[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <dda3f0c3-a5ee-e648-fac1-d484e475634c@huawei.com>
Date: Tue, 9 Aug 2022 19:01:49 +0800
From: chenlifu <chenlifu@...wei.com>
To: <paul.walmsley@...ive.com>, <palmer@...belt.com>,
<aou@...s.berkeley.edu>, <akira.tsukamoto@...il.com>,
<jszhang@...nel.org>, <wangkefeng.wang@...wei.com>,
<linux-riscv@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
<alankao@...estech.com>
Subject: Re: [PATCH -next] riscv: lib: uaccess: fix CSR_STATUS SR_SUM bit
在 2022/7/15 11:47, chenlifu 写道:
>>> Since commit 5d8544e2d007 ("RISC-V: Generic library routines and
>>> assembly")
>>> and commit ebcbd75e3962 ("riscv: Fix the bug in memory access fixup
>>> code"),
>>> if __clear_user and __copy_user return from an fixup branch,
>>> CSR_STATUS SR_SUM bit will be set, it is a vulnerability, so that
>>> S-mode memory accesses to pages that are accessible by U-mode will
>>> success.
>>> Disable S-mode access to U-mode memory should clear SR_SUM bit.
>>>
>>> Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly")
>>> Fixes: ebcbd75e3962 ("riscv: Fix the bug in memory access fixup code")
>>>
>>> Signed-off-by: Chen Lifu <chenlifu@...wei.com>
>>> ---
>>> arch/riscv/lib/uaccess.S | 4 ++--
>>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/arch/riscv/lib/uaccess.S b/arch/riscv/lib/uaccess.S
>>> index 8c475f4da308..ec486e5369d9 100644
>>> --- a/arch/riscv/lib/uaccess.S
>>> +++ b/arch/riscv/lib/uaccess.S
>>> @@ -173,11 +173,11 @@ ENTRY(__asm_copy_from_user)
>>> ret
>>> /* Exception fixup code */
>>> 10:
>>> /* Disable access to user memory */
>>> - csrs CSR_STATUS, t6
>>> + csrc CSR_STATUS, t6
>>> mv a0, t5
>>> ret
>>> ENDPROC(__asm_copy_to_user)
>>> ENDPROC(__asm_copy_from_user)
>>> EXPORT_SYMBOL(__asm_copy_to_user)
>>> @@ -225,10 +225,10 @@ ENTRY(__clear_user)
>>> j 3b
>>> /* Exception fixup code */
>>> 11:
>>> /* Disable access to user memory */
>>> - csrs CSR_STATUS, t6
>>> + csrc CSR_STATUS, t6
>>> mv a0, a1
>>> ret
>>> ENDPROC(__clear_user)
>>> EXPORT_SYMBOL(__clear_user)
>>>
>>
>> friendly ping ...
>>
>
> friendly ping ...
>
>> _______________________________________________
>> linux-riscv mailing list
>> linux-riscv@...ts.infradead.org
>> http://lists.infradead.org/mailman/listinfo/linux-riscv
>> .
> .
friendly ping ...
Powered by blists - more mailing lists