lkml.org 
[lkml]   [2019]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 08/16] ARM: 8797/1: spectre-v1.1: harden __copy_to_user
    Date
    From: Julien Thierry <julien.thierry@arm.com>

    Commit a1d09e074250fad24f1b993f327b18cc6812eb7a upstream.

    Sanitize user pointer given to __copy_to_user, both for standard version
    and memcopy version of the user accessor.

    Signed-off-by: Julien Thierry <julien.thierry@arm.com>
    Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
    Signed-off-by: David A. Long <dave.long@linaro.org>
    ---
    arch/arm/lib/copy_to_user.S | 6 +++++-
    arch/arm/lib/uaccess_with_memcpy.c | 3 ++-
    2 files changed, 7 insertions(+), 2 deletions(-)

    diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
    index caf5019d8161..970abe521197 100644
    --- a/arch/arm/lib/copy_to_user.S
    +++ b/arch/arm/lib/copy_to_user.S
    @@ -94,6 +94,11 @@

    ENTRY(__copy_to_user_std)
    WEAK(arm_copy_to_user)
    +#ifdef CONFIG_CPU_SPECTRE
    + get_thread_info r3
    + ldr r3, [r3, #TI_ADDR_LIMIT]
    + uaccess_mask_range_ptr r0, r2, r3, ip
    +#endif

    #include "copy_template.S"

    @@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std)
    rsb r0, r0, r2
    copy_abort_end
    .popsection
    -
    diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
    index 6bd1089b07e0..f598d792bace 100644
    --- a/arch/arm/lib/uaccess_with_memcpy.c
    +++ b/arch/arm/lib/uaccess_with_memcpy.c
    @@ -152,7 +152,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
    n = __copy_to_user_std(to, from, n);
    uaccess_restore(ua_flags);
    } else {
    - n = __copy_to_user_memcpy(to, from, n);
    + n = __copy_to_user_memcpy(uaccess_mask_range_ptr(to, n),
    + from, n);
    }
    return n;
    }
    --
    2.17.1
    \
     
     \ /
      Last update: 2019-02-14 15:51    [W:3.608 / U:0.244 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site