Files
kernel_amazon_mt8127-common/include/linux
Al Viro 138c012118 fix fault_in_multipages_...() on architectures with no-op access_ok()
commit e23d4159b109167126e5bcd7f3775c95de7fee47 upstream.

Switching iov_iter fault-in to multipages variants has exposed an old
bug in underlying fault_in_multipages_...(); they break if the range
passed to them wraps around.  Normally access_ok() done by callers will
prevent such (and it's a guaranteed EFAULT - ERR_PTR() values fall into
such a range and they should not point to any valid objects).

However, on architectures where userland and kernel live in different
MMU contexts (e.g. s390) access_ok() is a no-op and on those a range
with a wraparound can reach fault_in_multipages_...().

Since any wraparound means EFAULT there, the fix is trivial - turn
those

    while (uaddr <= end)
	    ...
into

    if (unlikely(uaddr > end))
	    return -EFAULT;
    do
	    ...
    while (uaddr <= end);

Reported-by: Jan Stancek <jstancek@redhat.com>
Tested-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
2017-02-06 23:33:04 +01:00
..
2015-04-29 10:33:54 +02:00
2013-12-04 10:56:22 -08:00
2016-03-09 15:31:54 -08:00
2013-12-08 07:29:27 -08:00
2013-07-28 16:30:11 -07:00
2015-07-03 19:48:08 -07:00
2013-10-13 16:08:28 -07:00
2014-04-03 12:01:05 -07:00
2014-06-26 15:12:38 -04:00
2013-07-28 16:30:05 -07:00
2013-10-13 16:08:35 -07:00
2013-07-21 18:21:29 -07:00
2014-01-15 15:28:47 -08:00
2016-03-03 15:06:24 -08:00
2013-07-28 16:29:55 -07:00