Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] cio: allow offline processing for disconnected devices
  [S390] cio: handle ssch() return codes correctly.
  [S390] cio: Correct cleanup on error.
  [S390] CVE-2008-1514: prevent ptrace padding area read/write in 31-bit mode

2 files changed, 29 insertions, 0 deletions

diff --git a/arch/s390/kernel/compat_ptrace.h b/arch/s390/kernel/compat_ptrace.h
index cde81fa64f89..a2be3a978d5c 100644
--- a/arch/s390/kernel/compat_ptrace.h
+++ b/arch/s390/kernel/compat_ptrace.h
@@ -42,6 +42,7 @@ struct user_regs_struct32
         u32 gprs[NUM_GPRS];
         u32 acrs[NUM_ACRS];
         u32 orig_gpr2;
+        /* nb: there's a 4-byte hole here */
         s390_fp_regs fp_regs;
         /*
          * These per registers are in here so that gdb can modify them
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 2815bfe348a6..c8b08289eb87 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -170,6 +170,13 @@ static unsigned long __peek_user(struct task_struct *child, addr_t addr)
                  */
                 tmp = (addr_t) task_pt_regs(child)->orig_gpr2;
 
+        } else if (addr < (addr_t) &dummy->regs.fp_regs) {
+                /*
+                 * prevent reads of padding hole between
+                 * orig_gpr2 and fp_regs on s390.
+                 */
+                tmp = 0;
+
         } else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
                 /* 
                  * floating point regs. are stored in the thread structure
@@ -270,6 +277,13 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
                  */
                 task_pt_regs(child)->orig_gpr2 = data;
 
+        } else if (addr < (addr_t) &dummy->regs.fp_regs) {
+                /*
+                 * prevent writes of padding hole between
+                 * orig_gpr2 and fp_regs on s390.
+                 */
+                return 0;
+
         } else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
                 /*
                  * floating point regs. are stored in the thread structure
@@ -428,6 +442,13 @@ static u32 __peek_user_compat(struct task_struct *child, addr_t addr)
                  */
                 tmp = *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4);
 
+        } else if (addr < (addr_t) &dummy32->regs.fp_regs) {
+                /*
+                 * prevent reads of padding hole between
+                 * orig_gpr2 and fp_regs on s390.
+                 */
+                tmp = 0;
+
         } else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
                 /*
                  * floating point regs. are stored in the thread structure 
@@ -514,6 +535,13 @@ static int __poke_user_compat(struct task_struct *child,
                  */
                 *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4) = tmp;
 
+        } else if (addr < (addr_t) &dummy32->regs.fp_regs) {
+                /*
+                 * prevent writess of padding hole between
+                 * orig_gpr2 and fp_regs on s390.
+                 */
+                return 0;
+
         } else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
                 /*
                  * floating point regs. are stored in the thread structure