powerpc: Fix random memory corruption in merged elf.h

The merged verison of ELF_CORE_COPY_REGS is basically the PPC64 version, with
a memset that came from PPC and a few types abstracted out into #defines. But
it's not _quite_ right.

The first problem is we calculate the number of registers with:
        nregs = sizeof(struct pt_regs) / sizeof(ELF_GREG_TYPE)

For a 32-bit process on a 64-bit kernel that's bogus because the registers are
64 bits, but ELF_GREG_TYPE is u32, so nregs == 88 which is wrong.

The other problem is the memset, which assumes a struct pt_regs is smaller
than a struct elf_regs. For a 32-bit process on a 64-bit kernel that's false.

The fix is to calculate the number of regs using sizeof(unsigned long), which
should always be right, and just memset the whole damn thing _before_ copying
the registers in.

Signed-off-by: Michael Ellerman <michael@ellerman.id.au>

diff --git a/include/asm-powerpc/elf.h b/include/asm-powerpc/elf.h
index d22b10021b5d19bf2b46e9d1f83b2f8c0a324cd6..d140577d0a05b4cd4ff62becef0de5677b810876 100644 (file)
--- a/include/asm-powerpc/elf.h
+++ b/include/asm-powerpc/elf.h
@@ -178,18 +178,22 @@ typedef elf_vrreg_t elf_vrregset_t32[ELF_NVRREG32];
 static inline void ppc_elf_core_copy_regs(elf_gregset_t elf_regs,
                                            struct pt_regs *regs)
 {
-       int i;
-       int gprs = sizeof(struct pt_regs)/sizeof(ELF_GREG_TYPE);
+       int i, nregs;
 
-       if (gprs > ELF_NGREG)
-               gprs = ELF_NGREG;
+       memset((void *)elf_regs, 0, sizeof(elf_gregset_t));
 
-       for (i=0; i < gprs; i++)
-               elf_regs[i] = (elf_greg_t)((ELF_GREG_TYPE *)regs)[i];
-
-       memset((char *)(elf_regs) + sizeof(struct pt_regs), 0,          \
-              sizeof(elf_gregset_t) - sizeof(struct pt_regs));
+       /* Our registers are always unsigned longs, whether we're a 32 bit
+        * process or 64 bit, on either a 64 bit or 32 bit kernel.
+        * Don't use ELF_GREG_TYPE here. */
+       nregs = sizeof(struct pt_regs) / sizeof(unsigned long);
+       if (nregs > ELF_NGREG)
+               nregs = ELF_NGREG;
 
+       for (i = 0; i < nregs; i++) {
+               /* This will correctly truncate 64 bit registers to 32 bits
+                * for a 32 bit process on a 64 bit kernel. */
+               elf_regs[i] = (elf_greg_t)((ELF_GREG_TYPE *)regs)[i];
+       }
 }
 #define ELF_CORE_COPY_REGS(gregs, regs) ppc_elf_core_copy_regs(gregs, regs);