diff options
author | Kyle McMartin <kyle@redhat.com> | 2014-11-12 21:07:44 +0000 |
---|---|---|
committer | Luis Henriques <luis.henriques@canonical.com> | 2014-11-27 11:21:47 +0000 |
commit | 73d908ca212dfa4a27e6ba4c272a651c979594d4 (patch) | |
tree | d597ddf7da5b4474157384b255abef30586d916c | |
parent | d856a4f71ce937455b0ab609053534f83b0477a2 (diff) | |
download | linux-stable-73d908ca212dfa4a27e6ba4c272a651c979594d4.tar.gz linux-stable-73d908ca212dfa4a27e6ba4c272a651c979594d4.tar.bz2 linux-stable-73d908ca212dfa4a27e6ba4c272a651c979594d4.zip |
arm64: __clear_user: handle exceptions on strb
commit 97fc15436b36ee3956efad83e22a557991f7d19d upstream.
ARM64 currently doesn't fix up faults on the single-byte (strb) case of
__clear_user... which means that we can cause a nasty kernel panic as an
ordinary user with any multiple PAGE_SIZE+1 read from /dev/zero.
i.e.: dd if=/dev/zero of=foo ibs=1 count=1 (or ibs=65537, etc.)
This is a pretty obscure bug in the general case since we'll only
__do_kernel_fault (since there's no extable entry for pc) if the
mmap_sem is contended. However, with CONFIG_DEBUG_VM enabled, we'll
always fault.
if (!down_read_trylock(&mm->mmap_sem)) {
if (!user_mode(regs) && !search_exception_tables(regs->pc))
goto no_context;
retry:
down_read(&mm->mmap_sem);
} else {
/*
* The above down_read_trylock() might have succeeded in
* which
* case, we'll have missed the might_sleep() from
* down_read().
*/
might_sleep();
if (!user_mode(regs) && !search_exception_tables(regs->pc))
goto no_context;
}
Fix that by adding an extable entry for the strb instruction, since it
touches user memory, similar to the other stores in __clear_user.
Signed-off-by: Kyle McMartin <kyle@redhat.com>
Reported-by: Miloš Prchlík <mprchlik@redhat.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
-rw-r--r-- | arch/arm64/lib/clear_user.S | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S index 6e0ed93d51fe..c17967fdf5f6 100644 --- a/arch/arm64/lib/clear_user.S +++ b/arch/arm64/lib/clear_user.S @@ -46,7 +46,7 @@ USER(9f, strh wzr, [x0], #2 ) sub x1, x1, #2 4: adds x1, x1, #1 b.mi 5f - strb wzr, [x0] +USER(9f, strb wzr, [x0] ) 5: mov x0, #0 ret ENDPROC(__clear_user) |