lkml.org 
[lkml]   [2017]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 07/67] arm64: ensure __dump_instr() checks addr_limit
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Mark Rutland <mark.rutland@arm.com>

    commit 7a7003b1da010d2b0d1dc8bf21c10f5c73b389f1 upstream.

    It's possible for a user to deliberately trigger __dump_instr with a
    chosen kernel address.

    Let's avoid problems resulting from this by using get_user() rather than
    __get_user(), ensuring that we don't erroneously access kernel memory.

    Where we use __dump_instr() on kernel text, we already switch to
    KERNEL_DS, so this shouldn't adversely affect those cases.

    Fixes: 60ffc30d5652810d ("arm64: Exception handling")
    Acked-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Mark Rutland <mark.rutland@arm.com>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/arm64/kernel/traps.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/arch/arm64/kernel/traps.c
    +++ b/arch/arm64/kernel/traps.c
    @@ -112,7 +112,7 @@ static void __dump_instr(const char *lvl
    for (i = -4; i < 1; i++) {
    unsigned int val, bad;

    - bad = __get_user(val, &((u32 *)addr)[i]);
    + bad = get_user(val, &((u32 *)addr)[i]);

    if (!bad)
    p += sprintf(p, i == 0 ? "(%08x) " : "%08x ", val);

    \
     
     \ /
      Last update: 2017-11-06 11:12    [W:4.222 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site