linux-kernel - Re: [PATCH V9 21/21] csky: support dword access for get_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 18 Oct 2018 11:41:18 +0800
From:   Guo Ren <ren_guo@...ky.com>
To:     Arnd Bergmann <arnd@...db.de>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Daniel Lezcano <daniel.lezcano@...aro.org>,
        David Miller <davem@...emloft.net>,
        gregkh <gregkh@...uxfoundation.org>,
        Christoph Hellwig <hch@...radead.org>,
        Marc Zyngier <marc.zyngier@....com>,
        Mark Rutland <mark.rutland@....com>,
        Peter Zijlstra <peterz@...radead.org>,
        Rob Herring <robh@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-arch <linux-arch@...r.kernel.org>,
        DTML <devicetree@...r.kernel.org>,
        Rob Herring <robh+dt@...nel.org>, c-sky_gcc_upstream@...ky.com
Subject: Re: [PATCH V9 21/21] csky: support dword access for get_user_size()

On Wed, Oct 17, 2018 at 05:44:17PM +0200, Arnd Bergmann wrote:
> On Tue, Oct 16, 2018 at 5:33 AM Guo Ren <ren_guo@...ky.com> wrote:
> >
> > Support dword access for get_user_size and redesign put_user_size with
> > the same style of get_user_size. It's Ok to use xxx_user_asm_common for
> > all size of variable with ldb, ldh, ldw, ld.d
> >
> > ld.d rx, (addr, 0) could "rx <= addr" "and r(x+1) <= addr+4" and this also
> > follow abiv2 gcc ABI for dword access.
> 
> Are you sure this is correct for this?
> 
> static inline u32 get_64_to_32(__u64 __user *p)
> {
>       u32 ret;
>       get_user(ret, p);
>       return ret;
> }
> 
> If I read __get_user_asm_common() right, the ld.d would overwrite
> two registers, but the caller only expects one, so it clobbers one
> that might be in use.
Ah... BUG! I only consider the get_user(u64, u64 *) :P

Change to:
case 8:							\
__get_user_asm_dword((x), ptr, "ld.d", retval);		\
break;

#define __get_user_asm_dword(x, ptr, err)		\
do {							\
	u64 tmp;					\
	__get_user_asm_common(tmp, ptr, "ld.d", err);	\
	x = typeof(x) tmp;				\
} while(0)

#define __put_user_asm_dword(x, ptr, err)		\
do {							\
	u64 tmp = (u64) x;				\
	__put_user_asm_common(tmp, ptr, "st.d", err);	\
} while(0)

Hmm?

Best Regards
 Guo Ren