lkml.org 
[lkml]   [2017]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 46/59] arm64: uaccess: ensure extension of access_ok() addr
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Mark Rutland <mark.rutland@arm.com>

    commit a06040d7a791a9177581dcf7293941bd92400856 upstream.

    Our access_ok() simply hands its arguments over to __range_ok(), which
    implicitly assummes that the addr parameter is 64 bits wide. This isn't
    necessarily true for compat code, which might pass down a 32-bit address
    parameter.

    In these cases, we don't have a guarantee that the address has been zero
    extended to 64 bits, and the upper bits of the register may contain
    unknown values, potentially resulting in a suprious failure.

    Avoid this by explicitly casting the addr parameter to an unsigned long
    (as is done on other architectures), ensuring that the parameter is
    widened appropriately.

    Fixes: 0aea86a2176c ("arm64: User access library functions")
    Acked-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Mark Rutland <mark.rutland@arm.com>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/arm64/include/asm/uaccess.h | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/arch/arm64/include/asm/uaccess.h
    +++ b/arch/arm64/include/asm/uaccess.h
    @@ -89,11 +89,12 @@ static inline void set_fs(mm_segment_t f
    */
    #define __range_ok(addr, size) \
    ({ \
    + unsigned long __addr = (unsigned long __force)(addr); \
    unsigned long flag, roksum; \
    __chk_user_ptr(addr); \
    asm("adds %1, %1, %3; ccmp %1, %4, #2, cc; cset %0, ls" \
    : "=&r" (flag), "=&r" (roksum) \
    - : "1" (addr), "Ir" (size), \
    + : "1" (__addr), "Ir" (size), \
    "r" (current_thread_info()->addr_limit) \
    : "cc"); \
    flag; \

    \
     
     \ /
      Last update: 2017-05-23 23:10    [W:3.411 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site