xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Browse Source 
Pull address-limit checking fixes from Ingo Molnar:
 "This fixes a number of bugs in the address-limit (USER_DS) checks that
  got introduced in the merge window, (mostly) affecting the ARM and
  ARM64 platforms"

* 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  arm64/syscalls: Move address limit check in loop
  arm/syscalls: Optimize address limit check
  Revert "arm/syscalls: Check address limit on user-mode return"
  syscalls: Use CHECK_DATA_CORRUPTION for addr_limit_user_check
This commit is contained in:
Linus Torvalds
2017-09-24 11:53:13 -07:00
parent a302824782 a2048e34d4
commit a4306434b7
6 changed files with 38 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
include/linux/syscalls.h
View File

@@ -221,22 +221,26 @@ static inline int is_syscall_trace_event(struct trace_event_call *tp_event)
} \
static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__))
#ifdef TIF_FSCHECK
/*
* Called before coming back to user-mode. Returning to user-mode with an
* address limit different than USER_DS can allow to overwrite kernel memory.
*/
static inline void addr_limit_user_check(void)
{
#ifdef TIF_FSCHECK
if (!test_thread_flag(TIF_FSCHECK))
return;
BUG_ON(!segment_eq(get_fs(), USER_DS));
clear_thread_flag(TIF_FSCHECK);
}
#endif
if (CHECK_DATA_CORRUPTION(!segment_eq(get_fs(), USER_DS),
"Invalid address limit on user-mode return"))
force_sig(SIGKILL, current);
#ifdef TIF_FSCHECK
clear_thread_flag(TIF_FSCHECK);
#endif
}
asmlinkage long sys32_quotactl(unsigned int cmd, const char __user *special,
qid_t id, void __user *addr);
asmlinkage long sys_time(time_t __user *tloc);