From owner-svn-src-head@freebsd.org  Thu Mar 24 13:28:34 2016
Return-Path: <owner-svn-src-head@freebsd.org>
Delivered-To: svn-src-head@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 853A2ADB664;
 Thu, 24 Mar 2016 13:28:34 +0000 (UTC) (envelope-from wma@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2610:1c1:1:6068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 577651434;
 Thu, 24 Mar 2016 13:28:34 +0000 (UTC) (envelope-from wma@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.37])
 by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u2ODSXJq008961;
 Thu, 24 Mar 2016 13:28:33 GMT (envelope-from wma@FreeBSD.org)
Received: (from wma@localhost)
 by repo.freebsd.org (8.15.2/8.15.2/Submit) id u2ODSXMs008960;
 Thu, 24 Mar 2016 13:28:33 GMT (envelope-from wma@FreeBSD.org)
Message-Id: <201603241328.u2ODSXMs008960@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: wma set sender to wma@FreeBSD.org
 using -f
From: Wojciech Macek <wma@FreeBSD.org>
Date: Thu, 24 Mar 2016 13:28:33 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r297235 - head/sys/arm64/arm64
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.21
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head/>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Mar 2016 13:28:34 -0000

Author: wma
Date: Thu Mar 24 13:28:33 2016
New Revision: 297235
URL: https://svnweb.freebsd.org/changeset/base/297235

Log:
  arm64: Fixing user space boudary checking in copyinout.S
  
  Big buffer size could cause integer overflow and as a result
  attempt to copy beyond VM_USERMAX_ADDRESS.
  
  Fixing copyinstr boundary checking where compared value has been
  overwritten by accident when setting fault handler.
  
  Submitted by:          Dominik Ermel <der@semihalf.com>
  Obtained from:         Semihalf
  Sponsored by:          Cavium
  Reviewed by:           kib
  Differential Revision: https://reviews.freebsd.org/D5719

Modified:
  head/sys/arm64/arm64/copyinout.S

Modified: head/sys/arm64/arm64/copyinout.S
==============================================================================
--- head/sys/arm64/arm64/copyinout.S	Thu Mar 24 11:40:10 2016	(r297234)
+++ head/sys/arm64/arm64/copyinout.S	Thu Mar 24 13:28:33 2016	(r297235)
@@ -52,7 +52,8 @@ END(copyio_fault)
  */
 ENTRY(copyout)
 	cbz	x2, 1f
-	add	x3, x1, x2
+	adds	x3, x1, x2
+	b.cs 	copyio_fault_nopcb
 	ldr	x4, =VM_MAXUSER_ADDRESS
 	cmp	x3, x4
 	b.hi	copyio_fault_nopcb
@@ -71,7 +72,8 @@ END(copyout)
  */
 ENTRY(copyin)
 	cbz	x2, 1f
-	add	x3, x0, x2
+	adds	x3, x0, x2
+	b.cs    copyio_fault_nopcb
 	ldr	x4, =VM_MAXUSER_ADDRESS
 	cmp	x3, x4
 	b.hi	copyio_fault_nopcb
@@ -92,11 +94,11 @@ ENTRY(copyinstr)
 	mov	x5, xzr		/* count = 0 */
 	mov	w4, #1		/* If zero return faulure */
 	cbz	x2, 3f		/* If len == 0 then skip loop */
-	ldr	x7, =VM_MAXUSER_ADDRESS
 
 	adr	x6, copyio_fault /* Get the handler address */
 	SET_FAULT_HANDLER(x6, x7) /* Set the handler */
 
+	ldr	x7, =VM_MAXUSER_ADDRESS
 1:	cmp	x0, x7
 	b.cs	copyio_fault
 	ldrb	w4, [x0], #1	/* Load from uaddr */