]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ARC: uaccess: get_user to zero out dest in cause of fault
authorVineet Gupta <Vineet.Gupta1@synopsys.com>
Fri, 19 Aug 2016 19:10:02 +0000 (12:10 -0700)
committerJiri Slaby <jslaby@suse.cz>
Thu, 29 Sep 2016 09:14:31 +0000 (11:14 +0200)
commit27f32d12e690e61a9b356f84e54f496a2cb64f6e
tree406e619453e47d8527e12917ba5b79ead8b32e3c
parent1cdd2edb8f7ec2fa7f87154bfe5499021fac7bcb
ARC: uaccess: get_user to zero out dest in cause of fault

commit 05d9d0b96e53c52a113fd783c0c97c830c8dc7af upstream.

Al reported potential issue with ARC get_user() as it wasn't clearing
out destination pointer in case of fault due to bad address etc.

Verified using following

| {
|   u32 bogus1 = 0xdeadbeef;
| u64 bogus2 = 0xdead;
| int rc1, rc2;
|
|   pr_info("Orig values %x %llx\n", bogus1, bogus2);
| rc1 = get_user(bogus1, (u32 __user *)0x40000000);
| rc2 = get_user(bogus2, (u64 __user *)0x50000000);
| pr_info("access %d %d, new values %x %llx\n",
| rc1, rc2, bogus1, bogus2);
| }

| [ARCLinux]# insmod /mnt/kernel-module/qtn.ko
| Orig values deadbeef dead
| access -14 -14, new values 0 0

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-snps-arc@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
arch/arc/include/asm/uaccess.h