• James Hogan's avatar
    MIPS: uaccess: Fix strlen_user with EVA · 5dc62fdd
    James Hogan authored
    The strlen_user() function calls __strlen_kernel_asm in both branches of
    the eva_kernel_access() conditional. For EVA it should be calling
    __strlen_user_eva for user accesses, otherwise it will load from the
    kernel address space instead of the user address space, and the access
    checking will likely be ineffective at preventing it due to EVA's
    overlapping user and kernel address spaces.
    
    This was found after extending the test_user_copy module to cover user
    string access functions, which gave the following error with EVA:
    
    test_user_copy: illegal strlen_user passed
    
    Fortunately the use of strlen_user() has been all but eradicated from
    the mainline kernel, so only out of tree modules could be affected.
    
    Fixes: e3a9b07a ("MIPS: asm: uaccess: Add EVA support for str*_user operations")
    Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
    Cc: Markos Chandras <markos.chandras@imgtec.com>
    Cc: Paul Burton <paul.burton@imgtec.com>
    Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
    Cc: linux-mips@linux-mips.org
    Cc: <stable@vger.kernel.org> # 3.15.x-
    Patchwork: https://patchwork.linux-mips.org/patch/10842/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
    5dc62fdd
uaccess.h 41.3 KB