Merge git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86

* git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86:
  x86: fix deadlock, make pgd_lock irq-safe
  virtio: fix trivial build bug
  x86: fix mttr trimming
  x86: delay CPA self-test and repeat it
  x86: fix 64-bit sections
  generic: add __FINITDATA
  x86: remove suprious ifdefs from pageattr.c
  x86: mark the .rodata section also NX
  x86: fix iret exception recovery on 64-bit
  cpuidle: dubious one-bit signed bitfield in cpuidle.h
  x86: fix sparse warnings in powernow-k8.c
  x86: fix sparse error in traps_32.c
  x86: trivial sparse/checkpatch in quirks.c
  x86 ptrace: disallow null cs/ss
  MAINTAINERS: RDC R-321x SoC maintainer
  brk randomization: introduce CONFIG_COMPAT_BRK
  brk: check the lower bound properly
  x86: remove X2 workaround
  x86: make spurious fault handler aware of large mappings
  x86: make traps on entry code be debuggable in user space, 64-bit

1 files changed, 23 insertions, 2 deletions

diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 96286df1bb81..702c33efea84 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -103,9 +103,26 @@ static int set_segment_reg(struct task_struct *task,
         if (invalid_selector(value))
                 return -EIO;
 
-        if (offset != offsetof(struct user_regs_struct, gs))
+        /*
+         * For %cs and %ss we cannot permit a null selector.
+         * We can permit a bogus selector as long as it has USER_RPL.
+         * Null selectors are fine for other segment registers, but
+         * we will never get back to user mode with invalid %cs or %ss
+         * and will take the trap in iret instead.  Much code relies
+         * on user_mode() to distinguish a user trap frame (which can
+         * safely use invalid selectors) from a kernel trap frame.
+         */
+        switch (offset) {
+        case offsetof(struct user_regs_struct, cs):
+        case offsetof(struct user_regs_struct, ss):
+                if (unlikely(value == 0))
+                        return -EIO;
+
+        default:
                 *pt_regs_access(task_pt_regs(task), offset) = value;
-        else {
+                break;
+
+        case offsetof(struct user_regs_struct, gs):
                 task->thread.gs = value;
                 if (task == current)
                         /*
@@ -227,12 +244,16 @@ static int set_segment_reg(struct task_struct *task,
                  * Can't actually change these in 64-bit mode.
                  */
         case offsetof(struct user_regs_struct,cs):
+                if (unlikely(value == 0))
+                        return -EIO;
 #ifdef CONFIG_IA32_EMULATION
                 if (test_tsk_thread_flag(task, TIF_IA32))
                         task_pt_regs(task)->cs = value;
 #endif
                 break;
         case offsetof(struct user_regs_struct,ss):
+                if (unlikely(value == 0))
+                        return -EIO;
 #ifdef CONFIG_IA32_EMULATION
                 if (test_tsk_thread_flag(task, TIF_IA32))
                         task_pt_regs(task)->ss = value;