mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
![]() Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call. Fix this by probing read access rights at privilege level 3 (PRIV_USER) and setting __gu_err to -EFAULT (-14) if access isn't allowed. Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm. Signed-off-by: John David Anglin <dave.anglin@bell.net> Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org # v5.12+ |
||
---|---|---|
.. | ||
alternative.h | ||
asm-offsets.h | ||
asmregs.h | ||
assembly.h | ||
atomic.h | ||
barrier.h | ||
bitops.h | ||
bug.h | ||
cache.h | ||
cacheflush.h | ||
cachetype.h | ||
checksum.h | ||
cmpxchg.h | ||
compat.h | ||
compat_ucontext.h | ||
current.h | ||
delay.h | ||
dma-mapping.h | ||
dma.h | ||
dwarf.h | ||
eisa_bus.h | ||
eisa_eeprom.h | ||
elf.h | ||
extable.h | ||
fixmap.h | ||
floppy.h | ||
ftrace.h | ||
futex.h | ||
grfioctl.h | ||
hardirq.h | ||
hardware.h | ||
hash.h | ||
hugetlb.h | ||
io.h | ||
irq.h | ||
irqflags.h | ||
jump_label.h | ||
kbdleds.h | ||
Kbuild | ||
kexec.h | ||
kfence.h | ||
kgdb.h | ||
kprobes.h | ||
ldcw.h | ||
led.h | ||
linkage.h | ||
mman.h | ||
mmu.h | ||
mmu_context.h | ||
mmzone.h | ||
module.h | ||
page.h | ||
parisc-device.h | ||
parport.h | ||
pci.h | ||
pdc.h | ||
pdc_chassis.h | ||
pdcpat.h | ||
perf.h | ||
perf_event.h | ||
pgalloc.h | ||
pgtable.h | ||
prefetch.h | ||
processor.h | ||
psw.h | ||
ptrace.h | ||
ropes.h | ||
rt_sigframe.h | ||
runway.h | ||
seccomp.h | ||
sections.h | ||
serial.h | ||
shmparam.h | ||
signal.h | ||
smp.h | ||
socket.h | ||
sparsemem.h | ||
special_insns.h | ||
spinlock.h | ||
spinlock_types.h | ||
string.h | ||
superio.h | ||
switch_to.h | ||
syscall.h | ||
text-patching.h | ||
thread_info.h | ||
timex.h | ||
tlb.h | ||
tlbflush.h | ||
topology.h | ||
traps.h | ||
uaccess.h | ||
ucontext.h | ||
unistd.h | ||
unwind.h | ||
vdso.h | ||
video.h | ||
vmalloc.h |