diff options
| author | Martin Schwidefsky <schwidefsky@de.ibm.com> | 2006-09-28 16:56:03 +0200 |
|---|---|---|
| committer | Martin Schwidefsky <schwidefsky@de.ibm.com> | 2006-09-28 16:56:03 +0200 |
| commit | 52149ba6b0ddf3e9d965257cc0513193650b3ea8 (patch) | |
| tree | af8097516b3cd9d9f2397080e4cf81414fd4172a /arch/s390/lib/uaccess_std.c | |
| parent | 51dced544e3964b684afc99282ceceaa384b16a8 (diff) | |
| download | kernel_samsung_smdk4412-52149ba6b0ddf3e9d965257cc0513193650b3ea8.zip kernel_samsung_smdk4412-52149ba6b0ddf3e9d965257cc0513193650b3ea8.tar.gz kernel_samsung_smdk4412-52149ba6b0ddf3e9d965257cc0513193650b3ea8.tar.bz2 | |
[S390] user readable uninitialised kernel memory.
A user space program can read uninitialised kernel memory
by appending to a file from a bad address and then reading
the result back. The cause is the copy_from_user function
that does not clear the remaining bytes of the kernel
buffer after it got a fault on the user space address.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Diffstat (limited to 'arch/s390/lib/uaccess_std.c')
| -rw-r--r-- | arch/s390/lib/uaccess_std.c | 36 |
1 files changed, 26 insertions, 10 deletions
diff --git a/arch/s390/lib/uaccess_std.c b/arch/s390/lib/uaccess_std.c index 9a4d4a2..f44f007 100644 --- a/arch/s390/lib/uaccess_std.c +++ b/arch/s390/lib/uaccess_std.c @@ -35,25 +35,35 @@ size_t copy_from_user_std(size_t size, const void __user *ptr, void *x) tmp1 = -256UL; asm volatile( "0: mvcp 0(%0,%2),0(%1),%3\n" - " jz 5f\n" + " jz 8f\n" "1:"ALR" %0,%3\n" " la %1,256(%1)\n" " la %2,256(%2)\n" "2: mvcp 0(%0,%2),0(%1),%3\n" " jnz 1b\n" - " j 5f\n" + " j 8f\n" "3: la %4,255(%1)\n" /* %4 = ptr + 255 */ " "LHI" %3,-4096\n" " nr %4,%3\n" /* %4 = (ptr + 255) & -4096 */ " "SLR" %4,%1\n" " "CLR" %0,%4\n" /* copy crosses next page boundary? */ - " jnh 6f\n" + " jnh 5f\n" "4: mvcp 0(%4,%2),0(%1),%3\n" " "SLR" %0,%4\n" - " j 6f\n" - "5:"SLR" %0,%0\n" - "6: \n" - EX_TABLE(0b,3b) EX_TABLE(2b,3b) EX_TABLE(4b,6b) + " "ALR" %2,%4\n" + "5:"LHI" %4,-1\n" + " "ALR" %4,%0\n" /* copy remaining size, subtract 1 */ + " bras %3,7f\n" /* memset loop */ + " xc 0(1,%2),0(%2)\n" + "6: xc 0(256,%2),0(%2)\n" + " la %2,256(%2)\n" + "7:"AHI" %4,-256\n" + " jnm 6b\n" + " ex %4,0(%3)\n" + " j 9f\n" + "8:"SLR" %0,%0\n" + "9: \n" + EX_TABLE(0b,3b) EX_TABLE(2b,3b) EX_TABLE(4b,5b) : "+a" (size), "+a" (ptr), "+a" (x), "+a" (tmp1), "=a" (tmp2) : : "cc", "memory"); return size; @@ -67,16 +77,22 @@ size_t copy_from_user_std_small(size_t size, const void __user *ptr, void *x) asm volatile( "0: mvcp 0(%0,%2),0(%1),%3\n" " "SLR" %0,%0\n" - " j 3f\n" + " j 5f\n" "1: la %4,255(%1)\n" /* %4 = ptr + 255 */ " "LHI" %3,-4096\n" " nr %4,%3\n" /* %4 = (ptr + 255) & -4096 */ " "SLR" %4,%1\n" " "CLR" %0,%4\n" /* copy crosses next page boundary? */ - " jnh 3f\n" + " jnh 5f\n" "2: mvcp 0(%4,%2),0(%1),%3\n" " "SLR" %0,%4\n" - "3:\n" + " "ALR" %2,%4\n" + "3:"LHI" %4,-1\n" + " "ALR" %4,%0\n" /* copy remaining size, subtract 1 */ + " bras %3,4f\n" + " xc 0(1,%2),0(%2)\n" + "4: ex %4,0(%3)\n" + "5:\n" EX_TABLE(0b,1b) EX_TABLE(2b,3b) : "+a" (size), "+a" (ptr), "+a" (x), "+a" (tmp1), "=a" (tmp2) : : "cc", "memory"); |