diff options
author | Paul Mackerras <paulus@samba.org> | 2006-06-12 03:53:34 -0400 |
---|---|---|
committer | Paul Mackerras <paulus@samba.org> | 2006-06-12 03:53:34 -0400 |
commit | 7a0c58d0513c246ac5438ef4a55ce8b93395ae0e (patch) | |
tree | d18f58349ced242aa62e622e381e60933f71d451 /arch/powerpc/kernel/signal_32.c | |
parent | 6218a761bbc27acc65248c80024875bcc06d52b1 (diff) | |
parent | 289a1e995e74734b5ec76ca8a5490058f4fecc24 (diff) |
Merge branch 'merge'
Diffstat (limited to 'arch/powerpc/kernel/signal_32.c')
-rw-r--r-- | arch/powerpc/kernel/signal_32.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c index 237faeec2ec2..d73b25e22fca 100644 --- a/arch/powerpc/kernel/signal_32.c +++ b/arch/powerpc/kernel/signal_32.c | |||
@@ -808,10 +808,13 @@ static int do_setcontext(struct ucontext __user *ucp, struct pt_regs *regs, int | |||
808 | if (__get_user(cmcp, &ucp->uc_regs)) | 808 | if (__get_user(cmcp, &ucp->uc_regs)) |
809 | return -EFAULT; | 809 | return -EFAULT; |
810 | mcp = (struct mcontext __user *)(u64)cmcp; | 810 | mcp = (struct mcontext __user *)(u64)cmcp; |
811 | /* no need to check access_ok(mcp), since mcp < 4GB */ | ||
811 | } | 812 | } |
812 | #else | 813 | #else |
813 | if (__get_user(mcp, &ucp->uc_regs)) | 814 | if (__get_user(mcp, &ucp->uc_regs)) |
814 | return -EFAULT; | 815 | return -EFAULT; |
816 | if (!access_ok(VERIFY_READ, mcp, sizeof(*mcp))) | ||
817 | return -EFAULT; | ||
815 | #endif | 818 | #endif |
816 | restore_sigmask(&set); | 819 | restore_sigmask(&set); |
817 | if (restore_user_regs(regs, mcp, sig)) | 820 | if (restore_user_regs(regs, mcp, sig)) |
@@ -913,13 +916,14 @@ int sys_debug_setcontext(struct ucontext __user *ctx, | |||
913 | { | 916 | { |
914 | struct sig_dbg_op op; | 917 | struct sig_dbg_op op; |
915 | int i; | 918 | int i; |
919 | unsigned char tmp; | ||
916 | unsigned long new_msr = regs->msr; | 920 | unsigned long new_msr = regs->msr; |
917 | #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE) | 921 | #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE) |
918 | unsigned long new_dbcr0 = current->thread.dbcr0; | 922 | unsigned long new_dbcr0 = current->thread.dbcr0; |
919 | #endif | 923 | #endif |
920 | 924 | ||
921 | for (i=0; i<ndbg; i++) { | 925 | for (i=0; i<ndbg; i++) { |
922 | if (__copy_from_user(&op, dbg, sizeof(op))) | 926 | if (copy_from_user(&op, dbg + i, sizeof(op))) |
923 | return -EFAULT; | 927 | return -EFAULT; |
924 | switch (op.dbg_type) { | 928 | switch (op.dbg_type) { |
925 | case SIG_DBG_SINGLE_STEPPING: | 929 | case SIG_DBG_SINGLE_STEPPING: |
@@ -964,6 +968,11 @@ int sys_debug_setcontext(struct ucontext __user *ctx, | |||
964 | current->thread.dbcr0 = new_dbcr0; | 968 | current->thread.dbcr0 = new_dbcr0; |
965 | #endif | 969 | #endif |
966 | 970 | ||
971 | if (!access_ok(VERIFY_READ, ctx, sizeof(*ctx)) | ||
972 | || __get_user(tmp, (u8 __user *) ctx) | ||
973 | || __get_user(tmp, (u8 __user *) (ctx + 1) - 1)) | ||
974 | return -EFAULT; | ||
975 | |||
967 | /* | 976 | /* |
968 | * If we get a fault copying the context into the kernel's | 977 | * If we get a fault copying the context into the kernel's |
969 | * image of the user's registers, we can't just return -EFAULT | 978 | * image of the user's registers, we can't just return -EFAULT |