Merge tag 'usercopy-v4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull usercopy protection from Kees Cook:
 "Tbhis implements HARDENED_USERCOPY verification of copy_to_user and
  copy_from_user bounds checking for most architectures on SLAB and
  SLUB"

* tag 'usercopy-v4.8' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  mm: SLUB hardened usercopy support
  mm: SLAB hardened usercopy support
  s390/uaccess: Enable hardened usercopy
  sparc/uaccess: Enable hardened usercopy
  powerpc/uaccess: Enable hardened usercopy
  ia64/uaccess: Enable hardened usercopy
  arm64/uaccess: Enable hardened usercopy
  ARM: uaccess: Enable hardened usercopy
  x86/uaccess: Enable hardened usercopy
  mm: Hardened usercopy
  mm: Implement stack frame object validation
  mm: Add is_migrate_cma_page

2 files changed, 19 insertions, 6 deletions

diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
index 57aca2792d29..341a5a133f48 100644
--- a/arch/sparc/include/asm/uaccess_32.h
+++ b/arch/sparc/include/asm/uaccess_32.h
@@ -248,22 +248,28 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon
 
 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-        if (n && __access_ok((unsigned long) to, n))
+        if (n && __access_ok((unsigned long) to, n)) {
+                if (!__builtin_constant_p(n))
+                        check_object_size(from, n, true);
                 return __copy_user(to, (__force void __user *) from, n);
-        else
+        } else
                 return n;
 }
 
 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
+        if (!__builtin_constant_p(n))
+                check_object_size(from, n, true);
         return __copy_user(to, (__force void __user *) from, n);
 }
 
 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        if (n && __access_ok((unsigned long) from, n))
+        if (n && __access_ok((unsigned long) from, n)) {
+                if (!__builtin_constant_p(n))
+                        check_object_size(to, n, false);
                 return __copy_user((__force void __user *) to, from, n);
-        else
+        } else
                 return n;
 }
 
diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
index e9a51d64974d..8bda94fab8e8 100644
--- a/arch/sparc/include/asm/uaccess_64.h
+++ b/arch/sparc/include/asm/uaccess_64.h
@@ -210,8 +210,12 @@ unsigned long copy_from_user_fixup(void *to, const void __user *from,
 static inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long size)
 {
-        unsigned long ret = ___copy_from_user(to, from, size);
+        unsigned long ret;
 
+        if (!__builtin_constant_p(size))
+                check_object_size(to, size, false);
+
+        ret = ___copy_from_user(to, from, size);
         if (unlikely(ret))
                 ret = copy_from_user_fixup(to, from, size);
 
@@ -227,8 +231,11 @@ unsigned long copy_to_user_fixup(void __user *to, const void *from,
 static inline unsigned long __must_check
 copy_to_user(void __user *to, const void *from, unsigned long size)
 {
-        unsigned long ret = ___copy_to_user(to, from, size);
+        unsigned long ret;
 
+        if (!__builtin_constant_p(size))
+                check_object_size(from, size, true);
+        ret = ___copy_to_user(to, from, size);
         if (unlikely(ret))
                 ret = copy_to_user_fixup(to, from, size);
         return ret;