diff options
| author | Russell King <rmk+kernel@armlinux.org.uk> | 2021-01-29 10:19:07 +0000 |
|---|---|---|
| committer | Carlos Llamas <cmllamas@google.com> | 2021-10-29 14:09:29 -0700 |
| commit | 839523fca2efc7b0ccdc24fba1b28c4a67bc1c7d (patch) | |
| tree | 59c4e2855c3ca713200490feb28f243d4602994c | |
| parent | a7378d1307f39b4765b8dfae6f35d48e453e350c (diff) | |
| download | goldfish-android-3.18.tar.gz | |
ARM: ensure the signal page contains defined contentsandroid-3.18
commit 9c698bff66ab4914bb3d71da7dc6112519bde23e upstream.
Ensure that the signal page contains our poison instruction to increase
the protection against ROP attacks and also contains well defined
contents.
Bug: 197850306
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 8db77dca7e1d1d1d6aa9334207ead57853832bb7)
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: I018db4646b4ed3a04497f8bd512a78289b0ad85c
| -rw-r--r-- | arch/arm/kernel/signal.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c index b2e21192d873..2514d60581e7 100644 --- a/arch/arm/kernel/signal.c +++ b/arch/arm/kernel/signal.c @@ -629,18 +629,20 @@ struct page *get_signal_page(void) addr = page_address(page); + /* Poison the entire page */ + memset32(addr, __opcode_to_mem_arm(0xe7fddef1), + PAGE_SIZE / sizeof(u32)); + /* Give the signal return code some randomness */ offset = 0x200 + (get_random_int() & 0x7fc); signal_return_offset = offset; - /* - * Copy signal return handlers into the vector page, and - * set sigreturn to be a pointer to these. - */ + /* Copy signal return handlers into the page */ memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes)); - ptr = (unsigned long)addr + offset; - flush_icache_range(ptr, ptr + sizeof(sigreturn_codes)); + /* Flush out all instructions in this page */ + ptr = (unsigned long)addr; + flush_icache_range(ptr, ptr + PAGE_SIZE); return page; } |