Commit 8565d644 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'bounds-fixes-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull bounds fixes from Kees Cook:
 "These are a handful of buffer and array bounds fixes that I've been
  carrying in preparation for the coming memcpy improvements and the
  enabling of '-Warray-bounds' globally.

  There are additional similar fixes in other maintainer's trees, but
  these ended up getting carried by me. :)"

* tag 'bounds-fixes-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  media: omap3isp: Use struct_group() for memcpy() region
  tpm: vtpm_proxy: Check length to avoid compiler warning
  alpha: Silence -Warray-bounds warnings
  m68k: cmpxchg: Dereference matching size
  intel_th: msu: Use memset_startat() for clearing hw header
  KVM: x86: Replace memset() "optimization" with normal per-field writes
parents d0858cbd fad27838

arch/alpha/mm/init.c

+3 −3
Original line number Diff line number Diff line
@@ -76,14 +76,14 @@ pgd_alloc(struct mm_struct *mm) 
pmd_t *

__bad_pagetable(void)

{

	memset((void *) EMPTY_PGT, 0, PAGE_SIZE);

	memset(absolute_pointer(EMPTY_PGT), 0, PAGE_SIZE);

	return (pmd_t *) EMPTY_PGT;

}



pte_t

__bad_page(void)

{

	memset((void *) EMPTY_PGE, 0, PAGE_SIZE);

	memset(absolute_pointer(EMPTY_PGE), 0, PAGE_SIZE);

	return pte_mkdirty(mk_pte(virt_to_page(EMPTY_PGE), PAGE_SHARED));

}
@@ -253,7 +253,7 @@ void __init paging_init(void) 
	free_area_init(max_zone_pfn);



	/* Initialize the kernel's ZERO_PGE. */

	memset((void *)ZERO_PGE, 0, PAGE_SIZE);

	memset(absolute_pointer(ZERO_PGE), 0, PAGE_SIZE);

}



#if defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_SRM)

arch/m68k/include/asm/cmpxchg.h

+4 −5
Original line number Diff line number Diff line
@@ -4,8 +4,7 @@ 


#include <linux/irqflags.h>



struct __xchg_dummy { unsigned long a[100]; };

#define __xg(x) ((volatile struct __xchg_dummy *)(x))

#define __xg(type, x) ((volatile type *)(x))



extern unsigned long __invalid_xchg_size(unsigned long, volatile void *, int);
@@ -50,7 +49,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz 
			 "1:\n\t"

			 "casb %0,%1,%2\n\t"

			 "jne 1b"

			 : "=&d" (x) : "d" (x), "m" (*__xg(ptr)) : "memory");

			 : "=&d" (x) : "d" (x), "m" (*__xg(u8, ptr)) : "memory");

		break;

	case 2:

		__asm__ __volatile__
@@ -58,7 +57,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz 
			 "1:\n\t"

			 "casw %0,%1,%2\n\t"

			 "jne 1b"

			 : "=&d" (x) : "d" (x), "m" (*__xg(ptr)) : "memory");

			 : "=&d" (x) : "d" (x), "m" (*__xg(u16, ptr)) : "memory");

		break;

	case 4:

		__asm__ __volatile__
@@ -66,7 +65,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz 
			 "1:\n\t"

			 "casl %0,%1,%2\n\t"

			 "jne 1b"

			 : "=&d" (x) : "d" (x), "m" (*__xg(ptr)) : "memory");

			 : "=&d" (x) : "d" (x), "m" (*__xg(u32, ptr)) : "memory");

		break;

	default:

		x = __invalid_xchg_size(x, ptr, size);

arch/x86/kvm/emulate.c

+7 −2
Original line number Diff line number Diff line
@@ -5395,8 +5395,13 @@ static int fastop(struct x86_emulate_ctxt *ctxt, fastop_t fop) 


void init_decode_cache(struct x86_emulate_ctxt *ctxt)

{

	memset(&ctxt->rip_relative, 0,

	       (void *)&ctxt->modrm - (void *)&ctxt->rip_relative);

	/* Clear fields that are set conditionally but read without a guard. */

	ctxt->rip_relative = false;

	ctxt->rex_prefix = 0;

	ctxt->lock_prefix = 0;

	ctxt->rep_prefix = 0;

	ctxt->regs_valid = 0;

	ctxt->regs_dirty = 0;



	ctxt->io_read.pos = 0;

	ctxt->io_read.end = 0;

arch/x86/kvm/kvm_emulate.h

+1 −5
Original line number Diff line number Diff line
@@ -336,11 +336,7 @@ struct x86_emulate_ctxt { 
		fastop_t fop;

	};

	int (*check_perm)(struct x86_emulate_ctxt *ctxt);

	/*

	 * The following six fields are cleared together,

	 * the rest are initialized unconditionally in x86_decode_insn

	 * or elsewhere

	 */



	bool rip_relative;

	u8 rex_prefix;

	u8 lock_prefix;

drivers/char/tpm/tpm_vtpm_proxy.c

+1 −1
Original line number Diff line number Diff line
@@ -91,7 +91,7 @@ static ssize_t vtpm_proxy_fops_read(struct file *filp, char __user *buf, 


	len = proxy_dev->req_len;



	if (count < len) {

	if (count < len || len > sizeof(proxy_dev->buffer)) {

		mutex_unlock(&proxy_dev->buf_lock);

		pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n",

			 count, len);