Path: csiph.com!feeder.erje.net!1.us.feeder.erje.net!newsfeed.fsmpi.rwth-aachen.de!newsfeed.straub-nv.de!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod From: Greg Kroah-Hartman Newsgroups: linux.kernel Subject: [PATCH 4.4 092/118] fix minor infoleak in get_user_ex() Date: Thu, 22 Sep 2016 19:40:01 +0200 Message-ID: References: X-Original-To: linux-kernel@vger.kernel.org X-Mailer: git-send-email 2.10.0 User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: robomod@news.nic.it List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Approved: robomod@news.nic.it Lines: 37 Organization: linux.* mail to news gateway X-Original-Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , Linus Torvalds X-Original-Date: Thu, 22 Sep 2016 19:29:52 +0200 X-Original-Message-ID: <20160922172943.268369771@linuxfoundation.org> X-Original-References: <20160922172938.643879685@linuxfoundation.org> X-Original-Sender: linux-kernel-owner@vger.kernel.org Xref: csiph.com linux.kernel:1489113 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Al Viro commit 1c109fabbd51863475cd12ac206bdd249aee35af upstream. get_user_ex(x, ptr) should zero x on failure. It's not a lot of a leak (at most we are leaking uninitialized 64bit value off the kernel stack, and in a fairly constrained situation, at that), but the fix is trivial, so... Signed-off-by: Al Viro [ This sat in different branch from the uaccess fixes since mid-August ] Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- arch/x86/include/asm/uaccess.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/arch/x86/include/asm/uaccess.h +++ b/arch/x86/include/asm/uaccess.h @@ -394,7 +394,11 @@ do { \ #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \ asm volatile("1: mov"itype" %1,%"rtype"0\n" \ "2:\n" \ - _ASM_EXTABLE_EX(1b, 2b) \ + ".section .fixup,\"ax\"\n" \ + "3:xor"itype" %"rtype"0,%"rtype"0\n" \ + " jmp 2b\n" \ + ".previous\n" \ + _ASM_EXTABLE_EX(1b, 3b) \ : ltype(x) : "m" (__m(addr))) #define __put_user_nocheck(x, ptr, size) \