From patchwork Fri Mar 15 19:51:30 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Konovalov X-Patchwork-Id: 10855533 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4C6CE13B5 for ; Fri, 15 Mar 2019 19:53:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2B3CB2AC5A for ; Fri, 15 Mar 2019 19:53:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1917D2AC5D; Fri, 15 Mar 2019 19:53:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id BCB4E2AC5A for ; Fri, 15 Mar 2019 19:53:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:To:From:Subject:References:Mime-Version :Message-Id:In-Reply-To:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=UpHi/tAoP7vwWetGyOzOaLz/ZYyXeuq6C7Ue1h9HPM4=; b=RXT3aSgNW/6IzY Dj0LeVmbnYbzN88UIHCRd6eHpbC7bMrrcQYhHdKOpZTbAVhaQ19jyqWC8tZ3El6zYhFA0gCCavMRe b9mBguM9GMPEwHfYqg3SvW73VpXVGWZ9pEMwJLbU/uQROonOd5vK8F8OYlG5BXgV30DngWoiCgCLu WlfrYfYv9ITqCPqw6DT/8PfC9OXYypquVILopWfu2QCyNNAH/4T1/uYjt8PqJjiD8QGjJH0X+YW8D ZOG0x9NdBtB4RsPvn/uRhiNyGy8EhdqZ1TJKWbJGTYF1VNGQvxb0tYVX/dba8soh18gv9+3pSqwrz sJuHN3A7OXJdlG8e2pxw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1h4stK-0000LP-QE; Fri, 15 Mar 2019 19:53:18 +0000 Received: from mail-yw1-xc49.google.com ([2607:f8b0:4864:20::c49]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1h4ss8-0007Bm-Re for linux-arm-kernel@lists.infradead.org; Fri, 15 Mar 2019 19:52:11 +0000 Received: by mail-yw1-xc49.google.com with SMTP id t9so13142509ywe.19 for ; Fri, 15 Mar 2019 12:52:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=z/lbJIk5a8zt10jywFDNy5ZdetbtZxhqc2S4ejPNJ3g=; b=vzUF5/hV3N6LymY3D+bJBpSatNRK6fXpwnZa/1KVNOg7xeGxEXTPkbw+wbEOfgpNDR np5G4rL7T1cd+Sz5iJ0RCOtU4P6bLZVS0l14Aq6zvISFR6mzBUWQWKFDoL13DmN3dbM+ SpIGClyUMZd9169+i8j5m3A6jrJ+Hyb10rwBPEQoaeyLAtm17DlPNuWH2RVG7xX1Y6TF 9LKSfozE1SWXebNzzat2ugJn18cSW7bw5YZG+7kazfWFB4UEOKlKg3watEf4bHP24M7o 9DP2o8Vqy0brwdDfGOvD+zN5V6FQV40T4Y8K+j9OS7OnApB4pexBW7Q518EArWyVitEY H6yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=z/lbJIk5a8zt10jywFDNy5ZdetbtZxhqc2S4ejPNJ3g=; b=cvmaDS/BeUVRqiBd2ze0Pfg7RP2RpZUhquUr6By2MScuRIEFNrxDAj78XqZQfCv4/h l3qzMclgbYV7t9T/IUlDpJsgi5K99ysVJD0I13ppljTcZ4rPSWdOsXmwx0RhLeMXakdY FdcHju/61GYuYO7eE5rwHGaVpQNGpknqHobnNxeTerMNStg1/Q8veOVzR4Ia1aZC69ZY uPPY/wOKmetFf0GZ0RFoCF3uXaqzXFRawTxXQeaAY0y7PiUwHc8NpIx6fvESOTMgZCfx /StxBQUrMLknaf99BeIDMXw1jS7Q3ZrNX/3P6dLon8kWIi3rxGM+ahhY7VHo52N4faKp inGA== X-Gm-Message-State: APjAAAVphAMm/vTRdAVWu5gVMr7iZ2H6PI/EFr3aY269O9O37uQyQp4p ibMhUpY9i1di3UZ92B4MjmKD9ErIUtArf1sE X-Google-Smtp-Source: APXvYqzi5LEkko6ByM4uqeA/ILUmpPQs4A8NqtI2/DdkNKEbP39lGUp9icnx2HlBixyjeGCue9FZGuIPU0jeuK+1 X-Received: by 2002:a81:8a46:: with SMTP id a67mr2389102ywg.26.1552679522975; Fri, 15 Mar 2019 12:52:02 -0700 (PDT) Date: Fri, 15 Mar 2019 20:51:30 +0100 In-Reply-To: Message-Id: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.21.0.360.g471c308f928-goog Subject: [PATCH v11 06/14] fs, arm64: untag user pointers in copy_mount_options From: Andrey Konovalov To: Catalin Marinas , Will Deacon , Mark Rutland , Robin Murphy , Kees Cook , Kate Stewart , Greg Kroah-Hartman , Andrew Morton , Ingo Molnar , "Kirill A . Shutemov" , Shuah Khan , Vincenzo Frascino , Eric Dumazet , "David S. Miller" , Alexei Starovoitov , Daniel Borkmann , Steven Rostedt , Ingo Molnar , Peter Zijlstra , Arnaldo Carvalho de Melo , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190315_125205_701743_CC2A8923 X-CRM114-Status: GOOD ( 15.41 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Brodsky , Chintan Pandya , Jacob Bramley , Ruben Ayrapetyan , Szabolcs Nagy , Andrey Konovalov , Lee Smith , Kostya Serebryany , Dmitry Vyukov , Ramana Radhakrishnan , Luc Van Oostenryck , Dave Martin , Evgeniy Stepanov Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments. In copy_mount_options a user address is being subtracted from TASK_SIZE. If the address is lower than TASK_SIZE, the size is calculated to not allow the exact_copy_from_user() call to cross TASK_SIZE boundary. However if the address is tagged, then the size will be calculated incorrectly. Untag the address before subtracting. Signed-off-by: Andrey Konovalov --- fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/namespace.c b/fs/namespace.c index c9cab307fa77..c27e5713bf04 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2825,7 +2825,7 @@ void *copy_mount_options(const void __user * data) * the remainder of the page. */ /* copy_from_user cannot cross TASK_SIZE ! */ - size = TASK_SIZE - (unsigned long)data; + size = TASK_SIZE - (unsigned long)untagged_addr(data); if (size > PAGE_SIZE) size = PAGE_SIZE;