diff mbox series

[5.4,44/90] sh: Fix validation of system call number

Message ID	20200803121859.755761157@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=5b7Y=BN=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>, John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>, Rich Felker <dalias@libc.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.4 44/90] sh: Fix validation of system call number Date: Mon, 3 Aug 2020 14:19:06 +0200 Message-Id: <20200803121859.755761157@linuxfoundation.org> In-Reply-To: <20200803121857.546052424@linuxfoundation.org> References: <20200803121857.546052424@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.4,03/90] sunrpc: check that domain table is empty at module unload. [5.4,05/90] PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge [5.4,07/90] ALSA: usb-audio: Add implicit feedback quirk for SSL2 [5.4,11/90] ALSA: hda/realtek - Fixed HP right speaker no sound [5.4,13/90] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE [5.4,15/90] 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work [5.4,16/90] wireless: Use offsetof instead of custom macro. [5.4,18/90] ARM: dts: imx6sx-sabreauto: Fix the phy-mode on fec2 [5.4,20/90] ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect [5.4,21/90] virtio_balloon: fix up endian-ness for free cmd id [5.4,23/90] ARM: percpu.h: fix build error [5.4,31/90] rds: Prevent kernel-infoleak in rds_notify_queue_get() [5.4,32/90] libtraceevent: Fix build with binutils 2.35 [5.4,33/90] net/x25: Fix x25_neigh refcnt leak when x25 disconnect [5.4,35/90] xfrm: policy: match with both mark and mask on user interfaces [5.4,36/90] ARM: dts sunxi: Relax a bit the CMA pool allocation range [5.4,39/90] nvme-tcp: fix possible hang waiting for icresp response [5.4,40/90] selftests/net: rxtimestamp: fix clang issues for target arch PowerPC [5.4,43/90] sh/tlb: Fix PGTABLE_LEVELS > 2 [5.4,44/90] sh: Fix validation of system call number [5.4,45/90] net: hns3: fix a TX timeout issue [5.4,47/90] net/mlx5: E-switch, Destroy TSAR when fail to enable the mode [5.4,50/90] net/mlx5e: Modify uplink state on interface up/down [5.4,51/90] net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev [5.4,54/90] rhashtable: Fix unprotected RCU dereference in __rht_ptr [5.4,56/90] mlxsw: core: Increase scope of RCU read-side critical section [5.4,57/90] mlxsw: core: Free EMAD transactions using kfree_rcu() [5.4,59/90] bpf: Fix map leak in HASH_OF_MAPS map [5.4,60/90] mac80211: mesh: Free ie data when leaving mesh [5.4,61/90] mac80211: mesh: Free pending skb when destroying a mpath [5.4,62/90] arm64/alternatives: move length validation inside the subsection [5.4,64/90] Bluetooth: fix kernel oops in store_pending_adv_report [5.4,66/90] net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_por... [5.4,67/90] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq [5.4,69/90] vxlan: fix memleak of fdb [5.4,70/90] usb: hso: Fix debug compile warning on sparc32 [5.4,73/90] selftests: net: ip_defrag: modprobe missing nf_defrag_ipv6 support [5.4,74/90] nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame [5.4,77/90] net: ethernet: ravb: exit if re-initialization fails in tx timeout [5.4,79/90] x86/unwind/orc: Fix ORC for newly forked tasks [5.4,80/90] x86/stacktrace: Fix reliable check for empty user task stacks [5.4,83/90] RISC-V: Set maximum number of mapped pages correctly [5.4,87/90] x86/i8259: Use printk_deferred() to prevent deadlock [5.4,88/90] perf tests bp_account: Make global variable static

Commit Message

Greg Kroah-Hartman Aug. 3, 2020, 12:19 p.m. UTC

From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>

[ Upstream commit 04a8a3d0a73f51c7c2da84f494db7ec1df230e69 ]

The slow path for traced system call entries accessed a wrong memory
location to get the number of the maximum allowed system call number.
Renumber the numbered "local" label for the correct location to avoid
collisions with actual local labels.

Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Fixes: f3a8308864f920d2 ("sh: Add a few missing irqflags tracing markers.")
Signed-off-by: Rich Felker <dalias@libc.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sh/kernel/entry-common.S | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff mbox series

Patch

diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
index d31f66e82ce51..4a8ec9e40cc2a 100644
--- a/arch/sh/kernel/entry-common.S
+++ b/arch/sh/kernel/entry-common.S
@@ -199,7 +199,7 @@  syscall_trace_entry:
 	mov.l	@(OFF_R7,r15), r7   ! arg3
 	mov.l	@(OFF_R3,r15), r3   ! syscall_nr
 	!
-	mov.l	2f, r10			! Number of syscalls
+	mov.l	6f, r10			! Number of syscalls
 	cmp/hs	r10, r3
 	bf	syscall_call
 	mov	#-ENOSYS, r0
@@ -353,7 +353,7 @@  ENTRY(system_call)
 	tst	r9, r8
 	bf	syscall_trace_entry
 	!
-	mov.l	2f, r8			! Number of syscalls
+	mov.l	6f, r8			! Number of syscalls
 	cmp/hs	r8, r3
 	bt	syscall_badsys
 	!
@@ -392,7 +392,7 @@  syscall_exit:
 #if !defined(CONFIG_CPU_SH2)
 1:	.long	TRA
 #endif
-2:	.long	NR_syscalls
+6:	.long	NR_syscalls
 3:	.long	sys_call_table
 7:	.long	do_syscall_trace_enter
 8:	.long	do_syscall_trace_leave