summaryrefslogtreecommitdiffstats
path: root/arch
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2022-03-21 19:58:27 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2022-03-21 19:58:27 -0700
commit8565d64430f8278bea38dab0a3ab60b4e11c71e4 (patch)
tree71be2df8795c4862d45b3e1395fedf3092f723cf /arch
parentd0858cbdef50d973ca6b38c0ed0cce54cb2b6182 (diff)
parentfad278388e01e3658a356118bed8ee2c2408d280 (diff)
downloadlinux-stable-8565d64430f8278bea38dab0a3ab60b4e11c71e4.tar.gz
linux-stable-8565d64430f8278bea38dab0a3ab60b4e11c71e4.tar.bz2
linux-stable-8565d64430f8278bea38dab0a3ab60b4e11c71e4.zip
Merge tag 'bounds-fixes-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull bounds fixes from Kees Cook: "These are a handful of buffer and array bounds fixes that I've been carrying in preparation for the coming memcpy improvements and the enabling of '-Warray-bounds' globally. There are additional similar fixes in other maintainer's trees, but these ended up getting carried by me. :)" * tag 'bounds-fixes-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: media: omap3isp: Use struct_group() for memcpy() region tpm: vtpm_proxy: Check length to avoid compiler warning alpha: Silence -Warray-bounds warnings m68k: cmpxchg: Dereference matching size intel_th: msu: Use memset_startat() for clearing hw header KVM: x86: Replace memset() "optimization" with normal per-field writes
Diffstat (limited to 'arch')
-rw-r--r--arch/alpha/mm/init.c6
-rw-r--r--arch/m68k/include/asm/cmpxchg.h9
-rw-r--r--arch/x86/kvm/emulate.c9
-rw-r--r--arch/x86/kvm/kvm_emulate.h6
4 files changed, 15 insertions, 15 deletions
diff --git a/arch/alpha/mm/init.c b/arch/alpha/mm/init.c
index f6114d03357c..7511723b7669 100644
--- a/arch/alpha/mm/init.c
+++ b/arch/alpha/mm/init.c
@@ -76,14 +76,14 @@ pgd_alloc(struct mm_struct *mm)
pmd_t *
__bad_pagetable(void)
{
- memset((void *) EMPTY_PGT, 0, PAGE_SIZE);
+ memset(absolute_pointer(EMPTY_PGT), 0, PAGE_SIZE);
return (pmd_t *) EMPTY_PGT;
}
pte_t
__bad_page(void)
{
- memset((void *) EMPTY_PGE, 0, PAGE_SIZE);
+ memset(absolute_pointer(EMPTY_PGE), 0, PAGE_SIZE);
return pte_mkdirty(mk_pte(virt_to_page(EMPTY_PGE), PAGE_SHARED));
}
@@ -253,7 +253,7 @@ void __init paging_init(void)
free_area_init(max_zone_pfn);
/* Initialize the kernel's ZERO_PGE. */
- memset((void *)ZERO_PGE, 0, PAGE_SIZE);
+ memset(absolute_pointer(ZERO_PGE), 0, PAGE_SIZE);
}
#if defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_SRM)
diff --git a/arch/m68k/include/asm/cmpxchg.h b/arch/m68k/include/asm/cmpxchg.h
index e8ca4b0ccefa..6cf464cdab06 100644
--- a/arch/m68k/include/asm/cmpxchg.h
+++ b/arch/m68k/include/asm/cmpxchg.h
@@ -4,8 +4,7 @@
#include <linux/irqflags.h>
-struct __xchg_dummy { unsigned long a[100]; };
-#define __xg(x) ((volatile struct __xchg_dummy *)(x))
+#define __xg(type, x) ((volatile type *)(x))
extern unsigned long __invalid_xchg_size(unsigned long, volatile void *, int);
@@ -50,7 +49,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz
"1:\n\t"
"casb %0,%1,%2\n\t"
"jne 1b"
- : "=&d" (x) : "d" (x), "m" (*__xg(ptr)) : "memory");
+ : "=&d" (x) : "d" (x), "m" (*__xg(u8, ptr)) : "memory");
break;
case 2:
__asm__ __volatile__
@@ -58,7 +57,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz
"1:\n\t"
"casw %0,%1,%2\n\t"
"jne 1b"
- : "=&d" (x) : "d" (x), "m" (*__xg(ptr)) : "memory");
+ : "=&d" (x) : "d" (x), "m" (*__xg(u16, ptr)) : "memory");
break;
case 4:
__asm__ __volatile__
@@ -66,7 +65,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz
"1:\n\t"
"casl %0,%1,%2\n\t"
"jne 1b"
- : "=&d" (x) : "d" (x), "m" (*__xg(ptr)) : "memory");
+ : "=&d" (x) : "d" (x), "m" (*__xg(u32, ptr)) : "memory");
break;
default:
x = __invalid_xchg_size(x, ptr, size);
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index e86d610dc6b7..d8c087f1b831 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -5395,8 +5395,13 @@ static int fastop(struct x86_emulate_ctxt *ctxt, fastop_t fop)
void init_decode_cache(struct x86_emulate_ctxt *ctxt)
{
- memset(&ctxt->rip_relative, 0,
- (void *)&ctxt->modrm - (void *)&ctxt->rip_relative);
+ /* Clear fields that are set conditionally but read without a guard. */
+ ctxt->rip_relative = false;
+ ctxt->rex_prefix = 0;
+ ctxt->lock_prefix = 0;
+ ctxt->rep_prefix = 0;
+ ctxt->regs_valid = 0;
+ ctxt->regs_dirty = 0;
ctxt->io_read.pos = 0;
ctxt->io_read.end = 0;
diff --git a/arch/x86/kvm/kvm_emulate.h b/arch/x86/kvm/kvm_emulate.h
index 39eded2426ff..840ddb4a9302 100644
--- a/arch/x86/kvm/kvm_emulate.h
+++ b/arch/x86/kvm/kvm_emulate.h
@@ -336,11 +336,7 @@ struct x86_emulate_ctxt {
fastop_t fop;
};
int (*check_perm)(struct x86_emulate_ctxt *ctxt);
- /*
- * The following six fields are cleared together,
- * the rest are initialized unconditionally in x86_decode_insn
- * or elsewhere
- */
+
bool rip_relative;
u8 rex_prefix;
u8 lock_prefix;