Skip to content

Commit 169f910

Browse files
keesRussell King (Oracle)
authored andcommitted
ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
Under PAN emulation when dumping backtraces from things like the LKDTM EXEC_USERSPACE test[1], a double fault (which would hang a CPU) would happen because of dump_instr() attempting to read a userspace address. Make sure copy_from_kernel_nofault() does not attempt this any more. Closes: https://lava.sirena.org.uk/scheduler/job/497571 Link: https://lore.kernel.org/all/202401181125.D48DCB4C@keescook/ [1] Reported-by: Mark Brown <broonie@kernel.org> Suggested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Ard Biesheuvel <ardb@kernel.org> Tested-by: Mark Brown <broonie@kernel.org> Cc: Wang Kefeng <wangkefeng.wang@huawei.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
1 parent daa5595 commit 169f910

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

arch/arm/mm/fault.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,13 @@
2525

2626
#include "fault.h"
2727

28+
bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
29+
{
30+
unsigned long addr = (unsigned long)unsafe_src;
31+
32+
return addr >= TASK_SIZE && ULONG_MAX - addr >= size;
33+
}
34+
2835
#ifdef CONFIG_MMU
2936

3037
/*

0 commit comments

Comments
 (0)