From patchwork Thu Jan 10 17:51:42 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Long X-Patchwork-Id: 155253 Delivered-To: patches@linaro.org Received: by 2002:a02:48:0:0:0:0:0 with SMTP id 69csp2176206jaa; Thu, 10 Jan 2019 09:52:06 -0800 (PST) X-Received: by 2002:a37:b201:: with SMTP id b1mr9791554qkf.306.1547142726113; Thu, 10 Jan 2019 09:52:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1547142726; cv=none; d=google.com; s=arc-20160816; b=rmbZ+B8iv8t0NL9hy+pv4X6Dfq3SLpIxpaC9Irllokj+xeqlJDo2CpUK/HNDuOxqpk NgspIr5GKjnnSP8BHhWtpTniZti0P+sx0jh/Y2H/icih2ea+KCbKaAPz9Uwkxly+1F1d oJ0QpQgTPOHCIPfFkhZrc8aPVdPyeSil62LeabVT2SwpGP5I1pbvuZH+20gX60kxYG47 e2gVSZQ7fOW7/fby4r5uFgmosod57YlvVFJZOPX5tAouxA6Hn6dVo0Mc5pvNnJI9mfNn 30ix8oF502w5Y8kdBn3bf1tz8Sw7gKNnSZPATdo9OI3V+swa4cqcNsGpglDhWOm0j45W J98A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=cmHxjX3QWGEzbd3gID8OLJBVtbh3tUIgNET1gXVqzGU=; b=NVFd7ayxu2DZHx3GP62gvmybY9/EXCo2HUipgUo+RzIN2cD20BY3m0VfefpAsN4nrG EhUYwAzENEmT4GOQ7yGNpylCHIa/nHHVYiMQ3Un0X9uXNK6V6xLZEmfO3QHZOE4GBeHz IKailYw/EW2ezmYjgPV+WFZlV6g1784hGBQ/9zFqFsJpPR4BTiLTUv7/vHNt32GQqzx4 PqDEvMnb1VR5WQemcPV5OXqd1JfR9gmPwPvgqTIjNoVm4jvJaWxCbj2enQduDm3yPtb/ ac1p/7sM47WvLB9Q++YdY0RgNd8tugAyvoF+q/A/z0MLYenSzqzfQJPEBXItFNhW+BQL VJcg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=WUCZy8f1; spf=pass (google.com: domain of dave.long@linaro.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=dave.long@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id b127sor36321137qkc.48.2019.01.10.09.52.06 for (Google Transport Security); Thu, 10 Jan 2019 09:52:06 -0800 (PST) Received-SPF: pass (google.com: domain of dave.long@linaro.org designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=WUCZy8f1; spf=pass (google.com: domain of dave.long@linaro.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=dave.long@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=cmHxjX3QWGEzbd3gID8OLJBVtbh3tUIgNET1gXVqzGU=; b=WUCZy8f1BSH+sPmVcr2/btSvnRLljKRpk9Tb3KBEV2FJPHpI5PUSJUuwxe7ry6pmH1 NAfK8E8BmGT661BZuVyoExpieMepiivnOr9BaBgv5oJfKLzlPijLrPEIDZ5T6oC+Dbl1 wPt901JSvYAc8VwJ3Tpd1ha+4f994qEljFrXA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=cmHxjX3QWGEzbd3gID8OLJBVtbh3tUIgNET1gXVqzGU=; b=LTqSEp+It57mZMtGql3iK9iVSmadpgT+0u/3vwF48U1U9+PBWqQ6wci9nIM4vJZIGM 2ryLr/kGTtj3ZEku04rsvZX0EEqEa5a1y9J92HUu0ZU5Fm3JV/BKrZpQnWMt0I9pGplQ x0q53n5R65caXIhP5zZvL5cHaL5FHCG3KKjXZx/knPZzlBeCcdZP/3p0je1vAz8Xay9v 8Ly+aBk7xA8rewA1XYoUQWf4jbqF7l2wMAJOjo4ahSgc6S4e1RKnv22ayloij+gs2K9p MS8aREOdk1Hj9VHU/gaquVGOOUVmG3JExm7uo0866fEXBGaQXi035iI0zVHzX9LQmZKM qvjA== X-Gm-Message-State: AJcUukce+SFZ9iArx4NYCbmFoqJc1R7I6VALIrrmubhfodTBVwgWe3Lj KA4UW1NGR48l87X2AW5Suk0RIufk X-Google-Smtp-Source: ALg8bN7bBCLkIpWTKRwRun7BQUsTE1uldGzdL8es1VHOPni3i42f/pzpZV6++odKjsklWxjcKe/slw== X-Received: by 2002:a37:4145:: with SMTP id o66mr9823783qka.129.1547142725868; Thu, 10 Jan 2019 09:52:05 -0800 (PST) Return-Path: Received: from localhost.localdomain (pool-72-71-243-63.cncdnh.fast00.myfairpoint.net. [72.71.243.63]) by smtp.googlemail.com with ESMTPSA id b8sm41815904qka.79.2019.01.10.09.52.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 10 Jan 2019 09:52:05 -0800 (PST) From: David Long To: stable@vger.kernel.org, Russell King - ARM Linux , Florian Fainelli , Julien Thierry , Tony Lindgren , Marc Zyngier , Mark Rutland Cc: Greg KH , Mark Brown Subject: [PATCH 4.14 09/17] ARM: 8797/1: spectre-v1.1: harden __copy_to_user Date: Thu, 10 Jan 2019 12:51:42 -0500 Message-Id: <20190110175150.5239-10-dave.long@linaro.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190110175150.5239-1-dave.long@linaro.org> References: <20190110175150.5239-1-dave.long@linaro.org> From: Julien Thierry Commit a1d09e074250fad24f1b993f327b18cc6812eb7a upstream. Sanitize user pointer given to __copy_to_user, both for standard version and memcopy version of the user accessor. Signed-off-by: Julien Thierry Signed-off-by: Russell King Signed-off-by: David A. Long --- arch/arm/lib/copy_to_user.S | 6 +++++- arch/arm/lib/uaccess_with_memcpy.c | 3 ++- 2 files changed, 7 insertions(+), 2 deletions(-) -- 2.17.1 diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S index caf5019d8161..970abe521197 100644 --- a/arch/arm/lib/copy_to_user.S +++ b/arch/arm/lib/copy_to_user.S @@ -94,6 +94,11 @@ ENTRY(__copy_to_user_std) WEAK(arm_copy_to_user) +#ifdef CONFIG_CPU_SPECTRE + get_thread_info r3 + ldr r3, [r3, #TI_ADDR_LIMIT] + uaccess_mask_range_ptr r0, r2, r3, ip +#endif #include "copy_template.S" @@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std) rsb r0, r0, r2 copy_abort_end .popsection - diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c index 9b4ed1728616..73dc7360cbdd 100644 --- a/arch/arm/lib/uaccess_with_memcpy.c +++ b/arch/arm/lib/uaccess_with_memcpy.c @@ -152,7 +152,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n) n = __copy_to_user_std(to, from, n); uaccess_restore(ua_flags); } else { - n = __copy_to_user_memcpy(to, from, n); + n = __copy_to_user_memcpy(uaccess_mask_range_ptr(to, n), + from, n); } return n; }