From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:53157 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935781AbcIVPo2 (ORCPT ); Thu, 22 Sep 2016 11:44:28 -0400 Subject: Patch "mn10300: copy_from_user() should zero on access_ok() failure..." has been added to the 4.7-stable tree To: viro@zeniv.linux.org.uk, gregkh@linuxfoundation.org Cc: , From: Date: Thu, 22 Sep 2016 17:43:20 +0200 Message-ID: <14745590008055@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled mn10300: copy_from_user() should zero on access_ok() failure... to the 4.7-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mn10300-copy_from_user-should-zero-on-access_ok-failure.patch and it can be found in the queue-4.7 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From ae7cc577ec2a4a6151c9e928fd1f595d953ecef1 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 20 Aug 2016 16:33:10 -0400 Subject: mn10300: copy_from_user() should zero on access_ok() failure... From: Al Viro commit ae7cc577ec2a4a6151c9e928fd1f595d953ecef1 upstream. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- arch/mn10300/lib/usercopy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/mn10300/lib/usercopy.c +++ b/arch/mn10300/lib/usercopy.c @@ -9,7 +9,7 @@ * as published by the Free Software Foundation; either version * 2 of the Licence, or (at your option) any later version. */ -#include +#include unsigned long __generic_copy_to_user(void *to, const void *from, unsigned long n) @@ -24,6 +24,8 @@ __generic_copy_from_user(void *to, const { if (access_ok(VERIFY_READ, from, n)) __copy_user_zeroing(to, from, n); + else + memset(to, 0, n); return n; } Patches currently in stable-queue which might be from viro@zeniv.linux.org.uk are queue-4.7/nios2-copy_from_user-should-zero-the-tail-of-destination.patch queue-4.7/m32r-fix-__get_user.patch queue-4.7/microblaze-fix-copy_from_user.patch queue-4.7/cris-buggered-copy_from_user-copy_to_user-clear_user.patch queue-4.7/asm-generic-make-copy_from_user-zero-the-destination-properly.patch queue-4.7/metag-copy_from_user-should-zero-the-destination-on-access_ok-failure.patch queue-4.7/score-fix-__get_user-get_user.patch queue-4.7/parisc-fix-copy_from_user.patch queue-4.7/mips-copy_from_user-must-zero-the-destination-on-access_ok-failure.patch queue-4.7/alpha-fix-copy_from_user.patch queue-4.7/mn10300-failing-__get_user-and-get_user-should-zero.patch queue-4.7/openrisc-fix-copy_from_user.patch queue-4.7/avr32-fix-copy_from_user.patch queue-4.7/score-fix-copy_from_user-and-friends.patch queue-4.7/sh64-failing-__get_user-should-zero.patch queue-4.7/arc-uaccess-get_user-to-zero-out-dest-in-cause-of-fault.patch queue-4.7/hexagon-fix-strncpy_from_user-error-return.patch queue-4.7/af_unix-split-u-readlock-into-two-iolock-and-bindlock.patch queue-4.7/frv-fix-clear_user.patch queue-4.7/fix-minor-infoleak-in-get_user_ex.patch queue-4.7/asm-generic-make-get_user-clear-the-destination-on-errors.patch queue-4.7/mn10300-copy_from_user-should-zero-on-access_ok-failure.patch queue-4.7/s390-get_user-should-zero-on-failure.patch queue-4.7/microblaze-fix-__get_user.patch queue-4.7/blackfin-fix-copy_from_user.patch queue-4.7/fix-iov_iter_fault_in_readable.patch queue-4.7/nios2-fix-__get_user.patch queue-4.7/sh-fix-copy_from_user.patch