Commit c222502b authored by Helge Deller's avatar Helge Deller Committed by Cheng Yu
Browse files

parisc: Drop strnlen_user() in favour of generic version 

mainline inclusion
from mainline-v5.15-rc1
commit 1260dea6
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GP
CVE: CVE-2024-26706

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1260dea6d2eb75706c978da828a36f0def590d3a



--------------------------------

As suggested by Arnd Bergmann, drop the parisc version of
strnlen_user() and switch to the generic version.

Suggested-by: default avatarArnd Bergmann <arnd@kernel.org>
Acked-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Signed-off-by: default avatarCheng Yu <serein.chengyu@huawei.com>
parent 974bcde8

arch/parisc/include/asm/uaccess.h

+1 −2
Original line number Diff line number Diff line
@@ -205,13 +205,12 @@ struct exception_table_entry { 


extern long strncpy_from_user(char *, const char __user *, long);

extern unsigned lclear_user(void __user *, unsigned long);

extern long lstrnlen_user(const char __user *, long);

extern __must_check long strnlen_user(const char __user *src, long n);

/*

 * Complex access routines -- macros

 */

#define user_addr_max() (~0UL)



#define strnlen_user lstrnlen_user

#define clear_user lclear_user

#define __clear_user lclear_user

arch/parisc/kernel/parisc_ksyms.c

+0 −1
Original line number Diff line number Diff line
@@ -32,7 +32,6 @@ EXPORT_SYMBOL(__xchg64); 


#include <linux/uaccess.h>

EXPORT_SYMBOL(lclear_user);

EXPORT_SYMBOL(lstrnlen_user);



#ifndef CONFIG_64BIT

/* Needed so insmod can set dp value */

arch/parisc/lib/lusercopy.S

+0 −34
Original line number Diff line number Diff line
@@ -67,40 +67,6 @@ $lclu_done: 
ENDPROC_CFI(lclear_user)





	/*

	 * long lstrnlen_user(char *s, long n)

	 *

	 * Returns 0 if exception before zero byte or reaching N,

	 *         N+1 if N would be exceeded,

	 *         else strlen + 1 (i.e. includes zero byte).

	 */



ENTRY_CFI(lstrnlen_user)

	comib,=     0,%r25,$lslen_nzero

	copy	    %r26,%r24

	get_sr

1:      ldbs,ma     1(%sr1,%r26),%r1

$lslen_loop:

	comib,=,n   0,%r1,$lslen_done

	addib,<>    -1,%r25,$lslen_loop

2:      ldbs,ma     1(%sr1,%r26),%r1

$lslen_done:

	bv          %r0(%r2)

	sub	    %r26,%r24,%r28



$lslen_nzero:

	b           $lslen_done

	ldo         1(%r26),%r26 /* special case for N == 0 */



3:      b	    $lslen_done

	copy        %r24,%r26    /* reset r26 so 0 is returned on fault */



	ASM_EXCEPTIONTABLE_ENTRY(1b,3b)

	ASM_EXCEPTIONTABLE_ENTRY(2b,3b)



ENDPROC_CFI(lstrnlen_user)





/*

 * unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)

 *