linux-kernel - [PATCH 4.11 081/150] staging/lustre/lov: remove set_fs() call from lov

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170612152522.869646343@linuxfoundation.org>
Date:   Mon, 12 Jun 2017 17:24:48 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, "John L. Hammond" <john.hammond@...el.com>,
        Andreas Dilger <andreas.dilger@...el.com>,
        Li Wei <wei.g.li@...el.com>, Oleg Drokin <green@...uxhacker.ru>
Subject: [PATCH 4.11 081/150] staging/lustre/lov: remove set_fs() call from lov_getstripe()

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oleg Drokin <green@...uxhacker.ru>

commit 0a33252e060e97ed3fbdcec9517672f1e91aaef3 upstream.

lov_getstripe() calls set_fs(KERNEL_DS) so that it can handle a struct
lov_user_md pointer from user- or kernel-space.  This changes the
behavior of copy_from_user() on SPARC and may result in a misaligned
access exception which in turn oopses the kernel.  In fact the
relevant argument to lov_getstripe() is never called with a
kernel-space pointer and so changing the address limits is unnecessary
and so we remove the calls to save, set, and restore the address
limits.

Signed-off-by: John L. Hammond <john.hammond@...el.com>
Reviewed-on: http://review.whamcloud.com/6150
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3221
Reviewed-by: Andreas Dilger <andreas.dilger@...el.com>
Reviewed-by: Li Wei <wei.g.li@...el.com>
Signed-off-by: Oleg Drokin <green@...uxhacker.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 drivers/staging/lustre/lustre/lov/lov_pack.c |    9 ---------
 1 file changed, 9 deletions(-)

--- a/drivers/staging/lustre/lustre/lov/lov_pack.c
+++ b/drivers/staging/lustre/lustre/lov/lov_pack.c
@@ -293,18 +293,10 @@ int lov_getstripe(struct lov_object *obj
 	size_t lmmk_size;
 	size_t lum_size;
 	int rc;
-	mm_segment_t seg;

 	if (!lsm)
 		return -ENODATA;

-	/*
-	 * "Switch to kernel segment" to allow copying from kernel space by
-	 * copy_{to,from}_user().
-	 */
-	seg = get_fs();
-	set_fs(KERNEL_DS);
-
 	if (lsm->lsm_magic != LOV_MAGIC_V1 && lsm->lsm_magic != LOV_MAGIC_V3) {
 		CERROR("bad LSM MAGIC: 0x%08X != 0x%08X nor 0x%08X\n",
 		       lsm->lsm_magic, LOV_MAGIC_V1, LOV_MAGIC_V3);
@@ -406,6 +398,5 @@ int lov_getstripe(struct lov_object *obj
 out_free:
 	kvfree(lmmk);
 out:
-	set_fs(seg);
 	return rc;
 }