summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-04-26Merge branches 'uaccess.alpha', 'uaccess.arc', 'uaccess.arm', ↵Al Viro1311-12582/+18197
'uaccess.arm64', 'uaccess.avr32', 'uaccess.bfin', 'uaccess.c6x', 'uaccess.cris', 'uaccess.frv', 'uaccess.h8300', 'uaccess.hexagon', 'uaccess.ia64', 'uaccess.m32r', 'uaccess.m68k', 'uaccess.metag', 'uaccess.microblaze', 'uaccess.mips', 'uaccess.mn10300', 'uaccess.nios2', 'uaccess.openrisc', 'uaccess.parisc', 'uaccess.powerpc', 'uaccess.s390', 'uaccess.score', 'uaccess.sh', 'uaccess.sparc', 'uaccess.tile', 'uaccess.um', 'uaccess.unicore32', 'uaccess.x86' and 'uaccess.xtensa' into work.uaccess
2017-04-26m32r: switch to RAW_COPY_USERAl Viro4-115/+8
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-25hexagon: switch to RAW_COPY_USERAl Viro5-17/+15
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-11microblaze: switch to RAW_COPY_USERAl Viro2-28/+9
[kudos to Piotr Sroka for spotting a braino in the previous variant] Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-07get rid of padding, switch to RAW_COPY_USERAl Viro3-43/+6
Merced is fucked, so what else is new? Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-07ia64: get rid of copy_in_user()Al Viro1-10/+0
it hadn't been biarch for years Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-07ia64: sanitize __access_ok()Al Viro1-16/+16
turn into static inline, kill the 'segment' argument. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-07ia64: get rid of 'segment' argument of __do_{get,put}_user()Al Viro1-8/+8
it's only evaluated if the first argument is not 0, and in those cases it's always equal to get_fs() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-07ia64: get rid of 'segment' argument of __{get,put}_user_check()Al Viro1-4/+4
always equal to get_fs() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-07ia64: add extable.hAl Viro3-8/+16
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-07Merge commit 'b4fb8f66f1ae2e167d06c12d018025a8d4d3ba7e' into uaccess.ia64Al Viro106-326/+1407
backmerge of mainline ia64 fix
2017-04-06powerpc: get rid of zeroing, switch to RAW_COPY_USERAl Viro6-138/+14
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06Merge commit 'a7d2475af7aedcb9b5c6343989a8bfadbf84429b' into uaccess.powerpcAl Viro20-124/+729
backmerge of sorting the arch/powerpc/Kconfig
2017-04-06esas2r: don't open-code memdup_user()Al Viro1-22/+3
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06alpha: fix stack smashing in old_adjtimex(2)Al Viro1-1/+1
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06don't open-code kernel_setsockopt()Al Viro3-32/+6
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06mips: switch to RAW_COPY_USERAl Viro2-248/+27
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06mips: get rid of tail-zeroing in primitivesAl Viro3-96/+3
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06mips: make copy_from_user() zero tail explicitlyAl Viro1-7/+7
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06mips: clean and reorder the forest of macros...Al Viro1-71/+49
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06mips: consolidate __invoke_... wrappersAl Viro1-100/+44
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06mips: sanitize __access_ok()Al Viro4-29/+20
for one thing, the last argument is always __access_mask and had been such since 2.4.0-test3pre8; for another, it can bloody well be a static inline - -O2 or -Os, __builtin_constant_p() propagates through static inline calls. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-06Merge commit 'fc69910f329d' into uaccess.mipsAl Viro115-295/+1363
backmerge of a build fix from mainline
2017-04-05metag/usercopy: Switch to RAW_COPY_USERJames Hogan3-32/+6
Switch to using raw user copy instead of providing metag specific [__]copy_{to,from}_user[_inatomic](). This simplifies the metag uaccess.h and allows us to take advantage of extra checking in the generic versions. Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-metag@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-05Merge branch 'fixes' of ↵Al Viro2-199/+128
git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag into uaccess.metag
2017-04-05metag/usercopy: Add missing fixupsJames Hogan1-24/+48
