From affb1a50b95b0d523868db759038bb0ff915a906 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 8 Jul 2022 20:45:32 +0530 Subject: [PATCH] linux-user/aarch64: Do not allow duplicate or short sve records In parse_user_sigframe, the kernel rejects duplicate sve records, or records that are smaller than the header. We were silently allowing these cases to pass, dropping the record. Reviewed-by: Peter Maydell Signed-off-by: Richard Henderson Message-id: 20220708151540.18136-38-richard.henderson@linaro.org Signed-off-by: Peter Maydell --- linux-user/aarch64/signal.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/linux-user/aarch64/signal.c b/linux-user/aarch64/signal.c index 8b352abb97..8fbe98d72f 100644 --- a/linux-user/aarch64/signal.c +++ b/linux-user/aarch64/signal.c @@ -318,10 +318,13 @@ static int target_restore_sigframe(CPUARMState *env, break; case TARGET_SVE_MAGIC: + if (sve || size < sizeof(struct target_sve_context)) { + goto err; + } if (cpu_isar_feature(aa64_sve, env_archcpu(env))) { vq = sve_vq(env); sve_size = QEMU_ALIGN_UP(TARGET_SVE_SIG_CONTEXT_SIZE(vq), 16); - if (!sve && size == sve_size) { + if (size == sve_size) { sve = (struct target_sve_context *)ctx; break; }