Vineet Gupta 59a2d6b2a6 ARC: uaccess: get_user to zero out dest in cause of fault ... commit 05d9d0b96e upstream. Al reported potential issue with ARC get_user() as it wasn't clearing out destination pointer in case of fault due to bad address etc. Verified using following | { | u32 bogus1 = 0xdeadbeef; | u64 bogus2 = 0xdead; | int rc1, rc2; | | pr_info("Orig values %x %llx\n", bogus1, bogus2); | rc1 = get_user(bogus1, (u32 __user *)0x40000000); | rc2 = get_user(bogus2, (u64 __user *)0x50000000); | pr_info("access %d %d, new values %x %llx\n", | rc1, rc2, bogus1, bogus2); | } | [ARCLinux]# insmod /mnt/kernel-module/qtn.ko | Orig values deadbeef dead | access -14 -14, new values 0 0 Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: linux-snps-arc@lists.infradead.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Vineet Gupta <vgupta@synopsys.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-09-24 10:07:44 +02:00
..
arcregs.h	ARC: build: Better way to detect ISA compatible toolchain	2016-09-07 08:32:42 +02:00
asm-offsets.h
atomic.h	atomic, arch: Audit atomic_{read,set}()	2015-09-23 09:54:28 +02:00
barrier.h	ARCv2: barriers	2015-06-25 06:00:17 +05:30
bitops.h	ARC: bitops: Remove non relevant comments	2016-04-12 09:08:56 -07:00
bug.h
cache.h	ARC: mm: fix building for MMU v2	2015-12-21 12:10:40 +05:30
cacheflush.h	ARC: mm: PAE40: switch to using phys_addr_t for physical addresses	2015-10-28 19:50:29 +05:30
checksum.h
clk.h
cmpxchg.h	ARC: add/fix some comments in code - no functional change	2015-08-20 19:05:49 +05:30
current.h
delay.h	ARCv2: Adhere to Zero Delay loop restriction	2015-06-22 14:06:56 +05:30
disasm.h
dma-mapping.h	Merge branch 'akpm' (patches from Andrew)	2015-07-01 17:47:51 -07:00
dma.h
elf.h	ARCv2: Support for ARCv2 ISA and HS38x cores	2015-06-22 14:06:55 +05:30
entry-arcv2.h	ARCv2: Support for ARCv2 ISA and HS38x cores	2015-06-22 14:06:55 +05:30
entry-compact.h	ARC: [arcompact] entry.S: Improve early return from exception	2015-10-17 17:48:22 +05:30
entry.h	ARC: use correct offset in pt_regs for saving/restoring user mode r25	2016-09-07 08:32:42 +02:00
exec.h
futex.h	ARC: change some branchs to jumps to resolve linkage errors	2015-08-20 18:53:15 +05:30
highmem.h	ARC: mm: HIGHMEM: kmap API implementation	2015-10-28 19:49:04 +05:30
hugepage.h	ARCv2: mm: THP: Implement flush_pmd_tlb_range() optimization	2015-10-17 17:48:21 +05:30
io.h	ARC: Add missing io barriers to io{read,write}{16,32}be()	2016-05-11 11:21:20 +02:00
irq.h	ARC: smp: irqchip: handle IPI as percpu irq like timer	2015-10-28 16:13:39 +05:30
irqflags-arcv2.h	ARCv2: SMP: Emulate IPI to self using software triggered interrupt	2016-03-03 15:07:28 -08:00
irqflags-compact.h	ARC: Call trace_hardirqs_on() before enabling irqs	2016-09-07 08:32:42 +02:00
irqflags.h	ARCv2: Support for ARCv2 ISA and HS38x cores	2015-06-22 14:06:55 +05:30
Kbuild	Merge branch 'strscpy' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile	2015-10-04 16:31:13 +01:00
kdebug.h
kgdb.h
kmap_types.h	ARC: mm: HIGHMEM: kmap API implementation	2015-10-28 19:49:04 +05:30
kprobes.h
linkage.h
mach_desc.h	ARC: smp: Rename platform hook @init_cpu_smp -> @init_per_cpu	2015-12-17 12:56:56 +05:30
mcip.h	ARCv2: smp: [plat-*]: No need to explicitly call mcip_init_smp()	2015-10-28 16:13:41 +05:30
mmu_context.h
mmu.h	ARC: mm: PAE40 support	2015-10-29 18:41:30 +05:30
module.h
mutex.h
page.h	ARC: mm: PAE40 support	2015-10-29 18:41:30 +05:30
perf_event.h	ARCv2: perf: Finally introduce HS perf unit	2015-08-27 14:59:07 +05:30
pgalloc.h	ARC: mm: PAE40 support	2015-10-29 18:41:30 +05:30
pgtable.h	ARC: mm: fix build breakage with STRICT_MM_TYPECHECKS	2016-09-24 10:07:37 +02:00
processor.h	ARC: cpu_relax() to be compiler barrier even for UP	2015-11-14 13:12:30 +05:30
ptrace.h	ARC: Make pt_regs regs unsigned	2015-08-05 11:48:21 +05:30
sections.h
segment.h
serial.h
setup.h	ARC: boot log: move helper macros to header for reuse	2015-10-17 17:48:25 +05:30
shmparam.h
smp.h	ARC: rename smp operation init_irq_cpu() to init_per_cpu()	2015-12-17 12:56:43 +05:30
spinlock_types.h	ARC: LLOCK/SCOND based rwlock	2015-08-04 09:26:33 +05:30
spinlock.h	ARCv2: spinlock/rwlock/atomics: reduce 1 instruction in exponential backoff	2015-08-07 13:56:16 +05:30
stacktrace.h
string.h
switch_to.h
syscall.h
syscalls.h
thread_info.h	ARCv2: Support for ARCv2 ISA and HS38x cores	2015-06-22 14:06:55 +05:30
timex.h
tlb-mmu1.h
tlb.h
tlbflush.h	ARCv2: mm: THP: flush_pmd_tlb_range make SMP safe	2015-10-17 17:48:21 +05:30
uaccess.h	ARC: uaccess: get_user to zero out dest in cause of fault	2016-09-24 10:07:44 +02:00
unaligned.h
unwind.h	ARC: dw2 unwind: Reinstante unwinding out of modules	2015-12-17 11:10:23 +05:30