From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Julien Thierry <julien.thierry@arm.com>,
Russell King <rmk+kernel@armlinux.org.uk>,
"David A. Long" <dave.long@linaro.org>,
Sasha Levin <sashal@kernel.org>, Ard Biesheuvel <ardb@kernel.org>
Subject: [PATCH 4.4 65/75] ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
Date: Fri, 8 Nov 2019 19:50:22 +0100 [thread overview]
Message-ID: <20191108174806.118003985@linuxfoundation.org> (raw)
In-Reply-To: <20191108174708.135680837@linuxfoundation.org>
From: Julien Thierry <julien.thierry@arm.com>
Commit afaf6838f4bc896a711180b702b388b8cfa638fc upstream.
Introduce C and asm helpers to sanitize user address, taking the
address range they target into account.
Use asm helper for existing sanitization in __copy_from_user().
Signed-off-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David A. Long <dave.long@linaro.org>
Reviewed-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/assembler.h | 11 +++++++++++
arch/arm/include/asm/uaccess.h | 26 ++++++++++++++++++++++++++
arch/arm/lib/copy_from_user.S | 6 +-----
3 files changed, 38 insertions(+), 5 deletions(-)
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -461,6 +461,17 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
#endif
.endm
+ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
+#ifdef CONFIG_CPU_SPECTRE
+ sub \tmp, \limit, #1
+ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
+ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
+ subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) }
+ movlo \addr, #0 @ if (tmp < 0) addr = NULL
+ csdb
+#endif
+ .endm
+
.macro uaccess_disable, tmp, isb=1
#ifdef CONFIG_CPU_SW_DOMAIN_PAN
/*
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -138,6 +138,32 @@ static inline void set_fs(mm_segment_t f
__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
/*
+ * Sanitise a uaccess pointer such that it becomes NULL if addr+size
+ * is above the current addr_limit.
+ */
+#define uaccess_mask_range_ptr(ptr, size) \
+ ((__typeof__(ptr))__uaccess_mask_range_ptr(ptr, size))
+static inline void __user *__uaccess_mask_range_ptr(const void __user *ptr,
+ size_t size)
+{
+ void __user *safe_ptr = (void __user *)ptr;
+ unsigned long tmp;
+
+ asm volatile(
+ " sub %1, %3, #1\n"
+ " subs %1, %1, %0\n"
+ " addhs %1, %1, #1\n"
+ " subhss %1, %1, %2\n"
+ " movlo %0, #0\n"
+ : "+r" (safe_ptr), "=&r" (tmp)
+ : "r" (size), "r" (current_thread_info()->addr_limit)
+ : "cc");
+
+ csdb();
+ return safe_ptr;
+}
+
+/*
* Single-value transfer routines. They automatically use the right
* size if we just have the right pointer type. Note that the functions
* which read from user space (*get_*) need to take care not to leak
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -93,11 +93,7 @@ ENTRY(arm_copy_from_user)
#ifdef CONFIG_CPU_SPECTRE
get_thread_info r3
ldr r3, [r3, #TI_ADDR_LIMIT]
- adds ip, r1, r2 @ ip=addr+size
- sub r3, r3, #1 @ addr_limit - 1
- cmpcc ip, r3 @ if (addr+size > addr_limit - 1)
- movcs r1, #0 @ addr = NULL
- csdb
+ uaccess_mask_range_ptr r1, r2, r3, ip
#endif
#include "copy_template.S"
next prev parent reply other threads:[~2019-11-08 19:23 UTC|newest]
Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-08 18:49 [PATCH 4.4 00/75] 4.4.200-stable review Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 01/75] kbuild: add -fcf-protection=none when using retpoline flags Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 02/75] regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 03/75] regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe() could be uninitialized Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 04/75] ASoc: rockchip: i2s: Fix RPM imbalance Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 05/75] ARM: dts: logicpd-torpedo-som: Remove twl_keypad Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 06/75] ARM: mm: fix alignment handler faults under memory pressure Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 07/75] scsi: sni_53c710: fix compilation error Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 08/75] scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 09/75] perf kmem: Fix memory leak in compact_gfp_flags() Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 10/75] scsi: target: core: Do not overwrite CDB byte 1 Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 11/75] of: unittest: fix memory leak in unittest_data_add Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 12/75] MIPS: bmips: mark exception vectors as char arrays Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 13/75] cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 14/75] dccp: do not leak jiffies on the wire Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 15/75] net: fix sk_page_frag() recursion from memory reclaim Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 16/75] net: hisilicon: Fix ping latency when deal with high throughput Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 17/75] net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol() Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 18/75] net: add READ_ONCE() annotation in __skb_wait_for_more_packets() Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 19/75] vxlan: check tun_info options_len properly Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 20/75] net/mlx4_core: Dynamically set guaranteed amount of counters per VF Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 21/75] inet: stop leaking jiffies on the wire Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 22/75] net/flow_dissector: switch to siphash Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 23/75] dmaengine: qcom: bam_dma: Fix resource leak Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 24/75] ARM: 8051/1: put_user: fix possible data corruption in put_user Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 