ARM: 8797/1: spectre-v1.1: harden __copy_to_user
Commit a1d09e0742
upstream.
Sanitize user pointer given to __copy_to_user, both for standard version
and memcopy version of the user accessor.
Signed-off-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David A. Long <dave.long@linaro.org>
Reviewed-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
committed by
Greg Kroah-Hartman
parent
d5e5018179
commit
27dd16a03e
@ -94,6 +94,11 @@
|
|||||||
|
|
||||||
ENTRY(__copy_to_user_std)
|
ENTRY(__copy_to_user_std)
|
||||||
WEAK(arm_copy_to_user)
|
WEAK(arm_copy_to_user)
|
||||||
|
#ifdef CONFIG_CPU_SPECTRE
|
||||||
|
get_thread_info r3
|
||||||
|
ldr r3, [r3, #TI_ADDR_LIMIT]
|
||||||
|
uaccess_mask_range_ptr r0, r2, r3, ip
|
||||||
|
#endif
|
||||||
|
|
||||||
#include "copy_template.S"
|
#include "copy_template.S"
|
||||||
|
|
||||||
@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std)
|
|||||||
rsb r0, r0, r2
|
rsb r0, r0, r2
|
||||||
copy_abort_end
|
copy_abort_end
|
||||||
.popsection
|
.popsection
|
||||||
|
|
||||||
|
@ -152,7 +152,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
|
|||||||
n = __copy_to_user_std(to, from, n);
|
n = __copy_to_user_std(to, from, n);
|
||||||
uaccess_restore(ua_flags);
|
uaccess_restore(ua_flags);
|
||||||
} else {
|
} else {
|
||||||
n = __copy_to_user_memcpy(to, from, n);
|
n = __copy_to_user_memcpy(uaccess_mask_range_ptr(to, n),
|
||||||
|
from, n);
|
||||||
}
|
}
|
||||||
return n;
|
return n;
|
||||||
}
|
}
|
||||||
|
Reference in New Issue
Block a user