The rapf copy loops in the Meta usercopy code is missing some extable entries for HTP cores with unaligned access checking enabled, where faults occur on the instruction immediately after the faulting access. Add the fixup labels and extable entries for these cases so that corner case user copy failures don't cause kernel crashes. Fixes: 373cd784d0fc ("metag: Memory handling") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org
2017-04-05metag/usercopy: Fix src fixup in from user rapf loopsJames Hogan1-8/+28
The fixup code to rewind the source pointer in __asm_copy_from_user_{32,64}bit_rapf_loop() always rewound the source by a single unit (4 or 8 bytes), however this is insufficient if the fault didn't occur on the first load in the loop, as the source pointer will have been incremented but nothing will have been stored until all 4 register [pairs] are loaded. Read the LSM_STEP field of TXSTATUS (which is already loaded into a register), a bit like the copy_to_user versions, to determine how many iterations of MGET[DL] have taken place, all of which need rewinding. Fixes: 373cd784d0fc ("metag: Memory handling") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org
2017-04-05metag/usercopy: Set flags before ADDZJames Hogan1-4/+4
The fixup code for the copy_to_user rapf loops reads TXStatus.LSM_STEP to decide how far to rewind the source pointer. There is a special case for the last execution of an MGETL/MGETD, since it leaves LSM_STEP=0 even though the number of MGETLs/MGETDs attempted was 4. This uses ADDZ which is conditional upon the Z condition flag, but the AND instruction which masked the TXStatus.LSM_STEP field didn't set the condition flags based on the result. Fix that now by using ANDS which does set the flags, and also marking the condition codes as clobbered by the inline assembly. Fixes: 373cd784d0fc ("metag: Memory handling") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org
2017-04-05metag/usercopy: Zero rest of buffer from copy_from_userJames Hogan2-46/+26
Currently we try to zero the destination for a failed read from userland in fixup code in the usercopy.c macros. The rest of the destination buffer is then zeroed from __copy_user_zeroing(), which is used for both copy_from_user() and __copy_from_user(). Unfortunately we fail to zero in the fixup code as D1Ar1 is set to 0 before the fixup code entry labels, and __copy_from_user() shouldn't even be zeroing the rest of the buffer. Move the zeroing out into copy_from_user() and rename __copy_user_zeroing() to raw_copy_from_user() since it no longer does any zeroing. This also conveniently matches the name needed for RAW_COPY_USER support in a later patch. Fixes: 373cd784d0fc ("metag: Memory handling") Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org
2017-04-05metag/usercopy: Add early abort to copy_to_userJames Hogan1-0/+20
When copying to userland on Meta, if any faults are encountered immediately abort the copy instead of continuing on and repeatedly faulting, and worse potentially copying further bytes successfully to subsequent valid pages. Fixes: 373cd784d0fc ("metag: Memory handling") Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org
2017-04-05metag/usercopy: Fix alignment error checkingJames Hogan1-6/+4
Fix the error checking of the alignment adjustment code in raw_copy_from_user(), which mistakenly considers it safe to skip the error check when aligning the source buffer on a 2 or 4 byte boundary. If the destination buffer was unaligned it may have started to copy using byte or word accesses, which could well be at the start of a new (valid) source page. This would result in it appearing to have copied 1 or 2 bytes at the end of the first (invalid) page rather than none at all. Fixes: 373cd784d0fc ("metag: Memory handling") Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org
2017-04-05metag/usercopy: Drop unused macrosJames Hogan1-113/+0
Metag's lib/usercopy.c has a bunch of copy_from_user macros for larger copies between 5 and 16 bytes which are completely unused. Before fixing zeroing lets drop these macros so there is less to fix. Signed-off-by: James Hogan <james.hogan@imgtec.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org
2017-04-04xtensa: fix prefetch in the raw_copy_to_userMax Filippov1-1/+1
'from' is the input buffer, it should be prefetched with prefetch, not prefetchw. Tested-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-02sparc: switch to RAW_COPY_USERAl Viro21-94/+37
... and drop zeroing in sparc32. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-02parisc: switch to RAW_COPY_USERAl Viro3-63/+16
