linux-toradex.git/arch/arc/include/asm/uaccess.h, branch v4.9.20

ARC: uaccess: get_user to zero out dest in cause of fault

2016-09-13T21:49:41+00:00

Al reported potential issue with ARC get_user() as it wasn't clearing
out destination pointer in case of fault due to bad address etc.

Verified using following

| {
|  	u32 bogus1 = 0xdeadbeef;
|	u64 bogus2 = 0xdead;
|	int rc1, rc2;
|
|  	pr_info("Orig values %x %llx\n", bogus1, bogus2);
|	rc1 = get_user(bogus1, (u32 __user *)0x40000000);
|	rc2 = get_user(bogus2, (u64 __user *)0x50000000);
|	pr_info("access %d %d, new values %x %llx\n",
|		rc1, rc2, bogus1, bogus2);
| }

| [ARCLinux]# insmod /mnt/kernel-module/qtn.ko
| Orig values deadbeef dead
| access -14 -14, new values 0 0

Reported-by: Al Viro 
Cc: Linus Torvalds 
Cc: linux-snps-arc@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Vineet Gupta 
Signed-off-by: Al Viro

Fix typos

2016-05-30T04:37:32+00:00

Signed-off-by: Andrea Gelmini 
Signed-off-by: Vineet Gupta

ARCv2: Adhere to Zero Delay loop restriction

2015-06-22T08:36:56+00:00

Branch insn can't be scheduled as last insn of Zero Overhead loop

Signed-off-by: Vineet Gupta

ARC: Fix 32-bit wrap around in access_ok()

2013-09-27T10:58:47+00:00

Anton reported

 | LTP tests syscalls/process_vm_readv01 and process_vm_writev01 fail
 | similarly in one testcase test_iov_invalid -> lvec->iov_base.
 | Testcase expects errno EFAULT and return code -1,
 | but it gets return code 1 and ERRNO is 0 what means success.

Essentially test case was passing a pointer of -1 which access_ok()
was not catching. It was doing [@addr + @sz <= TASK_SIZE] which would
pass for @addr == -1

Fixed that by rewriting as [@addr <= TASK_SIZE - @sz]

Reported-by: Anton Kolesov 
Signed-off-by: Vineet Gupta

ARC: [optim] uaccess __{get,put}_user() optimised

2013-02-11T14:30:32+00:00

Override asm-generic implementations. We basically gain on 2 fronts

* checks for alignment no longer needed as we are only doing "unit"
  sized copies.

  (Careful observer could argue that While the kernel buffers are aligned,
   the user buffer in theory might not be - however in that case the
   user space is already broken when it tries to deref a hword/word
   straddling word boundary - so we are not making it any worse).

* __copy_{to,from}_user( ) returns bytes that couldn't be copied,
  whereas get_user() returns 0 for success or -EFAULT (not size). Thus
  the code to do leftover bytes calculation can be avoided as well.

The savings were significant: ~17k of code.

bloat-o-meter vmlinux_uaccess_pre vmlinux_uaccess_post
add/remove: 0/4 grow/shrink: 8/118 up/down: 1262/-18758 (-17496)
							^^^^^^^^^
Signed-off-by: Vineet Gupta 
Acked-by: Arnd Bergmann

ARC: uaccess friends

2013-02-11T14:30:31+00:00

Signed-off-by: Vineet Gupta