From patchwork Tue Apr 24 07:27:38 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Christophe Lyon X-Patchwork-Id: 134055 Delivered-To: patch@linaro.org Received: by 10.46.151.6 with SMTP id r6csp1907533lji; Tue, 24 Apr 2018 00:29:42 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+cVQtW9S9xxFUjCvt4/7GVxOfAnziUnibT84z/gNrByZEPRpKUlsE8oJNjuVTdAEel1YlL X-Received: by 2002:ac8:2c98:: with SMTP id 24-v6mr26632607qtw.420.1524554982203; Tue, 24 Apr 2018 00:29:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524554982; cv=none; d=google.com; s=arc-20160816; b=lpOUnyy4eOqzoByimum6mqTOn1oH9t3GbCI8s6Rtizof8GJ249MMDR56CNr8k6Xdsb Eo4AtwJN+idUvkhXwqovHDKZBO/kxcoBtqfqN6pmf4gsPoSzj3hOo8IZtUZQM6NW/4xI d4orktIFUjA4C0Wl1NKPSe3V3xQdE+sLFHiyCLDE9cnvyVSsx58TpJ71k7pfGc6LTGIh jwfm610ruT4TkjjGnXSQdhc5NkksNdz4ERpSVunVBbofP3YpIscteeIZpiRl/DUnOABA nP+obFHhdbhe9PthAeVDJQ/4e3Gvg1/t+VCJO+u3D5PD3MLT1zTpR6hzjOJzXdoCyGdA FtRg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject :content-transfer-encoding:mime-version:message-id:date:to:from :arc-authentication-results; bh=INrBcyk1gmwk6ZuiAx0PK1mTJbnUQhmmRQeHHMfKq8Y=; b=twmRS0w0ybQ8FjGizgWWMpmbgzKpLQwZbYPLLGd1v1tdJ2eZJGxMb9ZAS1rlG8SJA5 uaRs6Jgi0iObsx6qHu3IcmJVffVSLiX8qT17dSw/qN4TO+N3XMiFjNyFR/BcqD2CxiG2 Veqnnhh4j8N7sbK/mLSYbrY8IlJMh1DLoXIkQD+Sh0nMMrm9uBI99vSXzlSusJ5/AVvx NmimoG72xhL6kmQ7qTK9eQkTqo0KDQcMIarQvGHBRt2oiL6lNwYTZzGM9CMoSGOui4ud c6ruRnD10Aj4zzI9i0UwjneLWwX11pFvQfRdtA/RGV1YqMSZspS1mDHl1FoeLuX7X5dK h1DQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom=qemu-devel-bounces+patch=linaro.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id w25-v6si2004254qth.172.2018.04.24.00.29.42 for (version=TLS1 cipher=AES128-SHA bits=128/128); Tue, 24 Apr 2018 00:29:42 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom=qemu-devel-bounces+patch=linaro.org@nongnu.org Received: from localhost ([::1]:56945 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fAsOT-0004F5-Mx for patch@linaro.org; Tue, 24 Apr 2018 03:29:41 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52929) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fAsN6-0003OH-4k for qemu-devel@nongnu.org; Tue, 24 Apr 2018 03:28:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fAsN1-0004CY-2u for qemu-devel@nongnu.org; Tue, 24 Apr 2018 03:28:16 -0400 Received: from mx07-00178001.pphosted.com ([62.209.51.94]:50615) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fAsN0-0004BY-B5 for qemu-devel@nongnu.org; Tue, 24 Apr 2018 03:28:11 -0400 Received: from pps.filterd (m0046037.ppops.net [127.0.0.1]) by mx07-.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id w3O7JV4k023426; Tue, 24 Apr 2018 09:28:04 +0200 Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com with ESMTP id 2hfu2txwac-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 24 Apr 2018 09:28:04 +0200 Received: from zeta.dmz-eu.st.com (zeta.dmz-eu.st.com [164.129.230.9]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id DBF2531; Tue, 24 Apr 2018 07:28:03 +0000 (GMT) Received: from Webmail-eu.st.com (sfhdag5node1.st.com [10.75.127.13]) by zeta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 9AA9810A5; Tue, 24 Apr 2018 07:28:03 +0000 (GMT) Received: from gnb.st.com (10.75.127.50) by SFHDAG5NODE1.st.com (10.75.127.13) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Tue, 24 Apr 2018 09:28:02 +0200 From: Christophe Lyon To: , , , , Date: Tue, 24 Apr 2018 09:27:38 +0200 Message-ID: <20180424072758.21643-1-christophe.lyon@st.com> X-Mailer: git-send-email 2.9.5 MIME-Version: 1.0 X-Originating-IP: [10.75.127.50] X-ClientProxiedBy: SFHDAG8NODE3.st.com (10.75.127.24) To SFHDAG5NODE1.st.com (10.75.127.13) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-04-24_01:, , signatures=0 X-MIME-Autoconverted: from 8bit to quoted-printable by mx07-.pphosted.com id w3O7JV4k023426 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 62.209.51.94 Subject: [Qemu-devel] [ARM/FDPIC v3 3/4] linux-user: ARM-FDPIC: Add support of FDPIC for ARM. