From patchwork Thu Aug 1 08:16:20 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Viresh Kumar X-Patchwork-Id: 170341 Delivered-To: patch@linaro.org Received: by 2002:a92:512:0:0:0:0:0 with SMTP id q18csp5086785ile; Thu, 1 Aug 2019 01:21:12 -0700 (PDT) X-Google-Smtp-Source: APXvYqwgo1/mK5GxiH/O4vY7m6HvwaT4FLfLjcCqG9pEK2SHgZL2JcT4AHN5Dn3A9evXyf+ZQcvr X-Received: by 2002:a17:90a:6097:: with SMTP id z23mr7282037pji.75.1564647672431; Thu, 01 Aug 2019 01:21:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564647672; cv=none; d=google.com; s=arc-20160816; b=IgYBzylxGQ6ysRJPFqHY97wAmMVU906SMbPVJOCsynM8OSlGtWZfc3sG3UJnyfELU9 DVzNVvqGpFu6lKkxzNjXVleoQIc3WWIzKEGtypbpwhcDYczgtgXdF2Roe0olc4b6kSc4 ul85L956HPSz/xb/fdEZ6aHMRFYAv+7N5XvmCExiublJV6VJ+zC5T/zHq97Qo8yka2vO cMFVyCxen/Tf3PmhvgeXIKwn7FFg840jNiwaynufV8V4ZrQwR5YoIcFqYpFKalV2Aw1t EmwZwM3jyRhk1fkgtl+cEOu3ehwqC6MncL0vx76SCaJrek14B7xg1E1lPAcKSADpboUw B8LA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=K9TMbtUgLTyiUr1AVMR6X3v/Vfqpdps5jv4IrzU02gI=; b=JQlscMHMB+L4jV0MyShA4067n6NH7sbF0xugft5q+p0jAB848jrWEdu0/E3q8NFePw 7ZcFdnTbuSKW4IRPHhEGgHsKGBIwjObAUisk8b9Qn2+tMp0IBl3NadgRkZO9P/O1HHMP mhhorN1gMyTKMyzm7xYacuWTI6xqSCyelvTZcbBzOuw7UK7uFIdF/sKJ6cyzuZ1ab/lk qDVOkEjax31gQdKiopruEFMXKk0L6rwnGbwrmlxY0g+bi+rWz+KE5KIeIW0F+TlnuJY7 ZwJG1hKIoKxakPK83rQlx/3I9PaNqjGmt+GMxyXGtbPOr+qmMKvrm2lX0Ep5kkw1dCNK NMrw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=u2IY36x0; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z13si4013236pgj.476.2019.08.01.01.21.12; Thu, 01 Aug 2019 01:21:12 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=u2IY36x0; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731138AbfHAIVK (ORCPT + 14 others); Thu, 1 Aug 2019 04:21:10 -0400 Received: from mail-pf1-f194.google.com ([209.85.210.194]:42886 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731106AbfHAIVJ (ORCPT ); Thu, 1 Aug 2019 04:21:09 -0400 Received: by mail-pf1-f194.google.com with SMTP id q10so33593416pff.9 for ; Thu, 01 Aug 2019 01:21:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=K9TMbtUgLTyiUr1AVMR6X3v/Vfqpdps5jv4IrzU02gI=; b=u2IY36x0captMh4lU1M0wOFOAmston0O2MSPdh8WfOWDhEl6wCe1fHWEB302u0RLea ojVO3+6Uw8ngcEcpYwUKq96/4ZNyKwEJSwrmqBpTewb+1cTQJdgIBsGPrIcskcI3D/WE 5Eg2rHSAqdcoxT2Rx0APBgbNWmChW6h+Ch+VfBXwjDUY8xtjNpJh8eZCmXoMtYQOIAnB KDRBkaRJKx2tqjYEejnBltvZKwg1B+mta/JF1UVSfxbYY86SwBJDW+O9haVVpEQ7x9Ou qnTAXeFV4PukhvZIY1cb0Nqw3H7EhNmjHszAQmsiggMC3v6tFdCB8MczrpQKPRwPqCdj P4SQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=K9TMbtUgLTyiUr1AVMR6X3v/Vfqpdps5jv4IrzU02gI=; b=uXREeHs3nbu4pznBONM1vCUnuJwPMyFItWVzFgIA7+sM0v3LsQMbduxGJTh/ASIrju