]> git.baikalelectronics.ru Git - kernel.git/commit
MIPS: uaccess: Fix strlen_user with EVA
authorJames Hogan <james.hogan@imgtec.com>
Wed, 5 Aug 2015 15:41:37 +0000 (16:41 +0100)
committerRalf Baechle <ralf@linux-mips.org>
Tue, 22 Dec 2015 10:54:13 +0000 (11:54 +0100)
commite7891d61abcdc908c41a054928952194cc266964
treeb5c3dd44291acc0d96ebf4088d6f07f970b846c8
parent76066219c1aa9865e8fc88181b8dc2f6356df9ce
MIPS: uaccess: Fix strlen_user with EVA

The strlen_user() function calls __strlen_kernel_asm in both branches of
the eva_kernel_access() conditional. For EVA it should be calling
__strlen_user_eva for user accesses, otherwise it will load from the
kernel address space instead of the user address space, and the access
checking will likely be ineffective at preventing it due to EVA's
overlapping user and kernel address spaces.

This was found after extending the test_user_copy module to cover user
string access functions, which gave the following error with EVA:

test_user_copy: illegal strlen_user passed

Fortunately the use of strlen_user() has been all but eradicated from
the mainline kernel, so only out of tree modules could be affected.

Fixes: c0250ac92b9c ("MIPS: asm: uaccess: Add EVA support for str*_user operations")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: <stable@vger.kernel.org> # 3.15.x-
Patchwork: https://patchwork.linux-mips.org/patch/10842/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
arch/mips/include/asm/uaccess.h