kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/arch/openrisc
History
Ali Ahmet Memis cf1b5514dd openrisc: signal: do not restore privileged SR bits on sigreturn 
commit 32ef1b30ad upstream.

restore_sigcontext() copies the whole supervision register (SR) from the
signal frame and only clears SPR_SR_SM before the value is reloaded into
the hardware SR (through ESR and l.rfe) on the return to user space.  All
other SR bits are left under user control.

An unprivileged task can thus return from a signal handler through a
crafted sigframe that clears SPR_SR_DME.  With the data MMU disabled the
CPU performs no translation or protection on data accesses, so the task
gains read and write access to arbitrary physical memory, a local
privilege escalation.  SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH
and the cache-enable bits are exposed the same way.  The ptrace GPR regset
already refuses any change to SR for exactly this reason.

Restore only the arithmetic flag bits (F, CY, OV) from the signal frame
and take every privileged control bit from the SR the kernel saved on
signal entry.

Verified with qemu-system-or1k -M or1k-sim: before this change an
unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to
physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the
same PoC receives SIGSEGV and physical memory is unchanged.

Fixes: ac689eb7f9 ("OpenRISC: Signal handling")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-23 14:17:16 +02:00
..
boot openrisc/litex: Add ethernet device 2021-08-31 22:41:46 +09:00
configs openrisc/litex: Update defconfig 2021-08-31 22:41:46 +09:00
include openrisc: signal: do not restore privileged SR bits on sigreturn 2026-08-23 14:17:16 +02:00
kernel openrisc: signal: do not restore privileged SR bits on sigreturn 2026-08-23 14:17:16 +02:00
lib openrisc: rename or32 code & comments to or1k 2021-08-05 10:53:59 +09:00
mm openrisc: io: Define iounmap argument as volatile 2022-08-25 11:40:38 +02:00
Kbuild openrisc: add arch/openrisc/Kbuild 2021-01-18 20:53:14 +09:00
Kconfig Tracing updates for 5.15: 2021-09-05 11:50:41 -07:00
Kconfig.debug treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile kbuild: require all architectures to have arch/$(SRCARCH)/Kbuild 2021-05-26 23:10:37 +09:00