... and remove dead declarations, while we are at it Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-04-02Merge branch 'parisc-4.11-3' of ↵Al Viro1124-8157/+16577
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux into uaccess.parisc
2017-03-30s390: get rid of zeroing, switch to RAW_COPY_USERAl Viro3-156/+33
[folded a fix from Martin] Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-30ARC: uaccess: enable INLINE_COPY_{TO,FROM}_USER ...Vineet Gupta2-24/+6
... and switch to generic out of line version in lib/usercopy.c Signed-off-by: Vineet Gupta <vgupta@synopsys.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-29parisc: Avoid stalled CPU warnings after system shutdownHelge Deller1-0/+2
Commit 73580dac7618 ("parisc: Fix system shutdown halt") introduced an endless loop for systems which don't provide a software power off function. But the soft lockup detector will detect this and report stalled CPUs after some time. Avoid those unwanted warnings by disabling the soft lockup detector. Fixes: 73580dac7618 ("parisc: Fix system shutdown halt") Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org # 4.9+
2017-03-29parisc: Clean up fixup routines for get_user()/put_user()Helge Deller5-134/+52
Al Viro noticed that userspace accesses via get_user()/put_user() can be simplified a lot with regard to usage of the exception handling. This patch implements a fixup routine for get_user() and put_user() in such that the exception handler will automatically load -EFAULT into the register %r8 (the error value) in case on a fault on userspace. Additionally the fixup routine will zero the target register on fault in case of a get_user() call. The target register is extracted out of the faulting assembly instruction. This patch brings a few benefits over the old implementation: 1. Exception handling gets much cleaner, easier and smaller in size. 2. Helper functions like fixup_get_user_skip_1 (all of fixup.S) can be dropped. 3. No need to hardcode %r9 as target register for get_user() any longer. This helps the compiler register allocator and thus creates less assembler statements. 4. No dependency on the exception_data contents any longer. 5. Nested faults will be handled cleanly. Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Cc: <stable@vger.kernel.org> # v4.9+ Signed-off-by: Helge Deller <deller@gmx.de>
2017-03-29parisc: Fix access fault handling in pa_memcpy()Helge Deller2-458/+321
pa_memcpy() is the major memcpy implementation in the parisc kernel which is used to do any kind of userspace/kernel memory copies. Al Viro noticed various bugs in the implementation of pa_mempcy(), most notably that in case of faults it may report back to have copied more bytes than it actually did. Fixing those bugs is quite hard in the C-implementation, because the compiler is messing around with the registers and we are not guaranteed that specific variables are always in the same processor registers. This makes proper fault handling complicated. This patch implements pa_memcpy() in assembler. That way we have correct fault handling and adding a 64-bit copy routine was quite easy. Runtime tested with 32- and 64bit kernels. Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Cc: <stable@vger.kernel.org> # v4.9+ Signed-off-by: John David Anglin <dave.anglin@bell.net> Signed-off-by: Helge Deller <deller@gmx.de>
2017-03-29x86: switch to RAW_COPY_USERAl Viro6-395/+24
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-29x86: don't wank with magical size in __copy_in_user()Al Viro2-65/+2
... especially since copy_in_user() doesn't Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-29arc: switch to RAW_COPY_USERAl Viro2-4/+5
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-29xtensa: get rid of zeroing, use RAW_COPY_USERAl Viro3-114/+57
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-29xtensa: switch to generic extable.hAl Viro2-6/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-29kill __copy_from_user_nocache()Al Viro5-164/+2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-29unicore32: get rid of zeroing and switch to RAW_COPY_USERAl Viro5-17/+16
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-29amd64: get rid of zeroingAl Viro4-16/+25
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-03-29um: switch to RAW_COPY_USERAl Viro3-8/+9
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
generated by cgit v1.2.3 (git 2.39.0) at 2024-12-18 12:26:16 +0300