From patchwork Thu Mar 1 12:53:52 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Shi X-Patchwork-Id: 130225 Delivered-To: patch@linaro.org Received: by 10.80.172.228 with SMTP id x91csp2773384edc; Thu, 1 Mar 2018 05:06:31 -0800 (PST) X-Google-Smtp-Source: AG47ELsCQJ2mzNuEmVGyXZ9uQRfdZysHCI0bLCh71QlBkfmakwXLhvKungbiANq+KWJjHJE7bXzi X-Received: by 10.99.154.73 with SMTP id e9mr1489935pgo.26.1519909591084; Thu, 01 Mar 2018 05:06:31 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519909591; cv=none; d=google.com; s=arc-20160816; b=Gz13cw9+bUE4km9UT8bfNyBph0yBEAD/IlS1P5nnbs7TpeHkzD34hIfdqNCU/xp1kD 9yte09gWCpFLV4JFcybUrw+NyhBo3axKOLXIg/MPM5kyPtwO84s8RE8tKnBXivPgnBfD MklBwHLv14SssAc94jWdw48Jokkgq1alt9i7lXY/dt3Sh0n+MNPTlwHX4FPrQuE9ULWq 3YtVh212a8o/aIHFuWCmPiiedsptZZZMKGlJGU6jVsj+SB9l006HwuWUV1jVcZuAtwuZ QtD1JkLHzfPMjvAE5wli5ECElTJLLk1ZCTg3Faxk8csiGhfcThgR64hEHKbV0HJh8XId YFSw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=v4D/ryQu43SY8kOi0wmbmZowM0pzF7fHoEsCU0j3u2A=; b=PjT5RGC1LP13W1h7YIGMfeccKrjsm3Yq7IF0Uozzf3665WVrPeUHzfedN9OzbLkBei VSZy9R8EnzXLkPpQqspsxO52fY9Q2Yx3ClyKcK97YLSjAfQdYU3o9hD1cReJgMCTOk1J jkrGd4RvisghvVOFDkVlYbFm4p6+OUxnpN2ovJC1UpqTmwAFJRxKKwdFnO1SAMbkX/JK 3vK8G62bMlZg6MamrY41Fi44dL0tKiEGnbMCeO2ZoPAb2+aQxWmHI0KkkxMA9CcQ3loS QFgqLMK8C8qj6L10RcZL06mZJlAObNO3oUiYDWynft0+S0SosT26BFzUnhhPQ8nNqMm9 UChA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=BqtU3wG2; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 2-v6si3067128ple.387.2018.03.01.05.06.30; Thu, 01 Mar 2018 05:06:31 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=BqtU3wG2; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030864AbeCANG0 (ORCPT + 10 others); Thu, 1 Mar 2018 08:06:26 -0500 Received: from mail-pl0-f65.google.com ([209.85.160.65]:40946 "EHLO mail-pl0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1030801AbeCAM5K (ORCPT ); Thu, 1 Mar 2018 07:57:10 -0500 Received: by mail-pl0-f65.google.com with SMTP id i6-v6so3586317plt.7 for ; Thu, 01 Mar 2018 04:57:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=v4D/ryQu43SY8kOi0wmbmZowM0pzF7fHoEsCU0j3u2A=; b=BqtU3wG2bgy4vwTLvIJC/bT1CEyjcPyP7sFXO2ipd6ozJKn7BQdoeHZauBElg4sgCV 6cMrUeNEuoOMLWIHcQfgeRVaVH+EWTO1Hadw7n3fsn6sXUGZU3wu8rGpqHE2LuuYA4a7 /T9B6WH9ITb7NTrmkLZ5lRHBW34k/jGhZgPUs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=v4D/ryQu43SY8kOi0wmbmZowM0pzF7fHoEsCU0j3u2A=; b=V7yf93gebgZqeWNz13kS9x7JXa3hCQU80l0u3QE/3HVGBUNQK1ociBqYnlrnEVYxpR nlFl2Z7FuxJ4EusJ2StP+a3dJwCK09A/wX5NIYvS+eTPfA2UuUCgEIc+wnIjgmznM+FG RV3bA6LcC74In8/jIRSkxdq60JgtswfsEOBSNgv2ZBU6U3gmpqjsLzy96dh5qIBSjQfo AUCuMt+ROA9iVkRQUIDYoZuU8BR0Y4fKyk/ESgipXDAhQDVIty9fUwTT00OtMtjGu9CM mUSOQex6tLLmrw8eDfCQWjp7nQBePc5zvEl416623HYID0pibnlVegqTxqeqYkY+lwT5 tf6A== X-Gm-Message-State: APf1xPC7JOvY3/0dC3x69qu66kDlhJAAh/GvcpMrYq3rgOSbC88uR7zV MjXACt4UxkSpmMDJ6JfLrYEjvM40j8E= X-Received: by 2002:a17:902:9a98:: with SMTP id w24-v6mr1827619plp.188.1519909029401; Thu, 01 Mar 2018 04:57:09 -0800 (PST) Received: from localhost.localdomain (176.122.172.82.16clouds.com. [176.122.172.82]) by smtp.gmail.com with ESMTPSA id x4sm2289655pfb.46.2018.03.01.04.57.