diff options
| author | Russell King <rmk+kernel@arm.linux.org.uk> | 2012-09-07 18:22:28 +0100 |
|---|---|---|
| committer | Brett Rogers <brettrogers11@gmail.com> | 2015-12-18 00:54:47 -0800 |
| commit | 67f8047290499070df082f5a2de81a387cfcfdd6 (patch) | |
| tree | 455524f1c2231bee290fdd3fec3276d02c49669b /arch/arm/lib/getuser.S | |
| parent | 4de865b6d1dfa81b2a5d01c3cab0770a9aceac0c (diff) | |
| download | kernel_samsung_smdk4412-67f8047290499070df082f5a2de81a387cfcfdd6.zip kernel_samsung_smdk4412-67f8047290499070df082f5a2de81a387cfcfdd6.tar.gz kernel_samsung_smdk4412-67f8047290499070df082f5a2de81a387cfcfdd6.tar.bz2 | |
ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS
The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.
This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.
[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]
CRs-Fixed: 504011
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 8404663f81d212918ff85f493649a7991209fa04
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Conflicts:
arch/arm/include/asm/assembler.h
arch/arm/lib/getuser.S
arch/arm/lib/putuser.S
Change-Id: I3818045a136fcdf72deb1371b132e090fd7ed643
Diffstat (limited to 'arch/arm/lib/getuser.S')
| -rw-r--r-- | arch/arm/lib/getuser.S | 27 |
1 files changed, 17 insertions, 10 deletions
diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S index 1b049cd..77efabb 100644 --- a/arch/arm/lib/getuser.S +++ b/arch/arm/lib/getuser.S @@ -16,8 +16,9 @@ * __get_user_X * * Inputs: r0 contains the address + * r1 contains the address limit, which must be preserved * Outputs: r0 is the error code - * r2, r3 contains the zero-extended value + * r2 contains the zero-extended value * lr corrupted * * No other registers must be altered. (see <asm/uaccess.h> @@ -27,34 +28,40 @@ * Note also that it is intended that __get_user_bad is not global. */ #include <linux/linkage.h> +#include <asm/assembler.h> #include <asm/errno.h> #include <asm/domain.h> ENTRY(__get_user_1) -1: T(ldrb) r2, [r0] + check_uaccess r0, 1, r1, r2, __get_user_bad +1: T(ldrb) r2, [r0] mov r0, #0 mov pc, lr ENDPROC(__get_user_1) ENTRY(__get_user_2) -#ifdef CONFIG_THUMB2_KERNEL -2: T(ldrb) r2, [r0] -3: T(ldrb) r3, [r0, #1] + check_uaccess r0, 2, r1, r2, __get_user_bad +#ifdef CONFIG_CPU_USE_DOMAINS +rb .req ip +2: ldrbt r2, [r0], #1 +3: ldrbt rb, [r0], #0 #else -2: T(ldrb) r2, [r0], #1 -3: T(ldrb) r3, [r0] +rb .req r0 +2: ldrb r2, [r0] +3: ldrb rb, [r0, #1] #endif #ifndef __ARMEB__ - orr r2, r2, r3, lsl #8 + orr r2, r2, rb, lsl #8 #else - orr r2, r3, r2, lsl #8 + orr r2, rb, r2, lsl #8 #endif mov r0, #0 mov pc, lr ENDPROC(__get_user_2) ENTRY(__get_user_4) -4: T(ldr) r2, [r0] + check_uaccess r0, 4, r1, r2, __get_user_bad +4: T(ldr) r2, [r0] mov r0, #0 mov pc, lr ENDPROC(__get_user_4) |