Skip to content

Commit 24d6834

Browse files
brooniectmarinas
authored andcommitted
arm64/signal: Only read new data when parsing the ZA context
When we parse the ZA signal context we read the entire context from userspace, including the generic signal context header which was already read by parse_user_sigframe() and padding bytes that we ignore. Avoid the possibility of relying on the second read of the data read twice by only reading the data which we are actually going to use. Signed-off-by: Mark Brown <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Catalin Marinas <[email protected]>
1 parent f3ac48a commit 24d6834

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

arch/arm64/kernel/signal.c

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -435,25 +435,26 @@ static int preserve_za_context(struct za_context __user *ctx)
435435

436436
static int restore_za_context(struct user_ctxs *user)
437437
{
438-
int err;
438+
int err = 0;
439439
unsigned int vq;
440-
struct za_context za;
440+
u16 user_vl;
441441

442442
if (user->za_size < sizeof(*user->za))
443443
return -EINVAL;
444444

445-
if (__copy_from_user(&za, user->za, sizeof(za)))
446-
return -EFAULT;
445+
__get_user_error(user_vl, &(user->za->vl), err);
446+
if (err)
447+
return err;
447448

448-
if (za.vl != task_get_sme_vl(current))
449+
if (user_vl != task_get_sme_vl(current))
449450
return -EINVAL;
450451

451452
if (user->za_size == sizeof(*user->za)) {
452453
current->thread.svcr &= ~SVCR_ZA_MASK;
453454
return 0;
454455
}
455456

456-
vq = sve_vq_from_vl(za.vl);
457+
vq = sve_vq_from_vl(user_vl);
457458

458459
if (user->za_size < ZA_SIG_CONTEXT_SIZE(vq))
459460
return -EINVAL;

0 commit comments

Comments
 (0)