• Vineet Gupta's avatar
    ARC: uaccess: get_user to zero out dest in cause of fault · 09baa6b1
    Vineet Gupta authored
    [ Upstream commit 05d9d0b9 ]
    
    Al reported potential issue with ARC get_user() as it wasn't clearing
    out destination pointer in case of fault due to bad address etc.
    
    Verified using following
    
    | {
    |  	u32 bogus1 = 0xdeadbeef;
    |	u64 bogus2 = 0xdead;
    |	int rc1, rc2;
    |
    |  	pr_info("Orig values %x %llx\n", bogus1, bogus2);
    |	rc1 = get_user(bogus1, (u32 __user *)0x40000000);
    |	rc2 = get_user(bogus2, (u64 __user *)0x50000000);
    |	pr_info("access %d %d, new values %x %llx\n",
    |		rc1, rc2, bogus1, bogus2);
    | }
    
    | [ARCLinux]# insmod /mnt/kernel-module/qtn.ko
    | Orig values deadbeef dead
    | access -14 -14, new values 0 0
    Reported-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: linux-snps-arc@lists.infradead.org
    Cc: linux-kernel@vger.kernel.org
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarVineet Gupta <vgupta@synopsys.com>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
    09baa6b1
uaccess.h 19.1 KB