1. 13 1月, 2016 1 次提交
  2. 28 12月, 2015 1 次提交
  3. 22 12月, 2015 3 次提交
    • J
      MIPS: uaccess: Take EVA into account in [__]clear_user · d6a428fb
      James Hogan 提交于
      __clear_user() (and clear_user() which uses it), always access the user
      mode address space, which results in EVA store instructions when EVA is
      enabled even if the current user address limit is KERNEL_DS.
      
      Fix this by adding a new symbol __bzero_kernel for the normal kernel
      address space bzero in EVA mode, and call that from __clear_user() if
      eva_kernel_access().
      Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
      Cc: Markos Chandras <markos.chandras@imgtec.com>
      Cc: Paul Burton <paul.burton@imgtec.com>
      Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/10844/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      d6a428fb
    • J
      MIPS: uaccess: Take EVA into account in __copy_from_user() · 6f06a2c4
      James Hogan 提交于
      When EVA is in use, __copy_from_user() was unconditionally using the EVA
      instructions to read the user address space, however this can also be
      used for kernel access. If the address isn't a valid user address it
      will cause an address error or TLB exception, and if it is then user
      memory may be read instead of kernel memory.
      
      For example in the following stack trace from Linux v3.10 (changes since
      then will prevent this particular one still happening) kernel_sendmsg()
      set the user address limit to KERNEL_DS, and tcp_sendmsg() goes on to
      use __copy_from_user() with a kernel address in KSeg0.
      
      [<8002d434>] __copy_fromuser_common+0x10c/0x254
      [<805710e0>] tcp_sendmsg+0x5f4/0xf00
      [<804e8e3c>] sock_sendmsg+0x78/0xa0
      [<804e8f28>] kernel_sendmsg+0x24/0x38
      [<804ee0f8>] sock_no_sendpage+0x70/0x7c
      [<8017c820>] pipe_to_sendpage+0x80/0x98
      [<8017c6b0>] splice_from_pipe_feed+0xa8/0x198
      [<8017cc54>] __splice_from_pipe+0x4c/0x8c
      [<8017e844>] splice_from_pipe+0x58/0x78
      [<8017e884>] generic_splice_sendpage+0x20/0x2c
      [<8017d690>] do_splice_from+0xb4/0x110
      [<8017d710>] direct_splice_actor+0x24/0x30
      [<8017d394>] splice_direct_to_actor+0xd8/0x208
      [<8017d51c>] do_splice_direct+0x58/0x7c
      [<8014eaf4>] do_sendfile+0x1dc/0x39c
      [<8014f82c>] SyS_sendfile+0x90/0xf8
      
      Add the eva_kernel_access() check in __copy_from_user() like the one in
      copy_from_user().
      Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
      Cc: Markos Chandras <markos.chandras@imgtec.com>
      Cc: Paul Burton <paul.burton@imgtec.com>
      Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Patchwork: https://patchwork.linux-mips.org/patch/10843/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      6f06a2c4
    • J
      MIPS: uaccess: Fix strlen_user with EVA · 5dc62fdd
      James Hogan 提交于
      The strlen_user() function calls __strlen_kernel_asm in both branches of
      the eva_kernel_access() conditional. For EVA it should be calling
      __strlen_user_eva for user accesses, otherwise it will load from the
      kernel address space instead of the user address space, and the access
      checking will likely be ineffective at preventing it due to EVA's
      overlapping user and kernel address spaces.
      
      This was found after extending the test_user_copy module to cover user
      string access functions, which gave the following error with EVA:
      
      test_user_copy: illegal strlen_user passed
      
      Fortunately the use of strlen_user() has been all but eradicated from
      the mainline kernel, so only out of tree modules could be affected.
      
      Fixes: e3a9b07a ("MIPS: asm: uaccess: Add EVA support for str*_user operations")
      Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
      Cc: Markos Chandras <markos.chandras@imgtec.com>
      Cc: Paul Burton <paul.burton@imgtec.com>
      Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
      Cc: linux-mips@linux-mips.org
      Cc: <stable@vger.kernel.org> # 3.15.x-
      Patchwork: https://patchwork.linux-mips.org/patch/10842/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
      5dc62fdd
  4. 16 11月, 2015 1 次提交
  5. 12 11月, 2015 2 次提交
  6. 11 11月, 2015 17 次提交
  7. 10 11月, 2015 2 次提交
  8. 06 11月, 2015 1 次提交
    • E
      mm: mlock: add mlock flags to enable VM_LOCKONFAULT usage · b0f205c2
      Eric B Munson 提交于
      The previous patch introduced a flag that specified pages in a VMA should
      be placed on the unevictable LRU, but they should not be made present when
      the area is created.  This patch adds the ability to set this state via
      the new mlock system calls.
      
      We add MLOCK_ONFAULT for mlock2 and MCL_ONFAULT for mlockall.
      MLOCK_ONFAULT will set the VM_LOCKONFAULT modifier for VM_LOCKED.
      MCL_ONFAULT should be used as a modifier to the two other mlockall flags.
      When used with MCL_CURRENT, all current mappings will be marked with
      VM_LOCKED | VM_LOCKONFAULT.  When used with MCL_FUTURE, the mm->def_flags
      will be marked with VM_LOCKED | VM_LOCKONFAULT.  When used with both
      MCL_CURRENT and MCL_FUTURE, all current mappings and mm->def_flags will be
      marked with VM_LOCKED | VM_LOCKONFAULT.
      
      Prior to this patch, mlockall() will unconditionally clear the
      mm->def_flags any time it is called without MCL_FUTURE.  This behavior is
      maintained after adding MCL_ONFAULT.  If a call to mlockall(MCL_FUTURE) is
      followed by mlockall(MCL_CURRENT), the mm->def_flags will be cleared and
      new VMAs will be unlocked.  This remains true with or without MCL_ONFAULT
      in either mlockall() invocation.
      
      munlock() will unconditionally clear both vma flags.  munlockall()
      unconditionally clears for VMA flags on all VMAs and in the mm->def_flags
      field.
      Signed-off-by: NEric B Munson <emunson@akamai.com>
      Acked-by: NMichal Hocko <mhocko@suse.com>
      Acked-by: NVlastimil Babka <vbabka@suse.cz>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Cc: Guenter Roeck <linux@roeck-us.net>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Michael Kerrisk <mtk.manpages@gmail.com>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Shuah Khan <shuahkh@osg.samsung.com>
      Cc: Stephen Rothwell <sfr@canb.auug.org.au>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      b0f205c2
  9. 05 11月, 2015 1 次提交
  10. 26 10月, 2015 7 次提交
  11. 23 10月, 2015 2 次提交
  12. 13 10月, 2015 1 次提交
  13. 06 10月, 2015 1 次提交