Commit Graph

6 Commits

Author SHA1 Message Date
Vineet Gupta 05d9d0b96e ARC: uaccess: get_user to zero out dest in cause of fault
Al reported potential issue with ARC get_user() as it wasn't clearing
out destination pointer in case of fault due to bad address etc.

Verified using following

| {
|  	u32 bogus1 = 0xdeadbeef;
|	u64 bogus2 = 0xdead;
|	int rc1, rc2;
|
|  	pr_info("Orig values %x %llx\n", bogus1, bogus2);
|	rc1 = get_user(bogus1, (u32 __user *)0x40000000);
|	rc2 = get_user(bogus2, (u64 __user *)0x50000000);
|	pr_info("access %d %d, new values %x %llx\n",
|		rc1, rc2, bogus1, bogus2);
| }

| [ARCLinux]# insmod /mnt/kernel-module/qtn.ko
| Orig values deadbeef dead
| access -14 -14, new values 0 0

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-snps-arc@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-09-13 17:49:41 -04:00
Andrea Gelmini 2547476a5e Fix typos
Signed-off-by: Andrea Gelmini <andrea.gelmini@gelma.net>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
2016-05-30 10:07:32 +05:30
Vineet Gupta 8922bc3058 ARCv2: Adhere to Zero Delay loop restriction
Branch insn can't be scheduled as last insn of Zero Overhead loop

Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
2015-06-22 14:06:56 +05:30
Vineet Gupta 0752adfda1 ARC: Fix 32-bit wrap around in access_ok()
Anton reported

 | LTP tests syscalls/process_vm_readv01 and process_vm_writev01 fail
 | similarly in one testcase test_iov_invalid -> lvec->iov_base.
 | Testcase expects errno EFAULT and return code -1,
 | but it gets return code 1 and ERRNO is 0 what means success.

Essentially test case was passing a pointer of -1 which access_ok()
was not catching. It was doing [@addr + @sz <= TASK_SIZE] which would
pass for @addr == -1

Fixed that by rewriting as [@addr <= TASK_SIZE - @sz]

Reported-by: Anton Kolesov <Anton.Kolesov@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
2013-09-27 16:28:47 +05:30
Vineet Gupta 0a5eae458e ARC: [optim] uaccess __{get,put}_user() optimised
Override asm-generic implementations. We basically gain on 2 fronts

* checks for alignment no longer needed as we are only doing "unit"
  sized copies.

  (Careful observer could argue that While the kernel buffers are aligned,
   the user buffer in theory might not be - however in that case the
   user space is already broken when it tries to deref a hword/word
   straddling word boundary - so we are not making it any worse).

* __copy_{to,from}_user( ) returns bytes that couldn't be copied,
  whereas get_user() returns 0 for success or -EFAULT (not size). Thus
  the code to do leftover bytes calculation can be avoided as well.

The savings were significant: ~17k of code.

bloat-o-meter vmlinux_uaccess_pre vmlinux_uaccess_post
add/remove: 0/4 grow/shrink: 8/118 up/down: 1262/-18758 (-17496)
							^^^^^^^^^
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
2013-02-11 20:00:32 +05:30
Vineet Gupta 43697cb097 ARC: uaccess friends
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
2013-02-11 20:00:31 +05:30