diff mbox series

arm64: uaccess: Restrict user access to kernel memory in __copy_user_flushcache()

Message ID 20241115205206.17678-1-zichenxie0106@gmail.com (mailing list archive)
State New
Headers show
Series arm64: uaccess: Restrict user access to kernel memory in __copy_user_flushcache() | expand

Commit Message

Gax-c Nov. 15, 2024, 8:52 p.m. UTC 
From: Zichen Xie <zichenxie0106@gmail.com>

raw_copy_from_user() do not call access_ok(), so this code allowed
userspace to access any virtual memory address. Change it to
copy_from_user().

Fixes: 9e94fdade4d8 ("arm64: uaccess: simplify __copy_user_flushcache()")
Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
Cc: stable@vger.kernel.org
---
 arch/arm64/lib/uaccess_flushcache.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/arch/arm64/lib/uaccess_flushcache.c b/arch/arm64/lib/uaccess_flushcache.c
index 7510d1a23124..fb138a3934db 100644
--- a/arch/arm64/lib/uaccess_flushcache.c
+++ b/arch/arm64/lib/uaccess_flushcache.c
@@ -24,7 +24,7 @@  unsigned long __copy_user_flushcache(void *to, const void __user *from,
 {
 	unsigned long rc;
 
-	rc = raw_copy_from_user(to, from, n);
+	rc = copy_from_user(to, from, n);
 
 	/* See above */
 	dcache_clean_pop((unsigned long)to, (unsigned long)to + n - rc);