releases/4.19.35/riscv-fix-syscall_get_arguments-and-syscall_set_arguments.patch

   1 From 10a16997db3d99fc02c026cf2c6e6c670acafab0 Mon Sep 17 00:00:00 2001
   2 From: "Dmitry V. Levin" <ldv@altlinux.org>
   3 Date: Fri, 29 Mar 2019 20:12:21 +0300
   4 Subject: riscv: Fix syscall_get_arguments() and syscall_set_arguments()
   5
   6 From: Dmitry V. Levin <ldv@altlinux.org>
   7
   8 commit 10a16997db3d99fc02c026cf2c6e6c670acafab0 upstream.
   9
  10 RISC-V syscall arguments are located in orig_a0,a1..a5 fields
  11 of struct pt_regs.
  12
  13 Due to an off-by-one bug and a bug in pointer arithmetic
  14 syscall_get_arguments() was reading s3..s7 fields instead of a1..a5.
  15 Likewise, syscall_set_arguments() was writing s3..s7 fields
  16 instead of a1..a5.
  17
  18 Link: http://lkml.kernel.org/r/20190329171221.GA32456@altlinux.org
  19
  20 Fixes: e2c0cdfba7f69 ("RISC-V: User-facing API")
  21 Cc: Ingo Molnar <mingo@redhat.com>
  22 Cc: Kees Cook <keescook@chromium.org>
  23 Cc: Andy Lutomirski <luto@amacapital.net>
  24 Cc: Will Drewry <wad@chromium.org>
  25 Cc: Albert Ou <aou@eecs.berkeley.edu>
  26 Cc: linux-riscv@lists.infradead.org
  27 Cc: stable@vger.kernel.org # v4.15+
  28 Acked-by: Palmer Dabbelt <palmer@sifive.com>
  29 Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
  30 Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
  31 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  32
  33 ---
  34  arch/riscv/include/asm/syscall.h |   12 +++++++-----
  35  1 file changed, 7 insertions(+), 5 deletions(-)
  36
  37 --- a/arch/riscv/include/asm/syscall.h
  38 +++ b/arch/riscv/include/asm/syscall.h
  39 @@ -78,10 +78,11 @@ static inline void syscall_get_arguments
  40         if (i == 0) {
  41                 args[0] = regs->orig_a0;
  42                 args++;
  43 -               i++;
  44                 n--;
  45 +       } else {
  46 +               i--;
  47         }
  48 -       memcpy(args, &regs->a1 + i * sizeof(regs->a1), n * sizeof(args[0]));
  49 +       memcpy(args, &regs->a1 + i, n * sizeof(args[0]));
  50  }
  51
  52  static inline void syscall_set_arguments(struct task_struct *task,
  53 @@ -93,10 +94,11 @@ static inline void syscall_set_arguments
  54          if (i == 0) {
  55                  regs->orig_a0 = args[0];
  56                  args++;
  57 -                i++;
  58                  n--;
  59 -        }
  60 -       memcpy(&regs->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0));
  61 +       } else {
  62 +               i--;
  63 +       }
  64 +       memcpy(&regs->a1 + i, args, n * sizeof(regs->a1));
  65  }
  66
  67  #endif /* _ASM_RISCV_SYSCALL_H */