linux-stable.git/arch/arm/lib, branch v4.4.166

ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions

2018-05-26T06:48:57+00:00

commit 0d73c3f8e7f6ee2aab1bb350f60c180f5ae21a2c upstream.

Since do_undefinstr() uses get_user to get the undefined
instruction, it can be called before kprobes processes
recursive check. This can cause an infinit recursive
exception.
Prohibit probing on get_user functions.

Fixes: 24ba613c9d6c ("ARM kprobes: core code")
Signed-off-by: Masami Hiramatsu 
Cc: stable@vger.kernel.org
Signed-off-by: Russell King 
Signed-off-by: Greg Kroah-Hartman

ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch

2018-03-03T09:19:41+00:00

[ Upstream commit 36b0cb84ee858f02c256d26f0cb4229c78e3399e ]

An additional 'ip' will be pushed to the stack, for restoring the
DACR later, if CONFIG_CPU_SW_DOMAIN_PAN defined.

However, the fixup still get the err_ptr by add #8*4 to sp, which
results in the fact that the code area pointed by the LR will be
overwritten, or the kernel will crash if CONFIG_DEBUG_RODATA is enabled.

This patch fixes the stack mismatch.

Fixes: a5e090acbf54 ("ARM: software-based priviledged-no-access support")
Signed-off-by: Lvqiang Huang 
Signed-off-by: Chunyan Zhang 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

ARM: 8658/1: uaccess: fix zeroing of 64-bit get_user()

2017-02-23T16:43:09+00:00

commit 9e3440481845b2ec22508f60837ee2cab2b6054f upstream.

The 64-bit get_user() wasn't clearing the high word due to a typo in the
error handler. The exception handler entry was already correct, though.
Noticed during recent usercopy test additions in lib/test_user_copy.c.

Signed-off-by: Kees Cook 
Signed-off-by: Russell King 
Signed-off-by: Greg Kroah-Hartman

ARM: fix uaccess_with_memcpy() with SW_DOMAIN_PAN

2015-12-15T11:51:02+00:00

The uaccess_with_memcpy() code is currently incompatible with the SW
PAN code: it takes locks within the region that we've changed the DACR,
potentially sleeping as a result.  As we do not save and restore the
DACR across co-operative sleep events, can lead to an incorrect DACR
value later in this code path.

Reported-by: Peter Rosin 
Tested-by: Peter Rosin 
Signed-off-by: Russell King

ARM: 8438/1: Add unwinding to __clear_user_std()

2015-10-03T15:36:45+00:00

Add unwinding annotations so that unwinding from this function
works properly.

Signed-off-by: Stephen Boyd 
Signed-off-by: Russell King

Merge branches 'cleanup', 'fixes', 'misc', 'omap-barrier' and 'uaccess' into for-linus

2015-09-03T14:28:37+00:00

ARM: software-based priviledged-no-access support

2015-08-26T19:34:24+00:00

Provide a software-based implementation of the priviledged no access
support found in ARMv8.1.

Userspace pages are mapped using a different domain number from the
kernel and IO mappings.  If we switch the user domain to "no access"
when we enter the kernel, we can prevent the kernel from touching
userspace.

However, the kernel needs to be able to access userspace via the
various user accessor functions.  With the wrapping in the previous
patch, we can temporarily enable access when the kernel needs user
access, and re-disable it afterwards.

This allows us to trap non-intended accesses to userspace, eg, caused
by an inadvertent dereference of the LIST_POISON* values, which, with
appropriate user mappings setup, can be made to succeed.  This in turn
can allow use-after-free bugs to be further exploited than would
otherwise be possible.

Signed-off-by: Russell King

ARM: uaccess: provide uaccess_save_and_enable() and uaccess_restore()

2015-08-25T15:14:43+00:00

Provide uaccess_save_and_enable() and uaccess_restore() to permit
control of userspace visibility to the kernel, and hook these into
the appropriate places in the kernel where we need to access
userspace.

Signed-off-by: Russell King

ARM: 8414/1: __copy_to_user_memcpy: fix mmap semaphore usage

2015-08-18T12:59:59+00:00

The mmap semaphore should not be taken when page faults are disabled.
Since pagefault_disable() no longer disables preemption, we now need
to use faulthandler_disabled() in place of in_atomic().

Signed-off-by: Nicolas Pitre 
Tested-by: Mark Salter 
Signed-off-by: Russell King

ARM: avoid unwanted GCC memset()/memcpy() optimisations for IO variants

2015-07-03T19:46:15+00:00

We don't want GCC optimising our memset_io(), memcpy_fromio() or
memcpy_toio() variants, so we must not call one of the standard
functions.  Provide a separate name for our assembly memcpy() and
memset() functions, and use that instead, thereby bypassing GCC's
ability to optimise these operations.

GCCs optimisation may introduce unaligned accesses which are invalid
for device mappings.

Signed-off-by: Russell King