https://github.com/torvalds/linux
Revision 2a418cf3f5f1caf911af288e978d61c9844b0695 authored by Andy Lutomirski on 23 February 2019, 01:17:04 UTC, committed by Borislav Petkov on 25 February 2019, 19:17:05 UTC
When calling __put_user(foo(), ptr), the __put_user() macro would call foo() in between __uaccess_begin() and __uaccess_end(). If that code were buggy, then those bugs would be run without SMAP protection. Fortunately, there seem to be few instances of the problem in the kernel. Nevertheless, __put_user() should be fixed to avoid doing this. Therefore, evaluate __put_user()'s argument before setting AC. This issue was noticed when an objtool hack by Peter Zijlstra complained about genregs_get() and I compared the assembly output to the C source. [ bp: Massage commit message and fixed up whitespace. ] Fixes: 11f1a4b9755f ("x86: reorganize SMAP handling in user space accesses") Signed-off-by: Andy Lutomirski <luto@kernel.org> Signed-off-by: Borislav Petkov <bp@suse.de> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Brian Gerst <brgerst@gmail.com> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/20190225125231.845656645@infradead.org
1 parent f331e76
Tip revision: 2a418cf3f5f1caf911af288e978d61c9844b0695 authored by Andy Lutomirski on 23 February 2019, 01:17:04 UTC
x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
Tip revision: 2a418cf
File | Mode | Size |
---|---|---|
Kconfig | -rw-r--r-- | 27.0 KB |
Makefile | -rw-r--r-- | 5.2 KB |
atmel-quadspi.c | -rw-r--r-- | 15.4 KB |
internals.h | -rw-r--r-- | 1.2 KB |
spi-altera.c | -rw-r--r-- | 5.9 KB |
spi-armada-3700.c | -rw-r--r-- | 24.0 KB |
spi-at91-usart.c | -rw-r--r-- | 11.7 KB |
spi-ath79.c | -rw-r--r-- | 7.4 KB |
spi-atmel.c | -rw-r--r-- | 46.5 KB |
spi-au1550.c | -rw-r--r-- | 25.7 KB |
spi-axi-spi-engine.c | -rw-r--r-- | 15.0 KB |
spi-bcm-qspi.c | -rw-r--r-- | 36.3 KB |
spi-bcm-qspi.h | -rw-r--r-- | 3.0 KB |
spi-bcm2835.c | -rw-r--r-- | 29.1 KB |
spi-bcm2835aux.c | -rw-r--r-- | 15.0 KB |
spi-bcm63xx-hsspi.c | -rw-r--r-- | 13.7 KB |
spi-bcm63xx.c | -rw-r--r-- | 17.2 KB |
spi-bitbang-txrx.h | -rw-r--r-- | 3.3 KB |
spi-bitbang.c | -rw-r--r-- | 11.1 KB |
spi-brcmstb-qspi.c | -rw-r--r-- | 1.5 KB |
spi-butterfly.c | -rw-r--r-- | 8.4 KB |
spi-cadence.c | -rw-r--r-- | 22.7 KB |
spi-cavium-octeon.c | -rw-r--r-- | 2.5 KB |
spi-cavium-thunderx.c | -rw-r--r-- | 2.6 KB |
spi-cavium.c | -rw-r--r-- | 3.5 KB |
spi-cavium.h | -rw-r--r-- | 7.2 KB |
spi-clps711x.c | -rw-r--r-- | 4.7 KB |
spi-coldfire-qspi.c | -rw-r--r-- | 13.1 KB |
spi-davinci.c | -rw-r--r-- | 27.7 KB |
spi-dln2.c | -rw-r--r-- | 20.7 KB |
spi-dw-mid.c | -rw-r--r-- | 7.9 KB |
spi-dw-mmio.c | -rw-r--r-- | 6.8 KB |
spi-dw-pci.c | -rw-r--r-- | 3.5 KB |
spi-dw.c | -rw-r--r-- | 14.6 KB |
spi-dw.h | -rw-r--r-- | 6.3 KB |
spi-efm32.c | -rw-r--r-- | 11.8 KB |
spi-ep93xx.c | -rw-r--r-- | 19.7 KB |
spi-falcon.c | -rw-r--r-- | 10.4 KB |
spi-fsl-cpm.c | -rw-r--r-- | 10.1 KB |
spi-fsl-cpm.h | -rw-r--r-- | 1.6 KB |
spi-fsl-dspi.c | -rw-r--r-- | 28.6 KB |
spi-fsl-espi.c | -rw-r--r-- | 21.3 KB |
spi-fsl-lib.c | -rw-r--r-- | 4.3 KB |
spi-fsl-lib.h | -rw-r--r-- | 3.3 KB |
