Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1489126
| Path | csiph.com!1.us.feeder.erje.net!feeder.erje.net!2.eu.feeder.erje.net!news2.arglkargh.de!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod |
|---|---|
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 101/118] frv: fix clear_user() |
| Date | Thu, 22 Sep 2016 19:40:02 +0200 |
| Message-ID | <skg8y-Rq-49@gated-at.bofh.it> (permalink) |
| References | <skg8x-Rq-3@gated-at.bofh.it> |
| X-Mailer | git-send-email 2.10.0 |
| User-Agent | quilt/0.64 |
| MIME-Version | 1.0 |
| Content-Type | text/plain; charset=UTF-8 |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 49 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Al Viro <viro@zeniv.linux.org.uk> |
| X-Original-Date | Thu, 22 Sep 2016 19:30:01 +0200 |
| X-Original-Message-ID | <20160922172943.693062392@linuxfoundation.org> |
| X-Original-References | <20160922172938.643879685@linuxfoundation.org> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | csiph.com linux.kernel:1489126 |
Show key headers only | View raw
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 3b8767a8f00cc6538ba6b1cf0f88502e2fd2eb90 upstream.
It should check access_ok(). Otherwise a bunch of places turn into
trivially exploitable rootholes.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/frv/include/asm/uaccess.h | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/arch/frv/include/asm/uaccess.h
+++ b/arch/frv/include/asm/uaccess.h
@@ -263,19 +263,25 @@ do { \
extern long __memset_user(void *dst, unsigned long count);
extern long __memcpy_user(void *dst, const void *src, unsigned long count);
-#define clear_user(dst,count) __memset_user(____force(dst), (count))
+#define __clear_user(dst,count) __memset_user(____force(dst), (count))
#define __copy_from_user_inatomic(to, from, n) __memcpy_user((to), ____force(from), (n))
#define __copy_to_user_inatomic(to, from, n) __memcpy_user(____force(to), (from), (n))
#else
-#define clear_user(dst,count) (memset(____force(dst), 0, (count)), 0)
+#define __clear_user(dst,count) (memset(____force(dst), 0, (count)), 0)
#define __copy_from_user_inatomic(to, from, n) (memcpy((to), ____force(from), (n)), 0)
#define __copy_to_user_inatomic(to, from, n) (memcpy(____force(to), (from), (n)), 0)
#endif
-#define __clear_user clear_user
+static inline unsigned long __must_check
+clear_user(void __user *to, unsigned long n)
+{
+ if (likely(__access_ok(to, n)))
+ n = __clear_user(to, n);
+ return n;
+}
static inline unsigned long __must_check
__copy_to_user(void __user *to, const void *from, unsigned long n)
Back to linux.kernel | Previous | Next | Find similar | Unroll thread
[PATCH 4.4 101/118] frv: fix clear_user() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-22 19:40 +0200
csiph-web