aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHirokazu Takata <takata@linux-m32r.org>2006-04-11 01:53:20 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2006-04-11 09:18:34 -0400
commit04dfd0de4ec04aaf7d9d42439c972c642a15a75c (patch)
tree26f093671aee900dadc7458f774eb9eb9e209b78
parent7c1c4e541888947947bc46a18a9a5543a259ed62 (diff)
[PATCH] m32r: security fix of {get,put}_user macros
Update {get,put}_user macros for m32r kernel. - Modify get_user to use __get_user_asm macro, instead of __get_user_x macro. - Remove arch/m32r/lib/{get,put}user.S. - Some cosmetic updates. I would like to thank NIIBE Yutaka for his reporting about the m32r kernel's security problem in {get,put}_user macros. There were no address checking for user space access in {get,put}_user macros. ;-) Signed-off-by: Hirokazu Takata <takata@linux-m32r.org> Cc: NIIBE Yutaka <gniibe@fsij.org> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat
-rw-r--r--arch/m32r/kernel/m32r_ksyms.c4
-rw-r--r--arch/m32r/lib/Makefile4
-rw-r--r--arch/m32r/lib/getuser.S88
-rw-r--r--arch/m32r/lib/putuser.S84
-rw-r--r--include/asm-m32r/uaccess.h266
5 files changed, 117 insertions, 329 deletions
diff --git a/arch/m32r/kernel/m32r_ksyms.c b/arch/m32r/kernel/m32r_ksyms.c
index be8b711367ec..60009508dbe6 100644
--- a/arch/m32r/kernel/m32r_ksyms.c
+++ b/arch/m32r/kernel/m32r_ksyms.c
@@ -38,10 +38,6 @@ EXPORT_SYMBOL(__udelay);
38EXPORT_SYMBOL(__delay); 38EXPORT_SYMBOL(__delay);
39EXPORT_SYMBOL(__const_udelay); 39EXPORT_SYMBOL(__const_udelay);
40 40
41EXPORT_SYMBOL(__get_user_1);
42EXPORT_SYMBOL(__get_user_2);
43EXPORT_SYMBOL(__get_user_4);
44
45EXPORT_SYMBOL(strpbrk); 41EXPORT_SYMBOL(strpbrk);
46EXPORT_SYMBOL(strstr); 42EXPORT_SYMBOL(strstr);
47 43
diff --git a/arch/m32r/lib/Makefile b/arch/m32r/lib/Makefile
index e632d10c7d78..d16b4e40d1ae 100644
--- a/arch/m32r/lib/Makefile
+++ b/arch/m32r/lib/Makefile
@@ -2,6 +2,6 @@
2# Makefile for M32R-specific library files.. 2# Makefile for M32R-specific library files..
3# 3#
4 4
5lib-y := checksum.o ashxdi3.o memset.o memcpy.o getuser.o \ 5lib-y := checksum.o ashxdi3.o memset.o memcpy.o \
6 putuser.o delay.o strlen.o usercopy.o csum_partial_copy.o 6 delay.o strlen.o usercopy.o csum_partial_copy.o
7 7
diff --git a/arch/m32r/lib/getuser.S b/arch/m32r/lib/getuser.S
deleted file mode 100644
index 58a0db055c5c..000000000000
--- a/arch/m32r/lib/getuser.S
+++ /dev/null
@@ -1,88 +0,0 @@
1/*
2 * __get_user functions.
3 *
4 * (C) Copyright 2001 Hirokazu Takata
5 *
6 * These functions have a non-standard call interface
7 * to make them more efficient, especially as they
8 * return an error value in addition to the "real"
9 * return value.
10 */
11
12#include <linux/config.h>
13
14/*
15 * __get_user_X
16 *
17 * Inputs: r0 contains the address
18 *
19 * Outputs: r0 is error code (0 or -EFAULT)
20 * r1 contains zero-extended value
21 *
22 * These functions should not modify any other registers,
23 * as they get called from within inline assembly.
24 */
25
26#ifdef CONFIG_ISA_DUAL_ISSUE
27
28 .text
29 .balign 4
30 .globl __get_user_1
31__get_user_1:
321: ldub r1, @r0 || ldi r0, #0
33 jmp r14
34
35 .balign 4
36 .globl __get_user_2
37__get_user_2:
382: lduh r1, @r0 || ldi r0, #0
39 jmp r14
40
41 .balign 4
42 .globl __get_user_4
43__get_user_4:
443: ld r1, @r0 || ldi r0, #0
45 jmp r14
46
47bad_get_user:
48 ldi r1, #0 || ldi r0, #-14
49 jmp r14
50
51#else /* not CONFIG_ISA_DUAL_ISSUE */
52
53 .text
54 .balign 4
55 .globl __get_user_1
56__get_user_1:
571: ldub r1, @r0
58 ldi r0, #0
59 jmp r14
60
61 .balign 4
62 .globl __get_user_2
63__get_user_2:
642: lduh r1, @r0
65 ldi r0, #0
66 jmp r14
67
68 .balign 4
69 .globl __get_user_4
70__get_user_4:
713: ld r1, @r0
72 ldi r0, #0
73 jmp r14
74
75bad_get_user:
76 ldi r1, #0
77 ldi r0, #-14
78 jmp r14
79
80#endif /* not CONFIG_ISA_DUAL_ISSUE */
81
82.section __ex_table,"a"
83 .long 1b,bad_get_user
84 .long 2b,bad_get_user
85 .long 3b,bad_get_user
86.previous
87
88 .end
diff --git a/arch/m32r/lib/putuser.S b/arch/m32r/lib/putuser.S
deleted file mode 100644
index 218154cc3890..000000000000
--- a/arch/m32r/lib/putuser.S
+++ /dev/null
@@ -1,84 +0,0 @@
1/*
2 * __put_user functions.
3 *
4 * (C) Copyright 1998 Linus Torvalds
5 * (C) Copyright 2001 Hirokazu Takata
6 *
7 * These functions have a non-standard call interface
8 * to make them more efficient.
9 */
10
11#include <linux/config.h>
12
13/*
14 * __put_user_X
15 *
16 * Inputs: r0 contains the address
17 * r1 contains the value
18 *
19 * Outputs: r0 is error code (0 or -EFAULT)
20 * r1 is corrupted (will contain "current_task").
21 *
22 * These functions should not modify any other registers,
23 * as they get called from within inline assembly.
24 */
25
26#ifdef CONFIG_ISA_DUAL_ISSUE
27
28 .text
29 .balign 4
30 .globl __put_user_1
31__put_user_1:
321: stb r1, @r0 || ldi r0, #0
33 jmp r14
34
35 .balign 4
36 .globl __put_user_2
37__put_user_2:
382: sth r1, @r0 || ldi r0, #0
39 jmp r14
40
41 .balign 4
42 .globl __put_user_4
43__put_user_4:
443: st r1, @r0 || ldi r0, #0
45 jmp r14
46
47bad_put_user:
48 ldi r0, #-14 || jmp r14
49
50#else /* not CONFIG_ISA_DUAL_ISSUE */
51
52 .text
53 .balign 4
54 .globl __put_user_1
55__put_user_1:
561: stb r1, @r0
57 ldi r0, #0
58 jmp r14
59
60 .balign 4
61 .globl __put_user_2
62__put_user_2:
632: sth r1, @r0
64 ldi r0, #0
65 jmp r14
66
67 .balign 4
68 .globl __put_user_4
69__put_user_4:
703: st r1, @r0
71 ldi r0, #0
72 jmp r14
73
74bad_put_user:
75 ldi r0, #-14
76 jmp r14
77
78#endif /* not CONFIG_ISA_DUAL_ISSUE */
79
80.section __ex_table,"a"
81 .long 1b,bad_put_user
82 .long 2b,bad_put_user
83 .long 3b,bad_put_user
84.previous
diff --git a/include/asm-m32r/uaccess.h b/include/asm-m32r/uaccess.h
index e8ae61956a51..819cc28a94f7 100644
--- a/