Commit a1d09e07 authored by Julien Thierry's avatar Julien Thierry Committed by Russell King

ARM: 8797/1: spectre-v1.1: harden __copy_to_user

Sanitize user pointer given to __copy_to_user, both for standard version
and memcopy version of the user accessor.
Signed-off-by: default avatarJulien Thierry <julien.thierry@arm.com>
Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
parent afaf6838
...@@ -94,6 +94,11 @@ ...@@ -94,6 +94,11 @@
ENTRY(__copy_to_user_std) ENTRY(__copy_to_user_std)
WEAK(arm_copy_to_user) WEAK(arm_copy_to_user)
#ifdef CONFIG_CPU_SPECTRE
get_thread_info r3
ldr r3, [r3, #TI_ADDR_LIMIT]
uaccess_mask_range_ptr r0, r2, r3, ip
#endif
#include "copy_template.S" #include "copy_template.S"
...@@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std) ...@@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std)
rsb r0, r0, r2 rsb r0, r0, r2
copy_abort_end copy_abort_end
.popsection .popsection
...@@ -152,7 +152,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n) ...@@ -152,7 +152,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
n = __copy_to_user_std(to, from, n); n = __copy_to_user_std(to, from, n);
uaccess_restore(ua_flags); uaccess_restore(ua_flags);
} else { } else {
n = __copy_to_user_memcpy(to, from, n); n = __copy_to_user_memcpy(uaccess_mask_range_ptr(to, n),
from, n);
} }
return n; return n;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment