kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/arch/mips/cavium-octeon
History
James Cowgill 6f35f1fc14 MIPS: OCTEON: Fix copy_from_user fault handling for large buffers 
commit 884b426917 upstream.

If copy_from_user is called with a large buffer (>= 128 bytes) and the
userspace buffer refers partially to unreadable memory, then it is
possible for Octeon's copy_from_user to report the wrong number of bytes
have been copied. In the case where the buffer size is an exact multiple
of 128 and the fault occurs in the last 64 bytes, copy_from_user will
report that all the bytes were copied successfully but leave some
garbage in the destination buffer.

The bug is in the main __copy_user_common loop in octeon-memcpy.S where
in the middle of the loop, src and dst are incremented by 128 bytes. The
l_exc_copy fault handler is used after this but that assumes that
"src < THREAD_BUADDR($28)". This is not the case if src has already been
incremented.

Fix by adding an extra fault handler which rewinds the src and dst
pointers 128 bytes before falling though to l_exc_copy.

Thanks to the pwritev test from the strace test suite for originally
highlighting this bug!

Fixes: 5b3b16880f ("MIPS: Add Cavium OCTEON processor support ...")
Signed-off-by: James Cowgill <James.Cowgill@imgtec.com>
Acked-by: David Daney <david.daney@cavium.com>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14978/
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-03-12 06:41:39 +01:00
..
crypto Merge branch 'mvebu/drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc 2015-06-19 22:07:07 +08:00
executive MIPS: Octeon: Delete unused cvmx-mdio.h 2016-10-04 16:13:57 +02:00
cpu.c MIPS: Octeon: Place cnmips_cu2_setup in __init memory. 2010-10-04 18:34:00 +01:00
csrc-octeon.c MIPS: OCTEON: Don't attempt to use nonexistent registers on OCTEON III models. 2016-05-13 14:01:40 +02:00
dma-octeon.c dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
flash_setup.c MIPS: Octeon: Don't set .owner. 2015-04-08 01:10:53 +02:00
Kconfig treewide: Fix typos in Kconfig 2014-09-26 11:12:28 +02:00
Makefile of: clean-up unnecessary libfdt include paths 2015-06-04 20:16:47 -05:00
oct_ilm.c MIPS: Octeon: remove unnecessary null test before debugfs_remove_recursive 2014-08-02 00:06:47 +02:00
octeon-irq.c MIPS: Octeon: mark GPIO controller node not populated after IRQ init. 2016-09-29 18:59:49 +02:00
octeon-memcpy.S MIPS: OCTEON: Fix copy_from_user fault handling for large buffers 2017-03-12 06:41:39 +01:00
octeon-platform.c MIPS: Octeon: Fix platform bus probing 2016-09-19 17:35:44 +02:00
octeon_boot.h MIPS: Octeon: Handle bootloader structures in little-endian mode. 2015-04-01 17:21:23 +02:00
Platform MIPS: OCTEON: Rename Kconfig CAVIUM_OCTEON_REFERENCE_BOARD to CAVIUM_OCTEON_SOC 2013-06-10 18:01:25 +02:00
setup.c Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2016-10-15 09:26:12 -07:00
smp.c mips/octeon/smp: Convert to hotplug state machine 2016-09-19 21:44:32 +02:00