Merge branch 'regset' (PTRACE_SETREGSET data leakage)

[linux-2.6-microblaze.git] / arch / metag / kernel / ptrace.c

diff --git a/arch/metag/kernel/ptrace.c b/arch/metag/kernel/ptrace.c
index 5fd16ee..e615603 100644 (file)
--- a/arch/metag/kernel/ptrace.c
+++ b/arch/metag/kernel/ptrace.c
@@ -26,6 +26,16 @@
  * user_regset definitions.
  */
 
+static unsigned long user_txstatus(const struct pt_regs *regs)
+{
+       unsigned long data = (unsigned long)regs->ctx.Flags;
+
+       if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
+               data |= USER_GP_REGS_STATUS_CATCH_BIT;
+
+       return data;
+}
+
 int metag_gp_regs_copyout(const struct pt_regs *regs,
                          unsigned int pos, unsigned int count,
                          void *kbuf, void __user *ubuf)
@@ -64,9 +74,7 @@ int metag_gp_regs_copyout(const struct pt_regs *regs,
        if (ret)
                goto out;
        /* TXSTATUS */
-       data = (unsigned long)regs->ctx.Flags;
-       if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
-               data |= USER_GP_REGS_STATUS_CATCH_BIT;
+       data = user_txstatus(regs);
        ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
                                  &data, 4*25, 4*26);
        if (ret)
@@ -121,6 +129,7 @@ int metag_gp_regs_copyin(struct pt_regs *regs,
        if (ret)
                goto out;
        /* TXSTATUS */
+       data = user_txstatus(regs);
        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                 &data, 4*25, 4*26);
        if (ret)
@@ -246,6 +255,8 @@ int metag_rp_state_copyin(struct pt_regs *regs,
        unsigned long long *ptr;
        int ret, i;
 
+       if (count < 4*13)
+               return -EINVAL;
        /* Read the entire pipeline before making any changes */
        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                 &rp, 0, 4*13);
@@ -305,7 +316,7 @@ static int metag_tls_set(struct task_struct *target,
                        const void *kbuf, const void __user *ubuf)
 {
        int ret;
-       void __user *tls;
+       void __user *tls = target->thread.tls_ptr;
 
        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
        if (ret)