powerpc: Fix machine check problem on 32-bit kernels

This fixes a bug found by Dave Jones that means that it is possible
for userspace to provoke a machine check on 32-bit kernels.  This
also fixes a couple of other places where I found similar problems
by inspection.

Signed-off-by: Paul Mackerras <paulus@samba.org>

2 files changed, 12 insertions, 1 deletions

diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 01e3c08cb550..8fdeca2d4597 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -803,10 +803,13 @@ static int do_setcontext(struct ucontext __user *ucp, struct pt_regs *regs, int
                 if (__get_user(cmcp, &ucp->uc_regs))
                         return -EFAULT;
                 mcp = (struct mcontext __user *)(u64)cmcp;
+                /* no need to check access_ok(mcp), since mcp < 4GB */
         }
 #else
         if (__get_user(mcp, &ucp->uc_regs))
                 return -EFAULT;
+        if (!access_ok(VERIFY_READ, mcp, sizeof(*mcp)))
+                return -EFAULT;
 #endif
         restore_sigmask(&set);
         if (restore_user_regs(regs, mcp, sig))
@@ -908,13 +911,14 @@ int sys_debug_setcontext(struct ucontext __user *ctx,
 {
         struct sig_dbg_op op;
         int i;
+        unsigned char tmp;
         unsigned long new_msr = regs->msr;
 #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
         unsigned long new_dbcr0 = current->thread.dbcr0;
 #endif
 
         for (i=0; i<ndbg; i++) {
-                if (__copy_from_user(&op, dbg, sizeof(op)))
+                if (copy_from_user(&op, dbg + i, sizeof(op)))
                         return -EFAULT;
                 switch (op.dbg_type) {
                 case SIG_DBG_SINGLE_STEPPING:
@@ -959,6 +963,11 @@ int sys_debug_setcontext(struct ucontext __user *ctx,
         current->thread.dbcr0 = new_dbcr0;
 #endif
 
+        if (!access_ok(VERIFY_READ, ctx, sizeof(*ctx))
+            || __get_user(tmp, (u8 __user *) ctx)
+            || __get_user(tmp, (u8 __user *) (ctx + 1) - 1))
+                return -EFAULT;
+
         /*
          * If we get a fault copying the context into the kernel's
          * image of the user's registers, we can't just return -EFAULT
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 27f65b95184d..c2db642f4cdd 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -182,6 +182,8 @@ static long restore_sigcontext(struct pt_regs *regs, sigset_t *set, int sig,
         err |= __get_user(msr, &sc->gp_regs[PT_MSR]);
         if (err)
                 return err;
+        if (v_regs && !access_ok(VERIFY_READ, v_regs, 34 * sizeof(vector128)))
+                return -EFAULT;
         /* Copy 33 vec registers (vr0..31 and vscr) from the stack */
         if (v_regs != 0 && (msr & MSR_VEC) != 0)
                 err |= __copy_from_user(current->thread.vr, v_regs,