linux/arch/x86/lib
Linus Torvalds d869844bd0 x86: fix special __probe_kernel_write() tail zeroing case
Commit cae2a173fe ("x86: clean up/fix 'copy_in_user()' tail zeroing")
fixed the failure case tail zeroing of one special case of the x86-64
generic user-copy routine, namely when used for the user-to-user case
("copy_in_user()").

But in the process it broke an even more unusual case: using the user
copy routine for kernel-to-kernel copying.

Now, normally kernel-kernel copies are obviously done using memcpy(),
but we have a couple of special cases when we use the user-copy
functions.  One is when we pass a kernel buffer to a regular user-buffer
routine, using set_fs(KERNEL_DS).  That's a "normal" case, and continued
to work fine, because it never takes any faults (with the possible
exception of a silent and successful vmalloc fault).

But Jan Beulich pointed out another, very unusual, special case: when we
use the user-copy routines not because it's a path that expects a user
pointer, but for a couple of ftrace/kgdb cases that want to do a kernel
copy, but do so using "unsafe" buffers, and use the user-copy routine to
gracefully handle faults.  IOW, for probe_kernel_write().

And that broke for the case of a faulting kernel destination, because we
saw the kernel destination and wanted to try to clear the tail of the
buffer.  Which doesn't work, since that's what faults.

This only triggers for things like kgdb and ftrace users (eg trying
setting a breakpoint on read-only memory), but it's definitely a bug.
The fix is to not compare against the kernel address start (TASK_SIZE),
but instead use the same limits "access_ok()" uses.

Reported-and-tested-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org # 4.0
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-04-24 06:58:27 -07:00
..
.gitignore
atomic64_32.c
atomic64_386_32.S
atomic64_cx8_32.S x86/asm: Introduce push/pop macros which generate CFI_REL_OFFSET and CFI_RESTORE 2015-03-04 22:50:49 +01:00
cache-smp.c
checksum_32.S x86/asm: Optimize unnecessarily wide TEST instructions 2015-03-07 11:12:43 +01:00
clear_page_64.S x86/lib/clear_page_64.S: Convert to ALTERNATIVE_2 macro 2015-02-23 13:44:16 +01:00
cmdline.c x86, boot: Carve out early cmdline parsing function 2014-05-20 20:21:24 -07:00
cmpxchg8b_emu.S x86: Improve cmpxchg8b_emu.S 2014-10-08 10:05:49 +02:00
cmpxchg16b_emu.S x86: Improve cmpxchg16b_emu.S 2014-10-08 10:05:49 +02:00
copy_page_64.S x86/lib/copy_page_64.S: Use generic ALTERNATIVE macro 2015-02-23 13:44:12 +01:00
copy_user_64.S x86/lib/copy_user_64.S: Convert to ALTERNATIVE_2 2015-02-23 13:44:13 +01:00
copy_user_nocache_64.S
csum-copy_64.S x86/asm: Optimize unnecessarily wide TEST instructions 2015-03-07 11:12:43 +01:00
csum-partial_64.c
csum-wrappers_64.c x86-64: make csum_partial_copy_from_user() error handling consistent 2014-11-16 11:00:42 -08:00
delay.c
getuser.S
inat.c
insn.c x86/asm/decoder: Fix and enforce max instruction size in the insn decoder 2015-02-19 00:01:24 +01:00
iomap_copy_64.S
Makefile net, lib: kill arch_fast_hash library bits 2014-12-10 15:17:46 -05:00
memcpy_32.c asmlinkage, x86: Fix 32bit memcpy for LTO 2014-02-13 18:14:46 -08:00
memcpy_64.S x86/lib/memcpy_64.S: Convert memcpy to ALTERNATIVE_2 macro 2015-02-23 13:55:52 +01:00
memmove_64.S x86/lib/memmove_64.S: Convert memmove() to ALTERNATIVE macro 2015-02-23 13:54:14 +01:00
memset_64.S x86/lib/memset_64.S: Convert to ALTERNATIVE_2 macro 2015-02-23 13:50:59 +01:00
misc.c
mmx_32.c
msr-reg-export.c
msr-reg.S x86/asm: Introduce push/pop macros which generate CFI_REL_OFFSET and CFI_RESTORE 2015-03-04 22:50:49 +01:00
msr-smp.c
msr.c x86: Fix typo preventing msr_set/clear_bit from having an effect 2014-05-09 08:42:32 -07:00
putuser.S
rwsem.S x86/asm: Introduce push/pop macros which generate CFI_REL_OFFSET and CFI_RESTORE 2015-03-04 22:50:49 +01:00
string_32.c
strstr_32.c
thunk_32.S x86/asm: Introduce push/pop macros which generate CFI_REL_OFFSET and CFI_RESTORE 2015-03-04 22:50:49 +01:00
thunk_64.S x86/asm: Introduce push/pop macros which generate CFI_REL_OFFSET and CFI_RESTORE 2015-03-04 22:50:49 +01:00
usercopy_32.c
usercopy_64.c x86: fix special __probe_kernel_write() tail zeroing case 2015-04-24 06:58:27 -07:00
usercopy.c
x86-opcode-map.txt x86/asm/decoder: Explain CALLW discrepancy between Intel and AMD 2015-02-18 21:01:59 +01:00