linux/arch
Vineet Gupta 05d9d0b96e ARC: uaccess: get_user to zero out dest in cause of fault
Al reported potential issue with ARC get_user() as it wasn't clearing
out destination pointer in case of fault due to bad address etc.

Verified using following

| {
|  	u32 bogus1 = 0xdeadbeef;
|	u64 bogus2 = 0xdead;
|	int rc1, rc2;
|
|  	pr_info("Orig values %x %llx\n", bogus1, bogus2);
|	rc1 = get_user(bogus1, (u32 __user *)0x40000000);
|	rc2 = get_user(bogus2, (u64 __user *)0x50000000);
|	pr_info("access %d %d, new values %x %llx\n",
|		rc1, rc2, bogus1, bogus2);
| }

| [ARCLinux]# insmod /mnt/kernel-module/qtn.ko
| Orig values deadbeef dead
| access -14 -14, new values 0 0

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-snps-arc@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-09-13 17:49:41 -04:00
..
alpha alpha: fix copy_from_user() 2016-09-09 19:34:32 -04:00
arc ARC: uaccess: get_user to zero out dest in cause of fault 2016-09-13 17:49:41 -04:00
arm KVM locks kvm_device list to prevent corruption on device creation. 2016-08-13 10:11:14 -07:00
arm64 arm64 fixes: 2016-08-13 19:29:46 -07:00
avr32 dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
blackfin dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
c6x dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
cris cris: buggered copy_from_user/copy_to_user/clear_user 2016-09-13 17:49:38 -04:00
frv frv: fix clear_user() 2016-09-13 17:49:39 -04:00
h8300 h8300: Add missing include file to asm/io.h 2016-08-13 08:53:56 -07:00
hexagon hexagon: fix strncpy_from_user() error return 2016-09-13 17:49:39 -04:00
ia64 ia64: copy_from_user() should zero the destination on access_ok() failure 2016-09-13 17:49:40 -04:00
m32r mm: do not pass mm_struct into handle_mm_fault 2016-07-26 16:19:19 -07:00
m68k m68knommu: fix user a5 register being overwritten 2016-08-08 12:38:47 +10:00
metag metag: copy_from_user() should zero the destination on access_ok() failure 2016-09-13 17:49:40 -04:00
microblaze dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
mips MIPS: KVM: Propagate kseg0/mapped tlb fault errors 2016-08-12 12:01:30 +02:00
mn10300 RTC for 4.8 2016-08-05 09:48:22 -04:00
nios2 dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
openrisc dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
parisc RTC for 4.8 2016-08-05 09:48:22 -04:00
powerpc KVM locks kvm_device list to prevent corruption on device creation. 2016-08-13 10:11:14 -07:00
s390 KVM locks kvm_device list to prevent corruption on device creation. 2016-08-13 10:11:14 -07:00
score treewide: replace obsolete _refok by __ref 2016-08-02 17:31:41 -04:00
sh These changes improve device tree support (including builtin DTB), add 2016-08-06 09:00:05 -04:00
sparc Implements HARDENED_USERCOPY verification of copy_to_user/copy_from_user 2016-08-08 14:48:14 -07:00
tile tile: support static_key usage in non-module __exit sections 2016-08-04 08:50:07 -04:00
um Merge branch 'for-linus-4.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml 2016-08-04 19:37:59 -04:00
unicore32 unicore32: mm: Add missing parameter to arch_vma_access_permitted 2016-08-13 08:53:18 -07:00
x86 Power management fixes for v4.8-rc2 2016-08-12 16:23:58 -07:00
xtensa dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
.gitignore
Kconfig Implements HARDENED_USERCOPY verification of copy_to_user/copy_from_user 2016-08-08 14:48:14 -07:00