leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ARM: 8657/1: uaccess: consistently check object sizes

Browse Source 
In commit 76624175dc ("arm64: uaccess: consistently check object sizes"),
the object size checks are moved outside the access_ok() so that bad
destinations are detected before hitting the "memset(dest, 0, size)" in the
copy_from_user() failure path.

This makes the same change for arm, with attention given to possibly
extracting the uaccess routines into a common header file for all
architectures in the future.

Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
This commit is contained in:
Kees Cook 2017-02-16 01:43:58 +01:00 committed by Russell King
parent 228dbbfb5d
commit 32b143637e
1 changed files with 32 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
arch/arm/include/asm/uaccess.h
View File

@ -478,11 +478,10 @@ extern unsigned long __must_check
arm_copy_from_user(void *to, const void __user *from, unsigned long n); arm_copy_from_user(void *to, const void __user *from, unsigned long n);
static inline unsigned long __must_check static inline unsigned long __must_check
__copy_from_user(void *to, const void __user *from, unsigned long n) __arch_copy_from_user(void *to, const void __user *from, unsigned long n)
{ {
unsigned int __ua_flags; unsigned int __ua_flags;
check_object_size(to, n, false);
__ua_flags = uaccess_save_and_enable(); __ua_flags = uaccess_save_and_enable();
n = arm_copy_from_user(to, from, n); n = arm_copy_from_user(to, from, n);
uaccess_restore(__ua_flags); uaccess_restore(__ua_flags);
@ -495,18 +494,15 @@ extern unsigned long __must_check
__copy_to_user_std(void __user *to, const void *from, unsigned long n); __copy_to_user_std(void __user *to, const void *from, unsigned long n);
static inline unsigned long __must_check static inline unsigned long __must_check
__copy_to_user(void __user *to, const void *from, unsigned long n) __arch_copy_to_user(void __user *to, const void *from, unsigned long n)
{ {
#ifndef CONFIG_UACCESS_WITH_MEMCPY #ifndef CONFIG_UACCESS_WITH_MEMCPY
unsigned int __ua_flags; unsigned int __ua_flags;
check_object_size(from, n, true);
__ua_flags = uaccess_save_and_enable(); __ua_flags = uaccess_save_and_enable();
n = arm_copy_to_user(to, from, n); n = arm_copy_to_user(to, from, n);
uaccess_restore(__ua_flags); uaccess_restore(__ua_flags);
return n; return n;
#else #else
check_object_size(from, n, true);
return arm_copy_to_user(to, from, n); return arm_copy_to_user(to, from, n);
#endif #endif
} }
@ -526,25 +522,49 @@ __clear_user(void __user *addr, unsigned long n)
} }
#else #else
#define __copy_from_user(to, from, n) (memcpy(to, (void __force *)from, n), 0) #define __arch_copy_from_user(to, from, n) \
#define __copy_to_user(to, from, n) (memcpy((void __force *)to, from, n), 0) (memcpy(to, (void __force *)from, n), 0)
#define __arch_copy_to_user(to, from, n) \
(memcpy((void __force *)to, from, n), 0)
#define __clear_user(addr, n) (memset((void __force *)addr, 0, n), 0) #define __clear_user(addr, n) (memset((void __force *)addr, 0, n), 0)
#endif #endif
static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) static inline unsigned long __must_check
__copy_from_user(void *to, const void __user *from, unsigned long n)
{
check_object_size(to, n, false);
return __arch_copy_from_user(to, from, n);
}
static inline unsigned long __must_check
copy_from_user(void *to, const void __user *from, unsigned long n)
{ {
unsigned long res = n; unsigned long res = n;
check_object_size(to, n, false);
if (likely(access_ok(VERIFY_READ, from, n))) if (likely(access_ok(VERIFY_READ, from, n)))
res = __copy_from_user(to, from, n); res = __arch_copy_from_user(to, from, n);
if (unlikely(res)) if (unlikely(res))
memset(to + (n - res), 0, res); memset(to + (n - res), 0, res);
return res; return res;
} }
static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n) static inline unsigned long __must_check
__copy_to_user(void __user *to, const void *from, unsigned long n)
{ {
check_object_size(from, n, true);
return __arch_copy_to_user(to, from, n);
}
static inline unsigned long __must_check
copy_to_user(void __user *to, const void *from, unsigned long n)
{
check_object_size(from, n, true);
if (access_ok(VERIFY_WRITE, to, n)) if (access_ok(VERIFY_WRITE, to, n))
n = __copy_to_user(to, from, n); n = __arch_copy_to_user(to, from, n);
return n; return n;
} }