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 01 Mar 2018 04:57:08 -0800 (PST) From: Alex Shi To: Marc Zyngier , Will Deacon , Ard Biesheuvel , Catalin Marinas , stable@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: Alex Shi Subject: [PATCH 15/45] arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user Date: Thu, 1 Mar 2018 20:53:52 +0800 Message-Id: <1519908862-11425-16-git-send-email-alex.shi@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519908862-11425-1-git-send-email-alex.shi@linaro.org> References: <1519908862-11425-1-git-send-email-alex.shi@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Will Deacon Rewritting from commit f71c2ffcb20d upstream. On LTS 4.9, there has no raw_copy_from/to_user, neither __copy_user_flushcache, and it isn't good idead to pick up them. The following is origin commit log, that's also applicable for the new patch. Like we've done for get_user and put_user, ensure that user pointers are masked before invoking the underlying __arch_{clear,copy_*}_user operations. Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas Signed-off-by: Alex Shi --- arch/arm64/include/asm/uaccess.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) -- 2.7.4 diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index ffa4e39..fbf4ce4 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -357,14 +357,14 @@ static inline unsigned long __must_check __copy_from_user(void *to, const void _ { kasan_check_write(to, n); check_object_size(to, n, false); - return __arch_copy_from_user(to, from, n); + return __arch_copy_from_user(to, __uaccess_mask_ptr(from), n); } static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n) { kasan_check_read(from, n); check_object_size(from, n, true); - return __arch_copy_to_user(to, from, n); + return __arch_copy_to_user(__uaccess_mask_ptr(to), from, n); } static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) @@ -374,7 +374,7 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u check_object_size(to, n, false); if (access_ok(VERIFY_READ, from, n)) { - res = __arch_copy_from_user(to, from, n); + res = __arch_copy_from_user(to, __uaccess_mask_ptr(from), n); } if (unlikely(res)) memset(to + (n - res), 0, res); @@ -387,7 +387,7 @@ static inline unsigned long __must_check copy_to_user(void __user *to, const voi check_object_size(from, n, true); if (access_ok(VERIFY_WRITE, to, n)) { - n = __arch_copy_to_user(to, from, n); + n = __arch_copy_to_user(__uaccess_mask_ptr(to), from, n); } return n; } @@ -395,7 +395,7 @@ static inline unsigned long __must_check copy_to_user(void __user *to, const voi static inline unsigned long __must_check copy_in_user(void __user *to, const void __user *from, unsigned long n) { if (access_ok(VERIFY_READ, from, n) && access_ok(VERIFY_WRITE, to, n)) - n = __copy_in_user(to, from, n); + n = __copy_in_user(__uaccess_mask_ptr(to), __uaccess_mask_ptr(from), n); return n; }