linux-kernel - [PATCH v3] asm-generic: {get,put}_user ptr argument evaluate only 1 time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1437459289-26553-1-git-send-email-ysato@users.sourceforge.jp>
Date:	Tue, 21 Jul 2015 15:14:49 +0900
From:	Yoshinori Sato <ysato@...rs.sourceforge.jp>
To:	Arnd Bergmann <arnd@...db.de>
Cc:	Yoshinori Sato <ysato@...rs.sourceforge.jp>,
	linux-arch@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH v3] asm-generic: {get,put}_user ptr argument evaluate only 1 time

Current implemantation ptr argument evaluate 2 times.
It'll be an unexpected result.

Changes v3:
Some build error fix.
Changes v2:
Argument x protect.

Signed-off-by: Yoshinori Sato <ysato@...rs.sourceforge.jp>
---
 include/asm-generic/uaccess.h | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
index 72d8803..d800a3f 100644
--- a/include/asm-generic/uaccess.h
+++ b/include/asm-generic/uaccess.h
@@ -163,9 +163,10 @@ static inline __must_check long __copy_to_user(void __user *to,
 
 #define put_user(x, ptr)					\
 ({								\
+	uintptr_t __uip = (uintptr_t)(ptr);			\
 	might_fault();						\
-	access_ok(VERIFY_WRITE, ptr, sizeof(*ptr)) ?		\
-		__put_user(x, ptr) :				\
+	access_ok(VERIFY_WRITE, __uip, sizeof(*ptr)) ?		\
+		__put_user((x), ((__typeof__(*ptr) *)__uip)) :	\
 		-EFAULT;					\
 })
 
@@ -225,9 +226,10 @@ extern int __put_user_bad(void) __attribute__((noreturn));
 
 #define get_user(x, ptr)					\
 ({								\
+	uintptr_t __uip = (uintptr_t)(ptr);			\
 	might_fault();						\
-	access_ok(VERIFY_READ, ptr, sizeof(*ptr)) ?		\
-		__get_user(x, ptr) :				\
+	access_ok(VERIFY_READ, __uip, sizeof(*ptr)) ?		\
+		__get_user((x), (__typeof__(*ptr) *)__uip) :	\
 		-EFAULT;					\
 })
 
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/