oqhtmWiqPXKU26PsGIJQ9Boz0088rj9EvaQ+BzJq0k9jQt1RUQdUsqDk4SJnJXXMMmig nx6AYVba8FQd8IKn4gqFwXecwe/grpYhvzTyVw6kLSRfCaiIOm7x0xQoYPaZ1RCkN4Q+ vK9QB5+qKrpNpg9tAN4h6ZxlKJ3p77MvU+Ho+vZTfAsPahlN7u2DRqqV9Hv4wmzUPrzg mU1t8UO6akQnkZnAdkWE3/Bdn4XXIO3Uv2a/490gE4k6Lfc+YqHjATmcBow7Eoogb1mA VJGg== X-Gm-Message-State: APjAAAXCHCwgAARu3kiPMqabgyedaEp7f89QZld20+2yad1iT5GB7u19 x0P21EOz6Z6R9/0JNjtwzT6Cz/g1QWs= X-Received: by 2002:a62:e901:: with SMTP id j1mr52916707pfh.189.1564647668335; Thu, 01 Aug 2019 01:21:08 -0700 (PDT) Received: from localhost ([122.172.28.117]) by smtp.gmail.com with ESMTPSA id y194sm47244254pfg.116.2019.08.01.01.21.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 01 Aug 2019 01:21:07 -0700 (PDT) From: Viresh Kumar To: stable@vger.kernel.org Cc: Viresh Kumar , Julien Thierry , linux-arm-kernel@lists.infradead.org, Catalin Marinas , Marc Zyngier , Mark Rutland , Will Deacon , Russell King , Vincent Guittot , mark.brown@arm.com, guohanjun@huawei.com Subject: [PATCH ARM32 v4.4 V2 36/47] ARM: 8797/1: spectre-v1.1: harden __copy_to_user Date: Thu, 1 Aug 2019 13:46:20 +0530 Message-Id: X-Mailer: git-send-email 2.21.0.rc0.269.g1a574e7a288b In-Reply-To: References: MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Julien Thierry Commit a1d09e074250fad24f1b993f327b18cc6812eb7a upstream. Sanitize user pointer given to __copy_to_user, both for standard version and memcopy version of the user accessor. Signed-off-by: Julien Thierry Signed-off-by: Russell King Signed-off-by: Viresh Kumar --- arch/arm/lib/copy_to_user.S | 6 +++++- arch/arm/lib/uaccess_with_memcpy.c | 3 ++- 2 files changed, 7 insertions(+), 2 deletions(-) -- 2.21.0.rc0.269.g1a574e7a288b diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S index caf5019d8161..970abe521197 100644 --- a/arch/arm/lib/copy_to_user.S +++ b/arch/arm/lib/copy_to_user.S @@ -94,6 +94,11 @@ ENTRY(__copy_to_user_std) WEAK(arm_copy_to_user) +#ifdef CONFIG_CPU_SPECTRE + get_thread_info r3 + ldr r3, [r3, #TI_ADDR_LIMIT] + uaccess_mask_range_ptr r0, r2, r3, ip +#endif #include "copy_template.S" @@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std) rsb r0, r0, r2 copy_abort_end .popsection - diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c index 588bbc288396..0b4fe892d00b 100644 --- a/arch/arm/lib/uaccess_with_memcpy.c +++ b/arch/arm/lib/uaccess_with_memcpy.c @@ -153,7 +153,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n) n = __copy_to_user_std(to, from, n); uaccess_restore(ua_flags); } else { - n = __copy_to_user_memcpy(to, from, n); + n = __copy_to_user_memcpy(uaccess_mask_range_ptr(to, n), + from, n); } return n; }