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" Add FDPIC info into image_info structure since interpreter info is on stack and needs to be saved to be accessed later on. Compared to v2: Do not add the is_fdpic field to TaskState, as the information can be retrieved from the 'info' data in TaskState. Co-Authored-By: Mickaël Guêné Signed-off-by: Christophe Lyon -- 2.6.3 Reviewed-by: Peter Maydell diff --git a/linux-user/elfload.c b/linux-user/elfload.c index 76d7718..fad3c42 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -78,6 +78,11 @@ enum { */ #define personality(pers) (pers & PER_MASK) +int info_is_fdpic(struct image_info *info) +{ + return (info->personality == PER_LINUX_FDPIC); +} + /* this flag is uneffective under linux too, should be deleted */ #ifndef MAP_DENYWRITE #define MAP_DENYWRITE 0 @@ -287,6 +292,25 @@ static inline void init_thread(struct target_pt_regs *regs, /* For uClinux PIC binaries. */ /* XXX: Linux does this only on ARM with no MMU (do we care ?) */ regs->uregs[10] = infop->start_data; + + /* Support ARM FDPIC. */ + if (info_is_fdpic(infop)) { + /* As described in the ABI document, r7 points to the loadmap info + * prepared by the kernel. If an interpreter is needed, r8 points + * to the interpreter loadmap and r9 points to the interpreter + * PT_DYNAMIC info. If no interpreter is needed, r8 is zero, and + * r9 points to the main program PT_DYNAMIC info. + */ + regs->uregs[7] = infop->loadmap_addr; + if (infop->interpreter_loadmap_addr) { + /* Executable is dynamically loaded. */ + regs->uregs[8] = infop->interpreter_loadmap_addr; + regs->uregs[9] = infop->interpreter_pt_dynamic_addr; + } else { + regs->uregs[8] = 0; + regs->uregs[9] = infop->pt_dynamic_addr; + } + } } #define ELF_NREG 18 @@ -1745,6 +1769,11 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc, if (interp_info) { interp_info->other_info = info; sp = loader_build_fdpic_loadmap(interp_info, sp); + info->interpreter_loadmap_addr = interp_info->loadmap_addr; + info->interpreter_pt_dynamic_addr = interp_info->pt_dynamic_addr; + } else { + info->interpreter_loadmap_addr = 0; + info->interpreter_pt_dynamic_addr = 0; } } diff --git a/linux-user/qemu.h b/linux-user/qemu.h index da3b517..f8b9896 100644 --- a/linux-user/qemu.h +++ b/linux-user/qemu.h @@ -57,6 +57,8 @@ struct image_info { uint16_t nsegs; void *loadsegs; abi_ulong pt_dynamic_addr; + abi_ulong interpreter_loadmap_addr; + abi_ulong interpreter_pt_dynamic_addr; struct image_info *other_info; }; @@ -144,7 +146,6 @@ typedef struct TaskState { * from multiple threads.) */ int signal_pending; - } __attribute__((aligned(16))) TaskState; extern char *exec_path; @@ -182,6 +183,7 @@ abi_ulong loader_build_argptr(int envc, int argc, abi_ulong sp, int loader_exec(int fdexec, const char *filename, char **argv, char **envp, struct target_pt_regs * regs, struct image_info *infop, struct linux_binprm *); +int info_is_fdpic(struct image_info *info); uint32_t get_elf_eflags(int fd); int load_elf_binary(struct linux_binprm *bprm, struct image_info *info); From patchwork Tue Apr 24 07:28:08 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Christophe