linux-kernel - [PATCH] MIPS: fix access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 20 Feb 2013 14:17:36 +0800
From:	Yong Zhang <yong.zhang0@...il.com>
To:	linux-mips@...ux-mips.org, linux-kernel@...r.kernel.org
Cc:	Ralf Baechle <ralf@...ux-mips.org>,
	David Daney <david.daney@...ium.com>
Subject: [PATCH] MIPS: fix access_ok()

From: Yong Zhang <yong.zhang@...driver.com>

Current access_ok() will fail even if the address range is
valid when it reaches to the end of TASK_SIZE.
For exampe: addr = 0xfffffffff0; size = 16;
the real address range it want to access is 0xfffffffff0~0xfffffffff;
but addr + size = 0x10000000000 which we will not and can't access.
In current realization of access_ok(), the high bit will be 1
thus access_ok() indicates the operation is not allowed.

The bug is found in old kerenl(before vdso is realized) in
following typical call trace:
sys_mount()
  copy_mount_options()
    exact_copy_from_user()
When the parameter 'from' for exact_copy_from_user() residents in
the last page of the task's virtual address, such as stack.
But it's still in current kernel.

Signed-off-by: Yong Zhang <yong.zhang0@...il.com>
Cc: Ralf Baechle <ralf@...ux-mips.org>
Cc: David Daney <david.daney@...ium.com>
---
 arch/mips/include/asm/uaccess.h |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 3b92efe..55d4214 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -114,8 +114,12 @@ extern u64 __ua_limit;
 	unsigned long __ok;						\
 									\
 	__chk_user_ptr(addr);						\
-	__ok = (signed long)(__mask & (__addr | (__addr + __size) |	\
-		__ua_size(__size)));					\
+	if (likely(size))						\
+		__ok = (signed long)(__mask & (__addr |			\
+				(__addr + __size - 1) |			\
+				__ua_size(__size)));			\
+	else								\
+		__ok = 0;						\
 	__ok == 0;							\
 })
 
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/