Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1383744

[PATCH 4/5] x86, boot: Make memcpy handle overlaps

Show key headers only | View raw

Two uses of memcpy (screen scrolling and ELF parsing) were handling
overlapping memory areas. While there were no explicitly noticed bugs
here (yet), it is best to fix this so that the copying will always be
safe.

Instead of making a new memmove function that might collide with other
memmove definitions in the decompressors, this just makes the compressed
boot's copy of memcpy overlap safe.

Reported-by: Yinghai Lu <yinghai@kernel.org>
Suggested-by: Lasse Collin <lasse.collin@tukaani.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
 arch/x86/boot/compressed/misc.c   |  4 +---
 arch/x86/boot/compressed/string.c | 22 ++++++++++++++++++++--
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 0381e250a785..eacc855ae08e 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -301,9 +301,7 @@ static void parse_elf(void *output)
 #else
 			dest = (void *)(phdr->p_paddr);
 #endif
-			memcpy(dest,
-			       output + phdr->p_offset,
-			       phdr->p_filesz);
+			memcpy(dest, output + phdr->p_offset, phdr->p_filesz);
 			break;
 		default: /* Ignore other PT_* */ break;
 		}
diff --git a/arch/x86/boot/compressed/string.c b/arch/x86/boot/compressed/string.c
index 00e788be1db9..1e10e40f49dd 100644
--- a/arch/x86/boot/compressed/string.c
+++ b/arch/x86/boot/compressed/string.c
@@ -1,7 +1,7 @@
 #include "../string.c"
 
 #ifdef CONFIG_X86_32
-void *memcpy(void *dest, const void *src, size_t n)
+void *__memcpy(void *dest, const void *src, size_t n)
 {
 	int d0, d1, d2;
 	asm volatile(
@@ -15,7 +15,7 @@ void *memcpy(void *dest, const void *src, size_t n)
 	return dest;
 }
 #else
-void *memcpy(void *dest, const void *src, size_t n)
+void *__memcpy(void *dest, const void *src, size_t n)
 {
 	long d0, d1, d2;
 	asm volatile(
@@ -39,3 +39,21 @@ void *memset(void *s, int c, size_t n)
 		ss[i] = c;
 	return s;
 }
+
+/*
+ * This memcpy is overlap safe (i.e. it is memmove without conflicting
+ * with other definitions of memmove from the various decompressors.
+ */
+void *memcpy(void *dest, const void *src, size_t n)
+{
+	unsigned char *d = dest;
+	const unsigned char *s = src;
+
+	if (d <= s || d - s >= n)
+		return __memcpy(dest, src, n);
+
+	while (n-- > 0)
+		d[n] = s[n];
+
+	return dest;
+}
-- 
2.6.3

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/5] x86, boot: clean up KASLR code (step 2) Kees Cook <keescook@chromium.org> - 2016-04-20 23:00 +0200
  [PATCH 4/5] x86, boot: Make memcpy handle overlaps Kees Cook <keescook@chromium.org> - 2016-04-20 23:00 +0200
    Re: [PATCH 4/5] x86, boot: Make memcpy handle overlaps Ingo Molnar <mingo@kernel.org> - 2016-04-22 10:00 +0200
    Re: [PATCH 4/5] x86, boot: Make memcpy handle overlaps Ingo Molnar <mingo@kernel.org> - 2016-04-22 10:00 +0200
      Re: [PATCH 4/5] x86, boot: Make memcpy handle overlaps Kees Cook <keescook@chromium.org> - 2016-04-23 00:20 +0200
    [tip:x86/boot] x86/boot: Make memcpy() handle overlaps tip-bot for Kees Cook <tipbot@zytor.com> - 2016-04-22 11:50 +0200
      Re: [tip:x86/boot] x86/boot: Make memcpy() handle overlaps Lasse Collin <lasse.collin@tukaani.org> - 2016-04-22 23:10 +0200
        Re: [tip:x86/boot] x86/boot: Make memcpy() handle overlaps Kees Cook <keescook@chromium.org> - 2016-04-23 00:10 +0200
  [PATCH 1/5] x86, KASLR: Update description for decompressor worst case size Kees Cook <keescook@chromium.org> - 2016-04-20 23:00 +0200
    Re: [PATCH 1/5] x86, KASLR: Update description for decompressor  worst case size Borislav Petkov <bp@suse.de> - 2016-04-21 16:50 +0200
      Re: [PATCH 1/5] x86, KASLR: Update description for decompressor worst  case size Kees Cook <keescook@chromium.org> - 2016-04-21 22:10 +0200
        Re: [PATCH 1/5] x86, KASLR: Update description for decompressor  worst case size Baoquan He <bhe@redhat.com> - 2016-04-22 05:20 +0200
    Re: [PATCH 1/5] x86, KASLR: Update description for decompressor  worst case size Ingo Molnar <mingo@kernel.org> - 2016-04-22 09:50 +0200
    [tip:x86/boot] x86/KASLR: Update description for decompressor worst  case size tip-bot for Baoquan He <tipbot@zytor.com> - 2016-04-22 11:50 +0200
  Re: [PATCH 0/5] x86, boot: clean up KASLR code (step 2) Ingo Molnar <mingo@kernel.org> - 2016-04-22 09:50 +0200
    Re: [PATCH 0/5] x86, boot: clean up KASLR code (step 2) Kees Cook <keescook@chromium.org> - 2016-04-22 17:40 +0200

csiph-web