diff --git a/debian/patches/bugfix/arm/arm-7851-1-check-for-number-of-arguments-in-syscall_get-set_arguments.patch b/debian/patches/bugfix/arm/arm-7851-1-check-for-number-of-arguments-in-syscall_get-set_arguments.patch new file mode 100644 index 000000000..4b33389dd --- /dev/null +++ b/debian/patches/bugfix/arm/arm-7851-1-check-for-number-of-arguments-in-syscall_get-set_arguments.patch @@ -0,0 +1,53 @@ +From 3c1532df5c1b54b5f6246cdef94eeb73a39fe43a Mon Sep 17 00:00:00 2001 +From: AKASHI Takahiro +Date: Wed, 9 Oct 2013 15:58:29 +0100 +Subject: ARM: 7851/1: check for number of arguments in syscall_get/set_arguments() + +From: AKASHI Takahiro + +commit 3c1532df5c1b54b5f6246cdef94eeb73a39fe43a upstream. + +In ftrace_syscall_enter(), + syscall_get_arguments(..., 0, n, ...) + if (i == 0) { ...; n--;} + memcpy(..., n * sizeof(args[0])); +If 'number of arguments(n)' is zero and 'argument index(i)' is also zero in +syscall_get_arguments(), none of arguments should be copied by memcpy(). +Otherwise 'n--' can be a big positive number and unexpected amount of data +will be copied. Tracing system calls which take no argument, say sync(void), +may hit this case and eventually make the system corrupted. +This patch fixes the issue both in syscall_get_arguments() and +syscall_set_arguments(). + +Acked-by: Will Deacon +Signed-off-by: AKASHI Takahiro +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/syscall.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/arm/include/asm/syscall.h ++++ b/arch/arm/include/asm/syscall.h +@@ -57,6 +57,9 @@ static inline void syscall_get_arguments + unsigned int i, unsigned int n, + unsigned long *args) + { ++ if (n == 0) ++ return; ++ + if (i + n > SYSCALL_MAX_ARGS) { + unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i; + unsigned int n_bad = n + i - SYSCALL_MAX_ARGS; +@@ -81,6 +84,9 @@ static inline void syscall_set_arguments + unsigned int i, unsigned int n, + const unsigned long *args) + { ++ if (n == 0) ++ return; ++ + if (i + n > SYSCALL_MAX_ARGS) { + pr_warning("%s called with max args %d, handling only %d\n", + __func__, i + n, SYSCALL_MAX_ARGS);