() treats
the signal handler as a pointer to a function descriptor and reads the
entry point and GOT pointer from it with __get_user().  Nothing checks
that pointer: it is whatever the task passed to sigaction(), and any
task can set FDPIC_FUNCPTRS with personality(2).  BINFMT_ELF_FDPIC is
not limited to !MMU on ARM.

On most configurations this is harmless only by accident.  With
CPU_SPECTRE (ARMv7) __get_user() is get_user().  With CPU_USE_DOMAINS
(ARMv5 and older) it uses the unprivileged ldrt, but that only stops at
kernel memory when software PAN has put the kernel domain in client
mode; with ARM_PAN=n the kernel domain stays in manager mode, where
permissions are not checked.  So on an ARMv6-only MMU kernel, or an
ARMv5 or older one without ARM_PAN, it reads two words of kernel memory
that end up in the task's PC and r9.

Use get_user(), which checks the address.  This goes back to commit
5c16595353e0 ("ARM: signal handling support for FDPIC_FUNCPTRS
functions").

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

0 files changed, 0 insertions, 0 deletions