Re: [PATCH] drivers: char: mem: Check {read,write}_kmem() addresses

2016-05-31 Thread Kefeng Wang
On 2016/5/31 21:40, Robin Murphy wrote: > On 31/05/16 14:08, Russell King - ARM Linux wrote: >> On Tue, May 31, 2016 at 01:52:45PM +0100, Robin Murphy wrote: >>> Arriving at read_kmem() with an offset representing a bogus kernel >>> address (e.g. 0 from a simple "cat /dev/kmem") leads to copy_to_

Re: [PATCH] drivers: char: mem: Check {read,write}_kmem() addresses

2016-05-31 Thread Robin Murphy
On 31/05/16 14:46, Catalin Marinas wrote: On Tue, May 31, 2016 at 01:52:45PM +0100, Robin Murphy wrote: Arriving at read_kmem() with an offset representing a bogus kernel address (e.g. 0 from a simple "cat /dev/kmem") leads to copy_to_user faulting on the kernel-space read. x86_64 happens to ge

Re: [PATCH] drivers: char: mem: Check {read,write}_kmem() addresses

2016-05-31 Thread Catalin Marinas
On Tue, May 31, 2016 at 01:52:45PM +0100, Robin Murphy wrote: > Arriving at read_kmem() with an offset representing a bogus kernel > address (e.g. 0 from a simple "cat /dev/kmem") leads to copy_to_user > faulting on the kernel-space read. > > x86_64 happens to get away with this since the optimise

Re: [PATCH] drivers: char: mem: Check {read,write}_kmem() addresses

2016-05-31 Thread Robin Murphy
On 31/05/16 14:08, Russell King - ARM Linux wrote: On Tue, May 31, 2016 at 01:52:45PM +0100, Robin Murphy wrote: Arriving at read_kmem() with an offset representing a bogus kernel address (e.g. 0 from a simple "cat /dev/kmem") leads to copy_to_user faulting on the kernel-space read. x86_64 happ

Re: [PATCH] drivers: char: mem: Check {read,write}_kmem() addresses

2016-05-31 Thread Russell King - ARM Linux
On Tue, May 31, 2016 at 01:52:45PM +0100, Robin Murphy wrote: > Arriving at read_kmem() with an offset representing a bogus kernel > address (e.g. 0 from a simple "cat /dev/kmem") leads to copy_to_user > faulting on the kernel-space read. > > x86_64 happens to get away with this since the optimise

[PATCH] drivers: char: mem: Check {read,write}_kmem() addresses

2016-05-31 Thread Robin Murphy
Arriving at read_kmem() with an offset representing a bogus kernel address (e.g. 0 from a simple "cat /dev/kmem") leads to copy_to_user faulting on the kernel-space read. x86_64 happens to get away with this since the optimised implementation uses "rep movs*", thus the user write (which is allowed