arm64: futex: Mask __user pointers prior to dereference

Web:        https://git.kernel.org/torvalds/c/91b2d3442f6a44dce875670d702af22737ad5eff
Commit:     91b2d3442f6a44dce875670d702af22737ad5eff
Parent:     f71c2ffcb20dd8626880747557014bb9a61eb90e
Refname:    refs/heads/master
Author:     Will Deacon <[email protected]>
AuthorDate: Mon Feb 5 15:34:24 2018 +0000
Committer:  Catalin Marinas <[email protected]>
CommitDate: Tue Feb 6 22:53:42 2018 +0000

    arm64: futex: Mask __user pointers prior to dereference
    
    The arm64 futex code has some explicit dereferencing of user pointers
    where performing atomic operations in response to a futex command. This
    patch uses masking to limit any speculative futex operations to within
    the user address space.
    
    Signed-off-by: Will Deacon <[email protected]>
    Signed-off-by: Catalin Marinas <[email protected]>
---
 arch/arm64/include/asm/futex.h | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
index 5bb2fd4674e7..07fe2479d310 100644
--- a/arch/arm64/include/asm/futex.h
+++ b/arch/arm64/include/asm/futex.h
@@ -48,9 +48,10 @@ do {									\
 } while (0)
 
 static inline int
-arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
+arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr)
 {
 	int oldval = 0, ret, tmp;
+	u32 __user *uaddr = __uaccess_mask_ptr(_uaddr);
 
 	pagefault_disable();
 
@@ -88,15 +89,17 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
 }
 
 static inline int
-futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr,
 			      u32 oldval, u32 newval)
 {
 	int ret = 0;
 	u32 val, tmp;
+	u32 __user *uaddr;
 
-	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
+	if (!access_ok(VERIFY_WRITE, _uaddr, sizeof(u32)))
 		return -EFAULT;
 
+	uaddr = __uaccess_mask_ptr(_uaddr);
 	uaccess_enable();
 	asm volatile("// futex_atomic_cmpxchg_inatomic\n"
 "	prfm	pstl1strm, %2\n"
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html