From 1ee5e87f86deca84fdcb7c71bb8368cacc4c24e3 Mon Sep 17 00:00:00 2001 From: Russell King Date: Wed, 25 Oct 2017 11:04:14 +0100 Subject: ARM: fix get_user_pages_fast Ensure that get_user_pages_fast() is not able to access memory which has been mapped with PROT_NONE. Reported-by: Al Viro Signed-off-by: Russell King --- arch/arm/include/asm/pgtable.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'arch/arm/include/asm') diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h index 1c462381c225..150ece66ddf3 100644 --- a/arch/arm/include/asm/pgtable.h +++ b/arch/arm/include/asm/pgtable.h @@ -232,6 +232,18 @@ static inline pte_t *pmd_page_vaddr(pmd_t pmd) #define pte_valid_user(pte) \ (pte_valid(pte) && pte_isset((pte), L_PTE_USER) && pte_young(pte)) +static inline bool pte_access_permitted(pte_t pte, bool write) +{ + pteval_t mask = L_PTE_PRESENT | L_PTE_USER; + pteval_t needed = mask; + + if (write) + mask |= L_PTE_RDONLY; + + return (pte_val(pte) & mask) == needed; +} +#define pte_access_permitted pte_access_permitted + #if __LINUX_ARM_ARCH__ < 6 static inline void __sync_icache_dcache(pte_t pteval) { -- cgit From 8bafae202c82dc257f649ea3c275a0f35ee15113 Mon Sep 17 00:00:00 2001 From: Russell King Date: Fri, 24 Nov 2017 23:49:34 +0000 Subject: ARM: BUG if jumping to usermode address in kernel mode Detect if we are returning to usermode via the normal kernel exit paths but the saved PSR value indicates that we are in kernel mode. This could occur due to corrupted stack state, which has been observed with "ftracetest". This ensures that we catch the problem case before we get to user code. Signed-off-by: Russell King --- arch/arm/include/asm/assembler.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'arch/arm/include/asm') diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h index ad301f107dd2..bc8d4bbd82e2 100644 --- a/arch/arm/include/asm/assembler.h +++ b/arch/arm/include/asm/assembler.h @@ -518,4 +518,22 @@ THUMB( orr \reg , \reg , #PSR_T_BIT ) #endif .endm + .macro bug, msg, line +#ifdef CONFIG_THUMB2_KERNEL +1: .inst 0xde02 +#else +1: .inst 0xe7f001f2 +#endif +#ifdef CONFIG_DEBUG_BUGVERBOSE + .pushsection .rodata.str, "aMS", %progbits, 1 +2: .asciz "\msg" + .popsection + .pushsection __bug_table, "aw" + .align 2 + .word 1b, 2b + .hword \line + .popsection +#endif + .endm + #endif /* __ASM_ASSEMBLER_H__ */ -- cgit