Commit 225cf8d6 authored by Heiko Carstens's avatar Heiko Carstens Committed by Martin Schwidefsky
Browse files

s390/uaccess: fix strncpy_from_user string length check 



The "standard" and page table walk variants of strncpy_from_user() first
check the length of the to be copied string in userspace.
The string is then copied to kernel space and the length returned to the
caller.
However userspace can modify the string at any time while the kernel
checks for the length of the string or copies the string. In result the
returned length of the string is not necessarily correct.
Fix this by copying in a loop which mimics the mvcos variant of
strncpy_from_user(), which handles this correctly.

Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 832a9981

arch/s390/lib/uaccess_pt.c

+18 −16
Original line number Diff line number Diff line
@@ -202,27 +202,29 @@ fault: 
static size_t strncpy_from_user_pt(size_t count, const char __user *src,

				   char *dst)

{

	size_t n = strnlen_user_pt(count, src);

	size_t done, len, offset, len_str;



	if (unlikely(!count))

		return 0;

	if (!n)

		return -EFAULT;

	if (n > count)

		n = count;

	if (segment_eq(get_fs(), KERNEL_DS)) {

		memcpy(dst, (const char __kernel __force *) src, n);

		if (dst[n-1] == '\0')

			return n-1;

		else

			return n;

		len = strnlen((const char __kernel __force *) src, count) + 1;

		if (len > count)

			len = count;

		memcpy(dst, (const char __kernel __force *) src, len);

		return (dst[len - 1] == '\0') ? len - 1 : len;

	}

	if (__user_copy_pt((unsigned long) src, dst, n, 0))

	done = 0;

	do {

		offset = (size_t)src & ~PAGE_MASK;

		len = min(count - done, PAGE_SIZE - offset);

		if (__user_copy_pt((unsigned long) src, dst, len, 0))

			return -EFAULT;

	if (dst[n-1] == '\0')

		return n-1;

	else

		return n;

		len_str = strnlen(dst, len);

		done += len_str;

		src += len_str;

		dst += len_str;

	} while ((len_str == len) && (done < count));

	return done;

}



static size_t copy_in_user_pt(size_t n, void __user *to,

arch/s390/lib/uaccess_std.c

+16 −30
Original line number Diff line number Diff line
@@ -206,38 +206,24 @@ size_t strnlen_user_std(size_t size, const char __user *src) 
	return size;

}



size_t strncpy_from_user_std(size_t size, const char __user *src, char *dst)

size_t strncpy_from_user_std(size_t count, const char __user *src, char *dst)

{

	register unsigned long reg0 asm("0") = 0UL;

	unsigned long tmp1, tmp2;

	size_t done, len, offset, len_str;



	asm volatile(

		"   la    %3,0(%1)\n"

		"   la    %4,0(%0,%1)\n"

		"   sacf  256\n"

		"0: srst  %4,%3\n"

		"   jo    0b\n"

		"   sacf  0\n"

		"   la    %0,0(%4)\n"

		"   jh    1f\n"		/* found \0 in string ? */

		"  "AHI"  %4,1\n"	/* include \0 in copy */

		"1:"SLR"  %0,%1\n"	/* %0 = return length (without \0) */

		"  "SLR"  %4,%1\n"	/* %4 = copy length (including \0) */

		"2: mvcp  0(%4,%2),0(%1),%5\n"

		"   jz    9f\n"

		"3:"AHI"  %4,-256\n"

		"   la    %1,256(%1)\n"

		"   la    %2,256(%2)\n"

		"4: mvcp  0(%4,%2),0(%1),%5\n"

		"   jnz   3b\n"

		"   j     9f\n"

		"7: sacf  0\n"

		"8:"LHI"  %0,%6\n"

		"9:\n"

		EX_TABLE(0b,7b) EX_TABLE(2b,8b) EX_TABLE(4b,8b)

		: "+a" (size), "+a" (src), "+d" (dst), "=a" (tmp1), "=a" (tmp2)

		: "d" (reg0), "K" (-EFAULT) : "cc", "memory");

	return size;

	if (unlikely(!count))

		return 0;

	done = 0;

	do {

		offset = (size_t)src & ~PAGE_MASK;

		len = min(count - done, PAGE_SIZE - offset);

		if (copy_from_user_std(len, src, dst))

			return -EFAULT;

		len_str = strnlen(dst, len);

		done += len_str;

		src += len_str;

		dst += len_str;

	} while ((len_str == len) && (done < count));

	return done;

}



#define __futex_atomic_op(insn, ret, oldval, newval, uaddr, oparg)	\

CRA Git | Maintained and supported by SUSTech CRA and CCSE