Date: Thu, 24 Mar 2016 13:28:33 +0000 (UTC) From: Wojciech Macek <wma@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r297235 - head/sys/arm64/arm64 Message-ID: <201603241328.u2ODSXMs008960@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: wma Date: Thu Mar 24 13:28:33 2016 New Revision: 297235 URL: https://svnweb.freebsd.org/changeset/base/297235 Log: arm64: Fixing user space boudary checking in copyinout.S Big buffer size could cause integer overflow and as a result attempt to copy beyond VM_USERMAX_ADDRESS. Fixing copyinstr boundary checking where compared value has been overwritten by accident when setting fault handler. Submitted by: Dominik Ermel <der@semihalf.com> Obtained from: Semihalf Sponsored by: Cavium Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5719 Modified: head/sys/arm64/arm64/copyinout.S Modified: head/sys/arm64/arm64/copyinout.S ============================================================================== --- head/sys/arm64/arm64/copyinout.S Thu Mar 24 11:40:10 2016 (r297234) +++ head/sys/arm64/arm64/copyinout.S Thu Mar 24 13:28:33 2016 (r297235) @@ -52,7 +52,8 @@ END(copyio_fault) */ ENTRY(copyout) cbz x2, 1f - add x3, x1, x2 + adds x3, x1, x2 + b.cs copyio_fault_nopcb ldr x4, =VM_MAXUSER_ADDRESS cmp x3, x4 b.hi copyio_fault_nopcb @@ -71,7 +72,8 @@ END(copyout) */ ENTRY(copyin) cbz x2, 1f - add x3, x0, x2 + adds x3, x0, x2 + b.cs copyio_fault_nopcb ldr x4, =VM_MAXUSER_ADDRESS cmp x3, x4 b.hi copyio_fault_nopcb @@ -92,11 +94,11 @@ ENTRY(copyinstr) mov x5, xzr /* count = 0 */ mov w4, #1 /* If zero return faulure */ cbz x2, 3f /* If len == 0 then skip loop */ - ldr x7, =VM_MAXUSER_ADDRESS adr x6, copyio_fault /* Get the handler address */ SET_FAULT_HANDLER(x6, x7) /* Set the handler */ + ldr x7, =VM_MAXUSER_ADDRESS 1: cmp x0, x7 b.cs copyio_fault ldrb w4, [x0], #1 /* Load from uaddr */
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201603241328.u2ODSXMs008960>