Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1648709
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.18 50/59] metag/uaccess: Fix access_ok() |
| Date | 2017-05-23 23:10 +0200 |
| Message-ID | <tKpe5-rD-99@gated-at.bofh.it> (permalink) |
| References | <tKpe1-rD-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <james.hogan@imgtec.com>
commit 8a8b56638bcac4e64cccc88bf95a0f9f4b19a2fb upstream.
The __user_bad() macro used by access_ok() has a few corner cases
noticed by Al Viro where it doesn't behave correctly:
- The kernel range check has off by 1 errors which permit access to the
first and last byte of the kernel mapped range.
- The kernel range check ends at LINCORE_BASE rather than
META_MEMORY_LIMIT, which is ineffective when the kernel is in global
space (an extremely uncommon configuration).
There are a couple of other shortcomings here too:
- Access to the whole of the other address space is permitted (i.e. the
global half of the address space when the kernel is in local space).
This isn't ideal as it could theoretically still contain privileged
mappings set up by the bootloader.
- The size argument is unused, permitting user copies which start on
valid pages at the end of the user address range and cross the
boundary into the kernel address space (e.g. addr = 0x3ffffff0, size
> 0x10).
It isn't very convenient to add size checks when disallowing certain
regions, and it seems far safer to be sure and explicit about what
userland is able to access, so invert the logic to allow certain regions
instead, and fix the off by 1 errors and missing size checks. This also
allows the get_fs() == KERNEL_DS check to be more easily optimised into
the user address range case.
We now have 3 such allowed regions:
- The user address range (incorporating the get_fs() == KERNEL_DS
check).
- NULL (some kernel code expects this to work, and we'll always catch
the fault anyway).
- The core code memory region.
Fixes: 373cd784d0fc ("metag: Memory handling")
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/metag/include/asm/uaccess.h | 40 +++++++++++++++++++++++----------------
1 file changed, 24 insertions(+), 16 deletions(-)
--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -28,24 +28,32 @@
#define segment_eq(a, b) ((a).seg == (b).seg)
-#define __kernel_ok (segment_eq(get_fs(), KERNEL_DS))
-/*
- * Explicitly allow NULL pointers here. Parts of the kernel such
- * as readv/writev use access_ok to validate pointers, but want
- * to allow NULL pointers for various reasons. NULL pointers are
- * safe to allow through because the first page is not mappable on
- * Meta.
- *
- * We also wish to avoid letting user code access the system area
- * and the kernel half of the address space.
- */
-#define __user_bad(addr, size) (((addr) > 0 && (addr) < META_MEMORY_BASE) || \
- ((addr) > PAGE_OFFSET && \
- (addr) < LINCORE_BASE))
-
static inline int __access_ok(unsigned long addr, unsigned long size)
{
- return __kernel_ok || !__user_bad(addr, size);
+ /*
+ * Allow access to the user mapped memory area, but not the system area
+ * before it. The check extends to the top of the address space when
+ * kernel access is allowed (there's no real reason to user copy to the
+ * system area in any case).
+ */
+ if (likely(addr >= META_MEMORY_BASE && addr < get_fs().seg &&
+ size <= get_fs().seg - addr))
+ return true;
+ /*
+ * Explicitly allow NULL pointers here. Parts of the kernel such
+ * as readv/writev use access_ok to validate pointers, but want
+ * to allow NULL pointers for various reasons. NULL pointers are
+ * safe to allow through because the first page is not mappable on
+ * Meta.
+ */
+ if (!addr)
+ return true;
+ /* Allow access to core code memory area... */
+ if (addr >= LINCORE_CODE_BASE && addr <= LINCORE_CODE_LIMIT &&
+ size <= LINCORE_CODE_LIMIT + 1 - addr)
+ return true;
+ /* ... but no other areas. */
+ return false;
}
#define access_ok(type, addr, size) __access_ok((unsigned long)(addr), \
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.18 00/59] 3.18.55-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 31/59] USB: serial: io_ti: fix div-by-zero in set_termios Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 18/59] USB: serial: ftdi_sio: fix setting latency for unprivileged users Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 52/59] stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 44/59] ARM: dts: at91: sama5d3_xplained: fix ADC vref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 58/59] drivers: char: mem: Check for address space wraparound with mmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 27/59] USB: iowarrior: fix info ioctl on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 48/59] xc2028: Fix use-after-free bug properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 55/59] tracing/kprobes: Enforce kprobes teardown after testing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 20/59] usb: host: xhci-plat: propagate return value of platform_get_irq() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 05/59] dm btree: fix for dm_btree_find_lowest_key() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 40/59] [media] zr364xx: enforce minimum size when reading header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 24/59] [media] mceusb: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 42/59] [media] cx231xx-audio: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 09/59] mwifiex: pcie: fix cmd_buf use-after-free in remove/reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 16/59] iio: dac: ad7303: fix channel description Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 11/59] regulator: tps65023: Fix inverted core enable logic. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
Re: [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-05-24 15:50 +0200
Re: [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 17:10 +0200
[PATCH 3.18 46/59] arm64: uaccess: ensure extension of access_ok() addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 30/59] USB: serial: mct_u232: fix big-endian baud-rate handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 32/59] USB: hub: fix SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 41/59] [media] cx231xx-cards: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 47/59] arm64: documentation: document tagged pointer stack constraints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 13/59] cdc-acm: fix possible invalid access when processing notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 50/59] metag/uaccess: Fix access_ok() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 54/59] osf_wait4(): fix infoleak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 49/59] mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 51/59] metag/uaccess: Check access_ok in strncpy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 33/59] USB: hub: fix non-SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 45/59] ARM: dts: at91: sama5d3_xplained: not all ADC channels are available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 28/59] usb: serial: option: add Telit ME910 support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 15/59] of: fdt: add missing allocation-failure check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 26/59] usb: musb: tusb6010_omap: Do not reset the other directions packet size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 23/59] [media] usbvision: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 53/59] uwb: fix device quirk on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 56/59] PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 36/59] iio: proximity: as3935: fix as3935_write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 17/59] pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 06/59] dm bufio: avoid a possible ABBA deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 19/59] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 12/59] ath9k_htc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 22/59] net: irda: irda-usb: fix firmware name on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 25/59] [media] ttusb2: limit messages to buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 14/59] of: fix sparse warning in of_pci_range_parser_one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 04/59] USB: core: replace %p with %pK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 08/59] dm space map disk: fix some book keeping in the disk space map Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 07/59] dm thin metadata: call precommit before saving the roots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 39/59] [media] dib0700: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 38/59] [media] s5p-mfc: Fix unbalanced call to clock management Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 43/59] powerpc/pseries: Fix of_node_put() underflow during DLPAR remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 37/59] [media] gspca: konica: add missing endpoint sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 03/59] char: lp: fix possible integer overflow in lp_setup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 02/59] watchdog: pcwd_usb: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 01/59] USB: ene_usb6250: fix DMA to the stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
Re: [PATCH 3.18 00/59] 3.18.55-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 17:50 +0200
csiph-web