Explorar o código

arm: don't zero in __copy_from_user_inatomic()/__copy_from_user()

adjust copy_from_user(), obviously

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro %!s(int64=9) %!d(string=hai) anos
pai
achega
91344493b7
Modificáronse 2 ficheiros con 9 adicións e 11 borrados
  1. 6 5
      arch/arm/include/asm/uaccess.h
  2. 3 6
      arch/arm/lib/copy_from_user.S

+ 6 - 5
arch/arm/include/asm/uaccess.h

@@ -533,11 +533,12 @@ __clear_user(void __user *addr, unsigned long n)
 
 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-	if (access_ok(VERIFY_READ, from, n))
-		n = __copy_from_user(to, from, n);
-	else /* security hole - plug it */
-		memset(to, 0, n);
-	return n;
+	unsigned long res = n;
+	if (likely(access_ok(VERIFY_READ, from, n)))
+		res = __copy_from_user(to, from, n);
+	if (unlikely(res))
+		memset(to + (n - res), 0, res);
+	return res;
 }
 
 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)

+ 3 - 6
arch/arm/lib/copy_from_user.S

@@ -98,12 +98,9 @@ ENDPROC(arm_copy_from_user)
 	.pushsection .fixup,"ax"
 	.align 0
 	copy_abort_preamble
-	ldmfd	sp!, {r1, r2}
-	sub	r3, r0, r1
-	rsb	r1, r3, r2
-	str	r1, [sp]
-	bl	__memzero
-	ldr	r0, [sp], #4
+	ldmfd	sp!, {r1, r2, r3}
+	sub	r0, r0, r1
+	rsb	r0, r0, r2
 	copy_abort_end
 	.popsection