nios2: check the signal frame address before writing to it

setup_rt_frame() never checks that the signal frame it builds is in
user space.  The frame address comes from the user stack pointer (or
the alternate signal stack), and nios2's __put_user() is a plain store
with no address check.  The kernel runs in supervisor mode above
TASK_SIZE, so those stores succeed.

The errors are OR-ed together and the frame setup carries on, so even
though copy_siginfo_to_user() fails its own check, the ucontext header
and every saved register are still written.  A task that points its
stack pointer at kernel memory and takes a signal gets its own register
values written there.

Check the whole frame with access_ok() before writing any of it, as the
sigreturn side already does.  This goes back to the original nios2
signal code in commit b53e906d255d ("nios2: Signal handling support").

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

0 files changed, 0 insertions, 0 deletions