From 7f047de18cf6cd51915d4fdbe1a7e66c38b45e98 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Tue, 31 Oct 2017 13:53:52 +0100 Subject: linux-user: Restrict usage of sa_restorer Reading and writing to an sa_restorer member that isn't supposed to exist corrupts user memory. Introduce TARGET_ARCH_HAS_SA_RESTORER, similar to the kernel's __ARCH_HAS_SA_RESTORER. Reported-by: Helge Deller Signed-off-by: Richard Henderson Signed-off-by: Riku Voipio --- linux-user/syscall_defs.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'linux-user/syscall_defs.h') diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h index 450960bb54..e366183419 100644 --- a/linux-user/syscall_defs.h +++ b/linux-user/syscall_defs.h @@ -445,6 +445,7 @@ int do_sigaction(int sig, const struct target_sigaction *act, #define TARGET_SA_RESTART 2u #define TARGET_SA_NODEFER 0x20u #define TARGET_SA_RESETHAND 4u +#define TARGET_ARCH_HAS_SA_RESTORER 1 #elif defined(TARGET_MIPS) #define TARGET_SA_NOCLDSTOP 0x00000001 #define TARGET_SA_NOCLDWAIT 0x00010000 @@ -483,6 +484,10 @@ int do_sigaction(int sig, const struct target_sigaction *act, #define TARGET_SA_RESTORER 0x04000000 #endif +#ifdef TARGET_SA_RESTORER +#define TARGET_ARCH_HAS_SA_RESTORER 1 +#endif + #if defined(TARGET_ALPHA) #define TARGET_SIGHUP 1 @@ -718,19 +723,27 @@ struct target_sigaction { abi_ulong _sa_handler; #endif target_sigset_t sa_mask; +#ifdef TARGET_ARCH_HAS_SA_RESTORER + /* ??? This is always present, but ignored unless O32. */ + abi_ulong sa_restorer; +#endif }; #else struct target_old_sigaction { abi_ulong _sa_handler; abi_ulong sa_mask; abi_ulong sa_flags; +#ifdef TARGET_ARCH_HAS_SA_RESTORER abi_ulong sa_restorer; +#endif }; struct target_sigaction { abi_ulong _sa_handler; abi_ulong sa_flags; +#ifdef TARGET_ARCH_HAS_SA_RESTORER abi_ulong sa_restorer; +#endif target_sigset_t sa_mask; }; #endif -- cgit v1.2.3