spi-fsl-lpspi.c | -rw-r--r-- | 13.7 KB |
spi-fsl-spi.c | -rw-r--r-- | 22.6 KB |
spi-fsl-spi.h | -rw-r--r-- | 2.0 KB |
spi-geni-qcom.c | -rw-r--r-- | 18.6 KB |
spi-gpio.c | -rw-r--r-- | 14.3 KB |
spi-img-spfi.c | -rw-r--r-- | 20.7 KB |
spi-imx.c | -rw-r--r-- | 45.4 KB |
spi-iproc-qspi.c | -rw-r--r-- | 4.2 KB |
spi-jcore.c | -rw-r--r-- | 5.3 KB |
spi-lantiq-ssc.c | -rw-r--r-- | 26.1 KB |
spi-lm70llp.c | -rw-r--r-- | 9.0 KB |
spi-loopback-test.c | -rw-r--r-- | 26.5 KB |
spi-lp8841-rtc.c | -rw-r--r-- | 5.9 KB |
spi-mem.c | -rw-r--r-- | 19.3 KB |
spi-meson-spicc.c | -rw-r--r-- | 16.2 KB |
spi-meson-spifc.c | -rw-r--r-- | 11.3 KB |
spi-mpc512x-psc.c | -rw-r--r-- | 16.1 KB |
spi-mpc52xx-psc.c | -rw-r--r-- | 13.0 KB |
spi-mpc52xx.c | -rw-r--r-- | 14.1 KB |
spi-mt65xx.c | -rw-r--r-- | 22.7 KB |
spi-mxic.c | -rw-r--r-- | 14.8 KB |
spi-mxs.c | -rw-r--r-- | 16.0 KB |
spi-npcm-pspi.c | -rw-r--r-- | 11.1 KB |
spi-nuc900.c | -rw-r--r-- | 8.9 KB |
spi-oc-tiny.c | -rw-r--r-- | 8.6 KB |
spi-omap-100k.c | -rw-r--r-- | 12.4 KB |
spi-omap-uwire.c | -rw-r--r-- | 12.4 KB |
spi-omap2-mcspi.c | -rw-r--r-- | 40.5 KB |
spi-orion.c | -rw-r--r-- | 21.1 KB |
spi-pic32-sqi.c | -rw-r--r-- | 18.6 KB |
spi-pic32.c | -rw-r--r-- | 22.6 KB |
spi-pl022.c | -rw-r--r-- | 68.0 KB |
spi-ppc4xx.c | -rw-r--r-- | 13.6 KB |
spi-pxa2xx-dma.c | -rw-r--r-- | 6.4 KB |
spi-pxa2xx-pci.c | -rw-r--r-- | 7.2 KB |
spi-pxa2xx.c | -rw-r--r-- | 49.6 KB |
spi-pxa2xx.h | -rw-r--r-- | 3.5 KB |
spi-qcom-qspi.c | -rw-r--r-- | 14.3 KB |
spi-qup.c | -rw-r--r-- | 32.8 KB |
spi-rb4xx.c | -rw-r--r-- | 5.1 KB |
spi-rockchip.c | -rw-r--r-- | 21.9 KB |
spi-rspi.c | -rw-r--r-- | 35.1 KB |
spi-s3c24xx-fiq.S | -rw-r--r-- | 2.9 KB |
spi-s3c24xx-fiq.h | -rw-r--r-- | 671 bytes |
spi-s3c24xx.c | -rw-r--r-- | 15.1 KB |
spi-s3c64xx.c | -rw-r--r-- | 38.0 KB |
spi-sc18is602.c | -rw-r--r-- | 8.5 KB |
spi-sh-hspi.c | -rw-r--r-- | 6.1 KB |
spi-sh-msiof.c | -rw-r--r-- | 39.0 KB |
spi-sh-sci.c | -rw-r--r-- | 4.8 KB |
spi-sh.c | -rw-r--r-- | 11.2 KB |
spi-sirf.c | -rw-r--r-- | 35.5 KB |
spi-slave-mt27xx.c | -rw-r--r-- | 13.2 KB |
spi-slave-system-control.c | -rw-r--r-- | 3.6 KB |
spi-slave-time.c | -rw-r--r-- | 2.9 KB |
spi-sprd-adi.c | -rw-r--r-- | 13.6 KB |
spi-sprd.c | -rw-r--r-- | 18.7 KB |
spi-st-ssc4.c | -rw-r--r-- | 11.0 KB |
spi-stm32-qspi.c | -rw-r--r-- | 12.1 KB |
spi-stm32.c | -rw-r--r-- | 34.7 KB |
spi-sun4i.c | -rw-r--r-- | 13.8 KB |
spi-sun6i.c | -rw-r--r-- | 14.8 KB |
spi-tegra114.c | -rw-r--r-- | 33.1 KB |
spi-tegra20-sflash.c | -rw-r--r-- | 16.3 KB |
spi-tegra20-slink.c | -rw-r--r-- | 34.0 KB |
spi-test.h | -rw-r--r-- | 5.3 KB |
spi-ti-qspi.c | -rw-r--r-- | 20.5 KB |
spi-tle62x0.c | -rw-r--r-- | 7.2 KB |
spi-topcliff-pch.c | -rw-r--r-- | 45.7 KB |
spi-txx9.c | -rw-r--r-- | 10.8 KB |
spi-uniphier.c | -rw-r--r-- | 12.2 KB |
spi-xcomm.c | -rw-r--r-- | 5.8 KB |
spi-xilinx.c | -rw-r--r-- | 14.5 KB |
spi-xlp.c | -rw-r--r-- | 11.7 KB |
spi-xtensa-xtfpga.c | -rw-r--r-- | 4.0 KB |
spi-zynqmp-gqspi.c | -rw-r--r-- | 34.6 KB |
spi.c | -rw-r--r-- | 97.3 KB |
spidev.c | -rw-r--r-- | 21.4 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...