summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHeiko Carstens <heiko.carstens@de.ibm.com>2013-02-25 07:24:20 +0100
committerMartin Schwidefsky <schwidefsky@de.ibm.com>2013-02-28 09:37:11 +0100
commit225cf8d69c768f4472d2fd9f54bba2b69a588193 (patch)
tree72bb482ba7c226991712e0cf466e6155b85a7821
parent832a998190400563a69677b30d5f306e45cc3aff (diff)
downloadlinux-stable-225cf8d69c768f4472d2fd9f54bba2b69a588193.tar.gz
linux-stable-225cf8d69c768f4472d2fd9f54bba2b69a588193.tar.bz2
linux-stable-225cf8d69c768f4472d2fd9f54bba2b69a588193.zip
s390/uaccess: fix strncpy_from_user string length check
The "standard" and page table walk variants of strncpy_from_user() first check the length of the to be copied string in userspace. The string is then copied to kernel space and the length returned to the caller. However userspace can modify the string at any time while the kernel checks for the length of the string or copies the string. In result the returned length of the string is not necessarily correct. Fix this by copying in a loop which mimics the mvcos variant of strncpy_from_user(), which handles this correctly. Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
-rw-r--r--arch/s390/lib/uaccess_pt.c34
-rw-r--r--arch/s390/lib/uaccess_std.c46
2 files changed, 34 insertions, 46 deletions
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index c1aaf22c326b..304e07086ab3 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -202,27 +202,29 @@ fault:
static size_t strncpy_from_user_pt(size_t count, const char __user *src,
char *dst)
{
- size_t n = strnlen_user_pt(count, src);
+ size_t done, len, offset, len_str;
if (unlikely(!count))
return 0;
- if (!n)
- return -EFAULT;
- if (n > count)
- n = count;
if (segment_eq(get_fs(), KERNEL_DS)) {
- memcpy(dst, (const char __kernel __force *) src, n);
- if (dst[n-1] == '\0')
- return n-1;
- else
- return n;
+ len = strnlen((const char __kernel __force *) src, count) + 1;
+ if (len > count)
+ len = count;
+ memcpy(dst, (const char __kernel __force *) src, len);
+ return (dst[len - 1] == '\0') ? len - 1 : len;
}
- if (__user_copy_pt((unsigned long) src, dst, n, 0))
- return -EFAULT;
- if (dst[n-1] == '\0')
- return n-1;
- else
- return n;
+ done = 0;
+ do {
+ offset = (size_t)src & ~PAGE_MASK;
+ len = min(count - done, PAGE_SIZE - offset);
+ if (__user_copy_pt((unsigned long) src, dst, len, 0))
+ return -EFAULT;
+ len_str = strnlen(dst, len);
+ done += len_str;
+ src += len_str;
+ dst += len_str;
+ } while ((len_str == len) && (done < count));
+ return done;
}
static size_t copy_in_user_pt(size_t n, void __user *to,
diff --git a/arch/s390/lib/uaccess_std.c b/arch/s390/lib/uaccess_std.c
index 79c6c7d76e08..4a75d475b06a 100644
--- a/arch/s390/lib/uaccess_std.c
+++ b/arch/s390/lib/uaccess_std.c
@@ -206,38 +206,24 @@ size_t strnlen_user_std(size_t size, const char __user *src)
return size;
}
-size_t strncpy_from_user_std(size_t size, const char __user *src, char *dst)
+size_t strncpy_from_user_std(size_t count, const char __user *src, char *dst)
{
- register unsigned long reg0 asm("0") = 0UL;
- unsigned long tmp1, tmp2;
+ size_t done, len, offset, len_str;
- asm volatile(
- " la %3,0(%1)\n"
- " la %4,0(%0,%1)\n"
- " sacf 256\n"
- "0: srst %4,%3\n"
- " jo 0b\n"
- " sacf 0\n"
- " la %0,0(%4)\n"
- " jh 1f\n" /* found \0 in string ? */
- " "AHI" %4,1\n" /* include \0 in copy */
- "1:"SLR" %0,%1\n" /* %0 = return length (without \0) */
- " "SLR" %4,%1\n" /* %4 = copy length (including \0) */
- "2: mvcp 0(%4,%2),0(%1),%5\n"
- " jz 9f\n"
- "3:"AHI" %4,-256\n"
- " la %1,256(%1)\n"
- " la %2,256(%2)\n"
- "4: mvcp 0(%4,%2),0(%1),%5\n"
- " jnz 3b\n"
- " j 9f\n"
- "7: sacf 0\n"
- "8:"LHI" %0,%6\n"
- "9:\n"
- EX_TABLE(0b,7b) EX_TABLE(2b,8b) EX_TABLE(4b,8b)
- : "+a" (size), "+a" (src), "+d" (dst), "=a" (tmp1), "=a" (tmp2)
- : "d" (reg0), "K" (-EFAULT) : "cc", "memory");
- return size;
+ if (unlikely(!count))
+ return 0;
+ done = 0;
+ do {
+ offset = (size_t)src & ~PAGE_MASK;
+ len = min(count - done, PAGE_SIZE - offset);
+ if (copy_from_user_std(len, src, dst))
+ return -EFAULT;
+ len_str = strnlen(dst, len);
+ done += len_str;
+ src += len_str;
+ dst += len_str;
+ } while ((len_str == len) && (done < count));
+ return done;
}
#define __futex_atomic_op(insn, ret, oldval, newval, uaddr, oparg) \