Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59e65b4b authored by Alex Shi's avatar Alex Shi
Browse files

Merge remote-tracking branch 'v4.4/topic/mm-kaslr-pax_usercopy' into linux-linaro-lsk-v4.4

parents e779279d 3ad78bad

arch/Kconfig

+9 −0
Original line number Diff line number Diff line
@@ -423,6 +423,15 @@ config CC_STACKPROTECTOR_STRONG 


endchoice



config HAVE_ARCH_WITHIN_STACK_FRAMES

	bool

	help

	  An architecture should select this if it can walk the kernel stack

	  frames to determine if an object is part of either the arguments

	  or local variables (i.e. that it excludes saved return addresses,

	  and similar) by implementing an inline arch_within_stack_frames(),

	  which is used by CONFIG_HARDENED_USERCOPY.



config HAVE_CONTEXT_TRACKING

	bool

	help

arch/arm/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ config ARM 
	select HAVE_ARCH_BITREVERSE if (CPU_32v7M || CPU_32v7) && !CPU_32v6

	select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL && !CPU_ENDIAN_BE32

	select HAVE_ARCH_KGDB if !CPU_ENDIAN_BE32

	select HAVE_ARCH_HARDENED_USERCOPY

	select HAVE_ARCH_SECCOMP_FILTER if (AEABI && !OABI_COMPAT)

	select HAVE_ARCH_TRACEHOOK

	select HAVE_BPF_JIT

arch/arm/include/asm/uaccess.h

+9 −2
Original line number Diff line number Diff line
@@ -496,7 +496,10 @@ arm_copy_from_user(void *to, const void __user *from, unsigned long n); 
static inline unsigned long __must_check

__copy_from_user(void *to, const void __user *from, unsigned long n)

{

	unsigned int __ua_flags = uaccess_save_and_enable();

	unsigned int __ua_flags;



	check_object_size(to, n, false);

	__ua_flags = uaccess_save_and_enable();

	n = arm_copy_from_user(to, from, n);

	uaccess_restore(__ua_flags);

	return n;
@@ -511,11 +514,15 @@ static inline unsigned long __must_check 
__copy_to_user(void __user *to, const void *from, unsigned long n)

{

#ifndef CONFIG_UACCESS_WITH_MEMCPY

	unsigned int __ua_flags = uaccess_save_and_enable();

	unsigned int __ua_flags;



	check_object_size(from, n, true);

	__ua_flags = uaccess_save_and_enable();

	n = arm_copy_to_user(to, from, n);

	uaccess_restore(__ua_flags);

	return n;

#else

	check_object_size(from, n, true);

	return arm_copy_to_user(to, from, n);

#endif

}

arch/arm64/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -49,6 +49,7 @@ config ARM64 
	select HAVE_ALIGNED_STRUCT_PAGE if SLUB

	select HAVE_ARCH_AUDITSYSCALL

	select HAVE_ARCH_BITREVERSE

	select HAVE_ARCH_HARDENED_USERCOPY

	select HAVE_ARCH_HUGE_VMAP

	select HAVE_ARCH_JUMP_LABEL

	select HAVE_ARCH_KASAN if SPARSEMEM_VMEMMAP && !(ARM64_16K_PAGES && ARM64_VA_BITS_48)

arch/arm64/include/asm/uaccess.h

+22 −7
Original line number Diff line number Diff line
@@ -269,24 +269,39 @@ do { \ 
		-EFAULT;						\

})



extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);

extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);

extern unsigned long __must_check __arch_copy_from_user(void *to, const void __user *from, unsigned long n);

extern unsigned long __must_check __arch_copy_to_user(void __user *to, const void *from, unsigned long n);

extern unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n);

extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);



static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)

{

	check_object_size(to, n, false);

	return __arch_copy_from_user(to, from, n);

}



static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)

{

	check_object_size(from, n, true);

	return __arch_copy_to_user(to, from, n);

}



static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)

{

	if (access_ok(VERIFY_READ, from, n))

		n = __copy_from_user(to, from, n);

	else /* security hole - plug it */

	if (access_ok(VERIFY_READ, from, n)) {

		check_object_size(to, n, false);

		n = __arch_copy_from_user(to, from, n);

	} else /* security hole - plug it */

		memset(to, 0, n);

	return n;

}



static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)

{

	if (access_ok(VERIFY_WRITE, to, n))

		n = __copy_to_user(to, from, n);

	if (access_ok(VERIFY_WRITE, to, n)) {

		check_object_size(from, n, true);

		n = __arch_copy_to_user(to, from, n);

	}

	return n;

}