Lyon X-Patchwork-Id: 134056 Delivered-To: patch@linaro.org Received: by 10.46.151.6 with SMTP id r6csp1908608lji; Tue, 24 Apr 2018 00:30:57 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqQRVWsDhOibnRoGadZNZJArstI8sn2yLleCrzAbAmMa1hyBjSyJffpbvldEkZGCklJc/DO X-Received: by 10.55.51.207 with SMTP id z198mr24484615qkz.185.1524555057439; Tue, 24 Apr 2018 00:30:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524555057; cv=none; d=google.com; s=arc-20160816; b=pa2WWee6cyXmpxH6iSaaUCSZzSJqEtPYMDSdZHnXb/iT/nScJJRbjz0yUUJwpYhIjd 0i9SiCAO8sLbLWEMgOXAMsNUxsro3VjnRlbivqwZ4bMHJnxuPmXqZZoTHimfvHp575qP HaqnOj0CwLRet8b0UevpdCxK/Z0kjr9C/H45CSDcLKnOhxytN+a5JWk0W/QU8kebSFRT qC8lOtraAkVBkdoYHJ9sjlriiwmFCle/7aPxRyvrlZASpfWyA8A/gLYIlD+3mW9eRyqe m2AR7GUfFlNj3aZLJlB1pqotpMrMlATUMTkgcZo62GYy9zjdA8Hk2K30H11J4mCqWakR 1BZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject :content-transfer-encoding:mime-version:message-id:date:to:from :arc-authentication-results; bh=BYdS7ZAq5Rf90JjjtWKfKSyrciGqGVz4v1Cb8y9rOAM=; b=liVTeGbBkKLwKZZu5kTWxhNXzlvPEMaXC7YfNYnI0xWFJrRedHgL9C0BaulapPOqx7 bKd/VT+QZlAD0tYYMkt2x0aV5ZMAfpa+BGUDd5Bb5bQ1pda2Lg8yHNK7qypNskqA499H IfJ419K2vZFPooiwZ5YoOfq57o8gGC2rYAHJGIKZ4cgmqsU4xM13MMO2e/Skyp8V8XQp mRO9Uws1XTmhd1EnGEjmWUWOKaqrSbarxopRrC37uU04mu+XQjFPBUeOxED9D7/8AxtM TIF+6oRxKyDv6/kU/itivVf8vt3J4CdfT8rWSI6E2JtRfZsmxjZyWZHFSBm94oIlVVig vP6Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom=qemu-devel-bounces+patch=linaro.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id v73si4563136qkl.180.2018.04.24.00.30.57 for (version=TLS1 cipher=AES128-SHA bits=128/128); Tue, 24 Apr 2018 00:30:57 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom=qemu-devel-bounces+patch=linaro.org@nongnu.org Received: from localhost ([::1]:56953 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fAsPg-0004iK-VI for patch@linaro.org; Tue, 24 Apr 2018 03:30:56 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53007) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fAsNZ-0003fC-48 for qemu-devel@nongnu.org; Tue, 24 Apr 2018 03:28:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fAsNU-0004eu-0b for qemu-devel@nongnu.org; Tue, 24 Apr 2018 03:28:45 -0400 Received: from mx07-00178001.pphosted.com ([62.209.51.94]:45536) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fAsNT-0004cz-Jz for qemu-devel@nongnu.org; Tue, 24 Apr 2018 03:28:39 -0400 Received: from pps.filterd (m0046668.ppops.net [127.0.0.1]) by mx07-.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id w3O7SQIP007213; Tue, 24 Apr 2018 09:28:34 +0200 Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx07-00178001.pphosted.com with ESMTP id 2hftrwq0hw-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 24 Apr 2018 09:28:34 +0200 Received: from zeta.dmz-eu.st.com (zeta.dmz-eu.st.com [164.129.230.9]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 6CEB53D; Tue, 24 Apr 2018 07:28:32 +0000 (GMT) Received: from Webmail-eu.st.com (sfhdag5node1.st.com [10.75.127.13]) by zeta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 876AE10AC; Tue, 24 Apr 2018 07:28:32 +0000 (GMT) Received: from gnb.st.com (10.75.127.51) by SFHDAG5NODE1.st.com (10.75.127.13) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Tue, 24 Apr 2018 09:28:31 +0200 From: Christophe Lyon To: , , , , Date: Tue, 24 Apr 2018 09:28:08 +0200 Message-ID: <20180424072828.21699-1-christophe.lyon@st.com> X-Mailer: git-send-email 2.9.5 MIME-Version: 1.0 X-Originating-IP: [10.75.127.51] X-ClientProxiedBy: SFHDAG2NODE1.st.com (10.75.127.4) To SFHDAG5NODE1.st.com (10.75.127.13) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-04-24_01:, , signatures=0 X-MIME-Autoconverted: from 8bit to quoted-printable by mx07-.pphosted.com id w3O7SQIP007213 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 62.209.51.94 Subject: [Qemu-devel] [ARM/FDPIC v3 4/4] linux-user: ARM-FDPIC: Add support for signals for FDPIC targets X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" The FDPIC restorer needs to deal with a function descriptor, hence we have to extend 'retcode' such that it can hold the instructions needed to perform this. The restorer sequence uses the same thumbness as the exception handler (mainly to support Thumb-only architectures). Compared to v2: setup_return() now returns an error if the FDPIC function description isn't readable. Callers of setup_return() are updated to force_sigsegv in such cases. Co-Authored-By: Mickaël Guêné Signed-off-by: Christophe Lyon -- 2.6.3 Reviewed-by: Peter Maydell diff --git a/linux-user/signal.c b/linux-user/signal.c index 8d9e6e8..6dbc699 100644 --- a/linux-user/signal.c +++ b/linux-user/signal.c @@ -2045,13 +2045,13 @@ struct sigframe_v1 { struct target_sigcontext sc; abi_ulong extramask[TARGET_NSIG_WORDS-1]; - abi_ulong retcode; + abi_ulong retcode[4]; }; struct sigframe_v2 { struct target_ucontext_v2 uc; - abi_ulong retcode; + abi_ulong retcode[4]; }; struct rt_sigframe_v1 @@ -2060,14 +2060,14 @@ struct rt_sigframe_v1 abi_ulong puc; struct target_siginfo info; struct target_ucontext_v1 uc; - abi_ulong retcode; + abi_ulong retcode[4]; }; struct rt_sigframe_v2 { struct target_siginfo info; struct target_ucontext_v2 uc; - abi_ulong retcode; + abi_ulong retcode[4]; }; #define TARGET_CONFIG_CPU_32 1 @@ -2090,6 +2090,21 @@ static const abi_ulong retcodes[4] = { SWI_SYS_RT_SIGRETURN, SWI_THUMB_RT_SIGRETURN }; +/* + * Stub needed to make sure the FD register (r9) contains the right + * value. + */ +static const unsigned long sigreturn_fdpic_codes[3] = { + 0xe59fc004, /* ldr r12, [pc, #4] to read function descriptor */ + 0xe59c9004, /* ldr r9, [r12, #4] to setup GOT */ + 0xe59cf000 /* ldr pc, [r12] to jump into restorer */ +}; + +static const unsigned long sigreturn_fdpic_thumb_codes[3] = { + 0xc008f8df, /* ldr r12, [pc, #8] to read function descriptor */ + 0x9004f8dc, /* ldr r9, [r12, #4] to setup GOT */ + 0xf000f8dc /* ldr pc, [r12] to jump into restorer */ +}; static inline int valid_user_regs(CPUARMState *regs) { @@ -2143,13 +2158,33 @@ get_sigframe(struct target_sigaction *ka, CPUARMState *regs, int framesize) return (sp - framesize) & ~7; } -static void +static int setup_return(CPUARMState *env, struct target_sigaction *ka, abi_ulong *rc, abi_ulong frame_addr, int usig, abi_ulong rc_addr) { - abi_ulong handler = ka->_sa_handler; + abi_ulong handler = 0; + abi_ulong handler_fdpic_GOT = 0; abi_ulong retcode; - int thumb = handler & 1; + + int thumb; + int is_fdpic = info_is_fdpic(((TaskState *)thread_cpu->opaque)->info); + + if (is_fdpic) { + /* In FDPIC mode, ka->_sa_handler points to a function + * descriptor (FD). The first word contains the address of the + * handler. The second word contains the value of the PIC + * register (r9). */ + abi_ulong funcdesc_ptr = ka->_sa_handler; + if (get_user_ual(handler, funcdesc_ptr) + || get_user_ual(handler_fdpic_GOT, funcdesc_ptr + 4)) { + return 1; + } + } else { + handler = ka->_sa_handler; + } + + thumb = handler & 1; + uint32_t cpsr = cpsr_read(env); cpsr &= ~CPSR_IT; @@ -2160,7 +2195,28 @@ setup_return(CPUARMState *env, struct target_sigaction *ka, } if (ka->sa_flags & TARGET_SA_RESTORER) { - retcode = ka->sa_restorer; + if (is_fdpic) { + /* For FDPIC we ensure that the restorer is called with a + * correct r9 value. For that we need to write code on + * the stack that sets r9 and jumps back to restorer + * value. + */ + if (thumb) { + __put_user(sigreturn_fdpic_thumb_codes[0], rc); + __put_user(sigreturn_fdpic_thumb_codes[1], rc + 1); + __put_user(sigreturn_fdpic_thumb_codes[2], rc + 2); + __put_user((abi_ulong)ka->sa_restorer, rc + 3); + } else { + __put_user(sigreturn_fdpic_codes[0], rc); + __put_user(sigreturn_fdpic_codes[1], rc + 1); + __put_user(sigreturn_fdpic_codes[2], rc + 2); + __put_user((abi_ulong)ka->sa_restorer, rc + 3); + } + + retcode = rc_addr + thumb; + } else { + retcode = ka->sa_restorer; + } } else { unsigned int idx = thumb; @@ -2174,10 +2230,15 @@ setup_return(CPUARMState *env, struct target_sigaction *ka, } env->regs[0] = usig; + if (is_fdpic) { + env->regs[9] = handler_fdpic_GOT; + } env->regs[13] = frame_addr; env->regs[14] = retcode; env->regs[15] = handler & (thumb ? ~1 : ~3); cpsr_write(env, cpsr, CPSR_IT | CPSR_T, CPSRWriteByInstr); + + return 0; } static abi_ulong *setup_sigframe_v2_vfp(abi_ulong *regspace, CPUARMState *env) @@ -2270,12 +2331,15 @@ static void setup_frame_v1(int usig, struct target_sigaction *ka, __put_user(set->sig[i], &frame->extramask[i - 1]); } - setup_return(regs, ka, &frame->retcode, frame_addr, usig, - frame_addr + offsetof(struct sigframe_v1, retcode)); + if (setup_return(regs, ka, frame->retcode, frame_addr, usig, + frame_addr + offsetof(struct sigframe_v1, retcode))) { + goto sigsegv; + } unlock_user_struct(frame, frame_addr, 1); return; sigsegv: + unlock_user_struct(frame, frame_addr, 1); force_sigsegv(usig); } @@ -2292,12 +2356,15 @@ static void setup_frame_v2(int usig, struct target_sigaction *ka, setup_sigframe_v2(&frame->uc, set, regs); - setup_return(regs, ka, &frame->retcode, frame_addr, usig, - frame_addr + offsetof(struct sigframe_v2, retcode)); + if (setup_return(regs, ka, frame->retcode, frame_addr, usig, + frame_addr + offsetof(struct sigframe_v2, retcode))) { + goto sigsegv; + } unlock_user_struct(frame, frame_addr, 1); return; sigsegv: + unlock_user_struct(frame, frame_addr, 1); force_sigsegv(usig); } @@ -2347,8 +2414,10 @@ static void setup_rt_frame_v1(int usig, struct target_sigaction *ka, __put_user(set->sig[i], &frame->uc.tuc_sigmask.sig[i]); } - setup_return(env, ka, &frame->retcode, frame_addr, usig, - frame_addr + offsetof(struct rt_sigframe_v1, retcode)); + if (setup_return(env, ka, frame->retcode, frame_addr, usig, + frame_addr + offsetof(struct rt_sigframe_v1, retcode))) { + goto sigsegv; + } env->regs[1] = info_addr; env->regs[2] = uc_addr; @@ -2356,6 +2425,7 @@ static void setup_rt_frame_v1(int usig, struct target_sigaction *ka, unlock_user_struct(frame, frame_addr, 1); return; sigsegv: + unlock_user_struct(frame, frame_addr, 1); force_sigsegv(usig); } @@ -2378,8 +2448,10 @@ static void setup_rt_frame_v2(int usig, struct target_sigaction *ka, setup_sigframe_v2(&frame->uc, set, env); - setup_return(env, ka, &frame->retcode, frame_addr, usig, - frame_addr + offsetof(struct rt_sigframe_v2, retcode)); + if (setup_return(env, ka, frame->retcode, frame_addr, usig, + frame_addr + offsetof(struct rt_sigframe_v2, retcode))) { + goto sigsegv; + } env->regs[1] = info_addr; env->regs[2] = uc_addr; @@ -2387,6 +2459,7 @@ static void setup_rt_frame_v2(int usig, struct target_sigaction *ka, unlock_user_struct(frame, frame_addr, 1); return; sigsegv: + unlock_user_struct(frame, frame_addr, 1); force_sigsegv(usig); }