x86, smap: Handle csum_partial_copy_*_user()

Add SMAP annotations to csum_partial_copy_to/from_user().  These
functions legitimately access user space and thus need to set the AC
flag.

TODO: add explicit checks that the side with the kernel space pointer
really points into kernel space.

Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/n/tip-2aps0u00eer658fd5xyanan7@git.kernel.org
Cc: <stable@vger.kernel.org> # v3.7+

1 files changed, 17 insertions, 5 deletions

diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
index 46fc474fd819..f50de6951738 100644
--- a/arch/x86/include/asm/checksum_32.h
+++ b/arch/x86/include/asm/checksum_32.h
@@ -49,9 +49,15 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
                                                  int len, __wsum sum,
                                                  int *err_ptr)
 {
+        __wsum ret;
+
         might_sleep();
-        return csum_partial_copy_generic((__force void *)src, dst,
-                                         len, sum, err_ptr, NULL);
+        stac();
+        ret = csum_partial_copy_generic((__force void *)src, dst,
+                                        len, sum, err_ptr, NULL);
+        clac();
+
+        return ret;
 }
 
 /*
@@ -176,10 +182,16 @@ static inline __wsum csum_and_copy_to_user(const void *src,
                                            int len, __wsum sum,
                                            int *err_ptr)
 {
+        __wsum ret;
+
         might_sleep();
-        if (access_ok(VERIFY_WRITE, dst, len))
-                return csum_partial_copy_generic(src, (__force void *)dst,
-                                                 len, sum, NULL, err_ptr);
+        if (access_ok(VERIFY_WRITE, dst, len)) {
+                stac();
+                ret = csum_partial_copy_generic(src, (__force void *)dst,
+                                                len, sum, NULL, err_ptr);
+                clac();
+                return ret;
+        }
 
         if (len)
                 *err_ptr = -EFAULT;