25/75] ARM: 8478/2: arm/arm64: add arm-smccc Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 26/75] ARM: 8479/2: add implementation for arm-smccc Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 27/75] ARM: 8480/2: arm64: " Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 28/75] ARM: 8481/2: drivers: psci: replace psci firmware calls Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 29/75] ARM: uaccess: remove put_user() code duplication Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 30/75] ARM: Move system register accessors to asm/cp15.h Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 31/75] arm/arm64: KVM: Advertise SMCCC v1.1 Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 32/75] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 33/75] firmware/psci: Expose PSCI conduit Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 34/75] firmware/psci: Expose SMCCC version through psci_ops Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 35/75] arm/arm64: smccc: Make function identifiers an unsigned quantity Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 36/75] arm/arm64: smccc: Implement SMCCC v1.1 inline primitive Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 37/75] arm/arm64: smccc: Add SMCCC-specific return codes Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 38/75] arm/arm64: smccc-1.1: Make return values unsigned long Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 39/75] arm/arm64: smccc-1.1: Handle function result as parameters Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 40/75] ARM: add more CPU part numbers for Cortex and Brahma B15 CPUs Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 41/75] ARM: bugs: prepare processor bug infrastructure Greg Kroah-Hartman
2019-11-08 18:49 ` [PATCH 4.4 42/75] ARM: bugs: hook processor bug checking into SMP and suspend paths Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 43/75] ARM: bugs: add support for per-processor bug checking Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 44/75] ARM: spectre: add Kconfig symbol for CPUs vulnerable to Spectre Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 45/75] ARM: spectre-v2: harden branch predictor on context switches Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 46/75] ARM: spectre-v2: add Cortex A8 and A15 validation of the IBE bit Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 47/75] ARM: spectre-v2: harden user aborts in kernel space Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 48/75] ARM: spectre-v2: add firmware based hardening Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 49/75] ARM: spectre-v2: warn about incorrect context switching functions Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 50/75] ARM: spectre-v1: add speculation barrier (csdb) macros Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 51/75] ARM: spectre-v1: add array_index_mask_nospec() implementation Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 52/75] ARM: spectre-v1: fix syscall entry Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 53/75] ARM: signal: copy registers using __copy_from_user() Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 54/75] ARM: vfp: use __copy_from_user() when restoring VFP state Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 55/75] ARM: oabi-compat: copy semops using __copy_from_user() Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 56/75] ARM: use __inttype() in get_user() Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 57/75] ARM: spectre-v1: use get_user() for __get_user() Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 58/75] ARM: spectre-v1: mitigate user accesses Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 59/75] ARM: 8789/1: signal: copy registers using __copy_to_user() Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 60/75] ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 61/75] ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user() Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 62/75] ARM: 8793/1: signal: replace __put_user_error with __put_user Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 63/75] ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 64/75] ARM: 8795/1: spectre-v1.1: use put_user() for __put_user() Greg Kroah-Hartman
2019-11-08 18:50 ` Greg Kroah-Hartman [this message]
2019-11-08 18:50 ` [PATCH 4.4 66/75] ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 67/75] ARM: make lookup_processor_type() non-__init Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 68/75] ARM: split out processor lookup Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 69/75] ARM: clean up per-processor check_bugs method call Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 70/75] ARM: add PROC_VTABLE and PROC_TABLE macros Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 71/75] ARM: spectre-v2: per-CPU vtables to work around big.Little systems Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 72/75] ARM: ensure that processor vtables is not lost after boot Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 73/75] ARM: fix the cockup in the previous patch Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 74/75] alarmtimer: Change remaining ENOTSUPP to EOPNOTSUPP Greg Kroah-Hartman
2019-11-08 18:50 ` [PATCH 4.4 75/75] fs/dcache: move security_d_instantiate() behind attaching dentry to inode Greg Kroah-Hartman
2019-11-09 1:17 ` [PATCH 4.4 00/75] 4.4.200-stable review kernelci.org bot
2019-11-09 10:32 ` Naresh Kamboju
2019-11-09 15:38 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191108174806.118003985@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ardb@kernel.org \
--cc=dave.long@linaro.org \
--cc=julien.thierry@arm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rmk+kernel@armlinux.org.uk \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).