提交 a3c19514 编写于 作者: B Bobby Bingham 提交者: Linus Torvalds

sh: don't pass saved userspace state to exception handlers

The compiler is permitted to generate code which overwrites the
parameters to a function.  If those parameters include the only saved
copy we have of userspace's registers, we're in trouble.
Signed-off-by: NBobby Bingham <koorogi@koorogi.info>
Cc: Paul Mundt <paul.mundt@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 7caf62de
...@@ -42,18 +42,10 @@ static inline void trigger_address_error(void) ...@@ -42,18 +42,10 @@ static inline void trigger_address_error(void)
asmlinkage void do_address_error(struct pt_regs *regs, asmlinkage void do_address_error(struct pt_regs *regs,
unsigned long writeaccess, unsigned long writeaccess,
unsigned long address); unsigned long address);
asmlinkage void do_divide_error(unsigned long r4, unsigned long r5, asmlinkage void do_divide_error(unsigned long r4);
unsigned long r6, unsigned long r7, asmlinkage void do_reserved_inst(void);
struct pt_regs __regs); asmlinkage void do_illegal_slot_inst(void);
asmlinkage void do_reserved_inst(unsigned long r4, unsigned long r5, asmlinkage void do_exception_error(void);
unsigned long r6, unsigned long r7,
struct pt_regs __regs);
asmlinkage void do_illegal_slot_inst(unsigned long r4, unsigned long r5,
unsigned long r6, unsigned long r7,
struct pt_regs __regs);
asmlinkage void do_exception_error(unsigned long r4, unsigned long r5,
unsigned long r6, unsigned long r7,
struct pt_regs __regs);
#define BUILD_TRAP_HANDLER(name) \ #define BUILD_TRAP_HANDLER(name) \
asmlinkage void name##_trap_handler(unsigned long r4, unsigned long r5, \ asmlinkage void name##_trap_handler(unsigned long r4, unsigned long r5, \
......
...@@ -594,9 +594,7 @@ int is_dsp_inst(struct pt_regs *regs) ...@@ -594,9 +594,7 @@ int is_dsp_inst(struct pt_regs *regs)
#endif /* CONFIG_SH_DSP */ #endif /* CONFIG_SH_DSP */
#ifdef CONFIG_CPU_SH2A #ifdef CONFIG_CPU_SH2A
asmlinkage void do_divide_error(unsigned long r4, unsigned long r5, asmlinkage void do_divide_error(unsigned long r4)
unsigned long r6, unsigned long r7,
struct pt_regs __regs)
{ {
siginfo_t info; siginfo_t info;
...@@ -613,11 +611,9 @@ asmlinkage void do_divide_error(unsigned long r4, unsigned long r5, ...@@ -613,11 +611,9 @@ asmlinkage void do_divide_error(unsigned long r4, unsigned long r5,
} }
#endif #endif
asmlinkage void do_reserved_inst(unsigned long r4, unsigned long r5, asmlinkage void do_reserved_inst(void)
unsigned long r6, unsigned long r7,
struct pt_regs __regs)
{ {
struct pt_regs *regs = RELOC_HIDE(&__regs, 0); struct pt_regs *regs = current_pt_regs();
unsigned long error_code; unsigned long error_code;
struct task_struct *tsk = current; struct task_struct *tsk = current;
...@@ -701,11 +697,9 @@ static int emulate_branch(unsigned short inst, struct pt_regs *regs) ...@@ -701,11 +697,9 @@ static int emulate_branch(unsigned short inst, struct pt_regs *regs)
} }
#endif #endif
asmlinkage void do_illegal_slot_inst(unsigned long r4, unsigned long r5, asmlinkage void do_illegal_slot_inst(void)
unsigned long r6, unsigned long r7,
struct pt_regs __regs)
{ {
struct pt_regs *regs = RELOC_HIDE(&__regs, 0); struct pt_regs *regs = current_pt_regs();
unsigned long inst; unsigned long inst;
struct task_struct *tsk = current; struct task_struct *tsk = current;
...@@ -730,15 +724,12 @@ asmlinkage void do_illegal_slot_inst(unsigned long r4, unsigned long r5, ...@@ -730,15 +724,12 @@ asmlinkage void do_illegal_slot_inst(unsigned long r4, unsigned long r5,
die_if_no_fixup("illegal slot instruction", regs, inst); die_if_no_fixup("illegal slot instruction", regs, inst);
} }
asmlinkage void do_exception_error(unsigned long r4, unsigned long r5, asmlinkage void do_exception_error(void)
unsigned long r6, unsigned long r7,
struct pt_regs __regs)
{ {
struct pt_regs *regs = RELOC_HIDE(&__regs, 0);
long ex; long ex;
ex = lookup_exception_vector(); ex = lookup_exception_vector();
die_if_kernel("exception", regs, ex); die_if_kernel("exception", current_pt_regs(), ex);
} }
void per_cpu_trap_init(void) void per_cpu_trap_init(void)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册