lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()

The range passed to user_access_begin() by strncpy_from_user() and
strnlen_user() starts at 'src' and goes up to the limit of userspace
although reads will be limited by the 'count' param.

On 32 bits powerpc (book3s/32) access has to be granted for each
256Mbytes segment and the cost increases with the number of segments to
unlock.

Limit the range with 'count' param.

Fixes: 57c86a01540c ("make 'user_access_begin()' do 'access_ok()'")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
index dccb95af600322cc6a3f7db1229d52b47a6b037b..706020b06617ce6fae8e0e9517259a6a0fcfcb78 100644 (file)
--- a/lib/strncpy_from_user.c
+++ b/lib/strncpy_from_user.c
@@ -30,13 +30,6 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src,
        const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
        unsigned long res = 0;
 
-       /*
-        * Truncate 'max' to the user-specified limit, so that
-        * we only have one limit we need to check in the loop
-        */
-       if (max > count)
-               max = count;
-
        if (IS_UNALIGNED(src, dst))
                goto byte_at_a_time;
 
@@ -114,6 +107,13 @@ long strncpy_from_user(char *dst, const char __user *src, long count)
                unsigned long max = max_addr - src_addr;
                long retval;
 
+               /*
+                * Truncate 'max' to the user-specified limit, so that
+                * we only have one limit we need to check in the loop
+                */
+               if (max > count)
+                       max = count;
+
                kasan_check_write(dst, count);
                check_object_size(dst, count, false);
                if (user_access_begin(src, max)) {

diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
index 6c0005d5dd5c43e7ed4097c24d5fc785a794110e..41670d4a5816530d7b948fe29f0fad20a44ec2ed 100644 (file)
--- a/lib/strnlen_user.c
+++ b/lib/strnlen_user.c
@@ -26,13 +26,6 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
        unsigned long align, res = 0;
        unsigned long c;
 
-       /*
-        * Truncate 'max' to the user-specified limit, so that
-        * we only have one limit we need to check in the loop
-        */
-       if (max > count)
-               max = count;
-
        /*
         * Do everything aligned. But that means that we
         * need to also expand the maximum..
@@ -109,6 +102,13 @@ long strnlen_user(const char __user *str, long count)
                unsigned long max = max_addr - src_addr;
                long retval;
 
+               /*
+                * Truncate 'max' to the user-specified limit, so that
+                * we only have one limit we need to check in the loop
+                */
+               if (max > count)
+                       max = count;
+
                if (user_access_begin(str, max)) {
                        retval = do_strnlen_user(str, count, max);
                        user_access_end();