{"push_id":1030373680,"size":1,"distinct_size":1,"ref":"refs/heads/ci20-v3.18","head":"fbf929bc733b82b15f6996d4262a45870f19d214","before":"cdca433c70b6600a0f6cd7898f21492d3903d4b0","commits":[{"sha":"fbf929bc733b82b15f6996d4262a45870f19d214","author":{"email":"547fa85bb3888a0222eed8ec39e36708605c6d53@imgtec.com","name":"James Hogan"},"message":"MIPS: Fix buffer overflow in syscall_get_arguments()\n\nSince commit 4c21b8fd8f14 (\"MIPS: seccomp: Handle indirect system calls\n(o32)\"), syscall_get_arguments() attempts to handle o32 indirect syscall\narguments by incrementing both the start argument number and the number\nof arguments to fetch. However only the start argument number needs to\nbe incremented. The number of arguments does not change, they're just\nshifted up by one, and in fact the output array is provided by the\ncaller and is likely only n entries long, so reading more arguments\noverflows the output buffer.\n\nIn the case of seccomp, this results in it fetching 7 arguments starting\nat the 2nd one, which overflows the unsigned long args[6] in\npopulate_seccomp_data(). This clobbers the $s0 register from\nsyscall_trace_enter() which __seccomp_phase1_filter() saved onto the\nstack, into which syscall_trace_enter() had placed its syscall number\nargument. This caused Chromium to crash.\n\nCredit goes to Milko for tracking it down as far as $s0 being clobbered.\n\nFixes: 4c21b8fd8f14 (\"MIPS: seccomp: Handle indirect system calls (o32)\")\nReported-by: Milko Leporis <milko.leporis@imgtec.com>\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nCc: linux-mips@linux-mips.org\nCc: <stable@vger.kernel.org> # 3.15-\nPatchwork: https://patchwork.linux-mips.org/patch/12213/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\n(cherry picked from commit f4dce1ffd2e30fa31756876ef502ce6d2324be35)","distinct":true,"url":"https://api.github.com/repos/MIPS/CI20_linux/commits/fbf929bc733b82b15f6996d4262a45870f19d214"}]}