Commit c06989da authored by Mathias Krause's avatar Mathias Krause Committed by Thomas Gleixner

x86/vdso: Ensure vdso32_enabled gets set to valid values only

vdso_enabled can be set to arbitrary integer values via the kernel command
line 'vdso32=' parameter or via 'sysctl abi.vsyscall32'.

load_vdso32() only maps VDSO if vdso_enabled == 1, but ARCH_DLINFO_IA32
merily checks for vdso_enabled != 0. As a consequence the AT_SYSINFO_EHDR
auxiliary vector for the VDSO_ENTRY is emitted with a NULL pointer which
causes a segfault when the application tries to use the VDSO.

Restrict the valid arguments on the command line and the sysctl to 0 and 1.

Fixes: b0b49f26 ("x86, vdso: Remove compat vdso support")
Signed-off-by: default avatarMathias Krause <minipli@googlemail.com>
Acked-by: default avatarAndy Lutomirski <luto@amacapital.net>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Cc: Roland McGrath <roland@redhat.com>
Link: http://lkml.kernel.org/r/1491424561-7187-1-git-send-email-minipli@googlemail.com
Link: http://lkml.kernel.org/r/20170410151723.518412863@linutronix.deSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent cfac6dfa
...@@ -30,8 +30,10 @@ static int __init vdso32_setup(char *s) ...@@ -30,8 +30,10 @@ static int __init vdso32_setup(char *s)
{ {
vdso32_enabled = simple_strtoul(s, NULL, 0); vdso32_enabled = simple_strtoul(s, NULL, 0);
if (vdso32_enabled > 1) if (vdso32_enabled > 1) {
pr_warn("vdso32 values other than 0 and 1 are no longer allowed; vdso disabled\n"); pr_warn("vdso32 values other than 0 and 1 are no longer allowed; vdso disabled\n");
vdso32_enabled = 0;
}
return 1; return 1;
} }
...@@ -62,13 +64,18 @@ subsys_initcall(sysenter_setup); ...@@ -62,13 +64,18 @@ subsys_initcall(sysenter_setup);
/* Register vsyscall32 into the ABI table */ /* Register vsyscall32 into the ABI table */
#include <linux/sysctl.h> #include <linux/sysctl.h>
static const int zero;
static const int one = 1;
static struct ctl_table abi_table2[] = { static struct ctl_table abi_table2[] = {
{ {
.procname = "vsyscall32", .procname = "vsyscall32",
.data = &vdso32_enabled, .data = &vdso32_enabled,
.maxlen = sizeof(int), .maxlen = sizeof(int),
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec .proc_handler = proc_dointvec_minmax,
.extra1 = (int *)&zero,
.extra2 = (int *)&one,
}, },
{} {}
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment