linux/arch/arm64/lib
Kyle McMartin 97fc15436b arm64: __clear_user: handle exceptions on strb
ARM64 currently doesn't fix up faults on the single-byte (strb) case of
__clear_user... which means that we can cause a nasty kernel panic as an
ordinary user with any multiple PAGE_SIZE+1 read from /dev/zero.
i.e.: dd if=/dev/zero of=foo ibs=1 count=1 (or ibs=65537, etc.)

This is a pretty obscure bug in the general case since we'll only
__do_kernel_fault (since there's no extable entry for pc) if the
mmap_sem is contended. However, with CONFIG_DEBUG_VM enabled, we'll
always fault.

if (!down_read_trylock(&mm->mmap_sem)) {
	if (!user_mode(regs) && !search_exception_tables(regs->pc))
		goto no_context;
retry:
	down_read(&mm->mmap_sem);
} else {
	/*
	 * The above down_read_trylock() might have succeeded in
	 * which
	 * case, we'll have missed the might_sleep() from
	 * down_read().
	 */
	might_sleep();
	if (!user_mode(regs) && !search_exception_tables(regs->pc))
		goto no_context;
}

Fix that by adding an extable entry for the strb instruction, since it
touches user memory, similar to the other stores in __clear_user.

Signed-off-by: Kyle McMartin <kyle@redhat.com>
Reported-by: Miloš Prchlík <mprchlik@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2014-11-13 15:21:26 +00:00
..
Makefile arm64: lib: Implement optimized string length routines 2014-05-23 15:17:12 +01:00
bitops.S arm64: atomics: fix use of acquire + release for full barrier semantics 2014-02-07 16:45:43 +00:00
clear_page.S arm64: Miscellaneous library functions 2012-09-17 13:42:18 +01:00
clear_user.S arm64: __clear_user: handle exceptions on strb 2014-11-13 15:21:26 +00:00
copy_from_user.S
copy_in_user.S
copy_page.S arm64: Miscellaneous library functions 2012-09-17 13:42:18 +01:00
copy_to_user.S
delay.c arm64: Miscellaneous library functions 2012-09-17 13:42:18 +01:00
memchr.S arm64: klib: Optimised memory functions 2013-03-21 17:39:29 +00:00
memcmp.S arm64: lib: Implement optimized memcmp routine 2014-05-23 15:07:57 +01:00
memcpy.S arm64: lib: Implement optimized memcpy routine 2014-05-23 15:06:53 +01:00
memmove.S arm64: lib: Implement optimized memmove routine 2014-05-23 15:07:35 +01:00
memset.S arm64: lib: Implement optimized memset routine 2014-05-23 15:07:48 +01:00
strchr.S arm64: klib: Optimised string functions 2013-03-21 17:39:30 +00:00
strcmp.S arm64: lib: Implement optimized string compare routines 2014-05-23 15:16:59 +01:00
strlen.S arm64: lib: Implement optimized string length routines 2014-05-23 15:17:12 +01:00
strncmp.S arm64: lib: Implement optimized string compare routines 2014-05-23 15:16:59 +01:00
strnlen.S arm64: lib: Implement optimized string length routines 2014-05-23 15:17:12 +01:00
strrchr.S arm64: klib: Optimised string functions 2013-03-21 17:39:30 +00:00