mirror of
https://github.com/torvalds/linux.git
synced 2026-10-25 01:05:03 +02:00
9ef61ff7ca
syscall_user_dispatch() reads the selector byte with __get_user(), relying on an access_ok() done once at prctl time when the selector address was set. So the pointer being dereferenced was validated in a different system call, and the separation saves nothing anyway: __get_user() still enables and disables user access, and on x86 it does an lfence that get_user() avoids. Use get_user(), and drop the comment explaining why the unchecked access was safe. The selector may be a tagged address. The prctl-time check is done on untagged_addr(selector), but it is the tagged pointer that gets stored, and __get_user() never checked it. get_user() does, and on x86 with LAM a tagged pointer fails its range check. So untag it at the point of use as well. The prctl-time check stays, so a bad address is still reported when it is set. This is part of getting rid of __get_user() and __put_user() entirely. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
|---|---|---|
| .. | ||
| common.c | ||
| Makefile | ||
| syscall_user_dispatch.c | ||
| syscall-common.c | ||
| virt.c | ||