diff options
| author | Mark Rutland <mark.rutland@arm.com> | 2017-05-03 16:09:35 +0100 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2017-05-28 06:36:09 -0400 |
| commit | a7b4cdeb22f51cbf3b623ea404b0d215ca4eb3ea (patch) | |
| tree | 89bd7b41d3218f3dcc84722c8c65edc54a5ce3fe | |
| parent | ed3ffd7c7fb9770777b069cbda5c5642f44445e3 (diff) | |
arm64: uaccess: ensure extension of access_ok() addr
[ Upstream commit a06040d7a791a9177581dcf7293941bd92400856 ]
Our access_ok() simply hands its arguments over to __range_ok(), which
implicitly assummes that the addr parameter is 64 bits wide. This isn't
necessarily true for compat code, which might pass down a 32-bit address
parameter.
In these cases, we don't have a guarantee that the address has been zero
extended to 64 bits, and the upper bits of the register may contain
unknown values, potentially resulting in a suprious failure.
Avoid this by explicitly casting the addr parameter to an unsigned long
(as is done on other architectures), ensuring that the parameter is
widened appropriately.
Fixes: 0aea86a2176c ("arm64: User access library functions")
Cc: <stable@vger.kernel.org> # 3.7.x-
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
| -rw-r--r-- | arch/arm64/include/asm/uaccess.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index 07e1ba449bf1..4849baa914d8 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -89,11 +89,12 @@ static inline void set_fs(mm_segment_t fs) */ #define __range_ok(addr, size) \ ({ \ + unsigned long __addr = (unsigned long __force)(addr); \ unsigned long flag, roksum; \ __chk_user_ptr(addr); \ asm("adds %1, %1, %3; ccmp %1, %4, #2, cc; cset %0, ls" \ : "=&r" (flag), "=&r" (roksum) \ - : "1" (addr), "Ir" (size), \ + : "1" (__addr), "Ir" (size), \ "r" (current_thread_info()->addr_limit) \ : "cc"); \ flag; \ |