[PATCH] m32r: security fix of {get,put}_user macros
Update {get,put}_user macros for m32r kernel.
- Modify get_user to use __get_user_asm macro, instead of __get_user_x macro.
- Remove arch/m32r/lib/{get,put}user.S.
- Some cosmetic updates.
I would like to thank NIIBE Yutaka for his reporting about the m32r kernel's
security problem in {get,put}_user macros.
There were no address checking for user space access in {get,put}_user macros.
;-)
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Cc: NIIBE Yutaka <gniibe@fsij.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Hirokazu Takata
committed by
Linus Torvalds
Linus Torvalds
parent
7c1c4e5418
commit
04dfd0de4e
@ -38,10 +38,6 @@ EXPORT_SYMBOL(__udelay);
|
||||
EXPORT_SYMBOL(__delay);
|
||||
EXPORT_SYMBOL(__const_udelay);
|
||||
|
||||
EXPORT_SYMBOL(__get_user_1);
|
||||
EXPORT_SYMBOL(__get_user_2);
|
||||
EXPORT_SYMBOL(__get_user_4);
|
||||
|
||||
EXPORT_SYMBOL(strpbrk);
|
||||
EXPORT_SYMBOL(strstr);
|
||||
|
||||
|
||||
@ -2,6 +2,6 @@
|
||||
# Makefile for M32R-specific library files..
|
||||
#
|
||||
|
||||
lib-y := checksum.o ashxdi3.o memset.o memcpy.o getuser.o \
|
||||
putuser.o delay.o strlen.o usercopy.o csum_partial_copy.o
|
||||
lib-y := checksum.o ashxdi3.o memset.o memcpy.o \
|
||||
delay.o strlen.o usercopy.o csum_partial_copy.o
|
||||
|
||||
|
||||
@ -1,88 +0,0 @@
|
||||
/*
|
||||
* __get_user functions.
|
||||
*
|
||||
* (C) Copyright 2001 Hirokazu Takata
|
||||
*
|
||||
* These functions have a non-standard call interface
|
||||
* to make them more efficient, especially as they
|
||||
* return an error value in addition to the "real"
|
||||
* return value.
|
||||
*/
|
||||
|
||||
#include <linux/config.h>
|
||||
|
||||
/*
|
||||
* __get_user_X
|
||||
*
|
||||
* Inputs: r0 contains the address
|
||||
*
|
||||
* Outputs: r0 is error code (0 or -EFAULT)
|
||||
* r1 contains zero-extended value
|
||||
*
|
||||
* These functions should not modify any other registers,
|
||||
* as they get called from within inline assembly.
|
||||
*/
|
||||
|
||||
#ifdef CONFIG_ISA_DUAL_ISSUE
|
||||
|
||||
.text
|
||||
.balign 4
|
||||
.globl __get_user_1
|
||||
__get_user_1:
|
||||
1: ldub r1, @r0 || ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
.balign 4
|
||||
.globl __get_user_2
|
||||
__get_user_2:
|
||||
2: lduh r1, @r0 || ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
.balign 4
|
||||
.globl __get_user_4
|
||||
__get_user_4:
|
||||
3: ld r1, @r0 || ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
bad_get_user:
|
||||
ldi r1, #0 || ldi r0, #-14
|
||||
jmp r14
|
||||
|
||||
#else /* not CONFIG_ISA_DUAL_ISSUE */
|
||||
|
||||
.text
|
||||
.balign 4
|
||||
.globl __get_user_1
|
||||
__get_user_1:
|
||||
1: ldub r1, @r0
|
||||
ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
.balign 4
|
||||
.globl __get_user_2
|
||||
__get_user_2:
|
||||
2: lduh r1, @r0
|
||||
ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
.balign 4
|
||||
.globl __get_user_4
|
||||
__get_user_4:
|
||||
3: ld r1, @r0
|
||||
ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
bad_get_user:
|
||||
ldi r1, #0
|
||||
ldi r0, #-14
|
||||
jmp r14
|
||||
|
||||
#endif /* not CONFIG_ISA_DUAL_ISSUE */
|
||||
|
||||
.section __ex_table,"a"
|
||||
.long 1b,bad_get_user
|
||||
.long 2b,bad_get_user
|
||||
.long 3b,bad_get_user
|
||||
.previous
|
||||
|
||||
.end
|
||||
@ -1,84 +0,0 @@
|
||||
/*
|
||||
* __put_user functions.
|
||||
*
|
||||
* (C) Copyright 1998 Linus Torvalds
|
||||
* (C) Copyright 2001 Hirokazu Takata
|
||||
*
|
||||
* These functions have a non-standard call interface
|
||||
* to make them more efficient.
|
||||
*/
|
||||
|
||||
#include <linux/config.h>
|
||||
|
||||
/*
|
||||
* __put_user_X
|
||||
*
|
||||
* Inputs: r0 contains the address
|
||||
* r1 contains the value
|
||||
*
|
||||
* Outputs: r0 is error code (0 or -EFAULT)
|
||||
* r1 is corrupted (will contain "current_task").
|
||||
*
|
||||
* These functions should not modify any other registers,
|
||||
* as they get called from within inline assembly.
|
||||
*/
|
||||
|
||||
#ifdef CONFIG_ISA_DUAL_ISSUE
|
||||
|
||||
.text
|
||||
.balign 4
|
||||
.globl __put_user_1
|
||||
__put_user_1:
|
||||
1: stb r1, @r0 || ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
.balign 4
|
||||
.globl __put_user_2
|
||||
__put_user_2:
|
||||
2: sth r1, @r0 || ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
.balign 4
|
||||
.globl __put_user_4
|
||||
__put_user_4:
|
||||
3: st r1, @r0 || ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
bad_put_user:
|
||||
ldi r0, #-14 || jmp r14
|
||||
|
||||
#else /* not CONFIG_ISA_DUAL_ISSUE */
|
||||
|
||||
.text
|
||||
.balign 4
|
||||
.globl __put_user_1
|
||||
__put_user_1:
|
||||
1: stb r1, @r0
|
||||
ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
.balign 4
|
||||
.globl __put_user_2
|
||||
__put_user_2:
|
||||
2: sth r1, @r0
|
||||
ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
.balign 4
|
||||
.globl __put_user_4
|
||||
__put_user_4:
|
||||
3: st r1, @r0
|
||||
ldi r0, #0
|
||||
jmp r14
|
||||
|
||||
bad_put_user:
|
||||
ldi r0, #-14
|
||||
jmp r14
|
||||
|
||||
#endif /* not CONFIG_ISA_DUAL_ISSUE */
|
||||
|
||||
.section __ex_table,"a"
|
||||
.long 1b,bad_put_user
|
||||
.long 2b,bad_put_user
|
||||
.long 3b,bad_put_user
|
||||
.previous
|
||||
Reference in New Issue
Block a user