Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752866AbcDVJsX (ORCPT ); Fri, 22 Apr 2016 05:48:23 -0400 Received: from terminus.zytor.com ([198.137.202.10]:36752 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752444AbcDVJr6 (ORCPT ); Fri, 22 Apr 2016 05:47:58 -0400 Date: Fri, 22 Apr 2016 02:46:42 -0700 From: tip-bot for Kees Cook Message-ID: Cc: yinghai@kernel.org, luto@kernel.org, hpa@zytor.com, bp@suse.de, jpoimboe@redhat.com, linux-kernel@vger.kernel.org, dvlasenk@redhat.com, akpm@linux-foundation.org, peterz@infradead.org, aryabinin@virtuozzo.com, luto@amacapital.net, hjl.tools@gmail.com, brgerst@gmail.com, keescook@chromium.org, bp@alien8.de, tglx@linutronix.de, lasse.collin@tukaani.org, bhe@redhat.com, dvyukov@google.com, torvalds@linux-foundation.org, mingo@kernel.org Reply-To: aryabinin@virtuozzo.com, peterz@infradead.org, dvlasenk@redhat.com, linux-kernel@vger.kernel.org, akpm@linux-foundation.org, hpa@zytor.com, luto@kernel.org, yinghai@kernel.org, jpoimboe@redhat.com, bp@suse.de, dvyukov@google.com, torvalds@linux-foundation.org, mingo@kernel.org, bhe@redhat.com, lasse.collin@tukaani.org, tglx@linutronix.de, bp@alien8.de, keescook@chromium.org, brgerst@gmail.com, luto@amacapital.net, hjl.tools@gmail.com In-Reply-To: <1461185746-8017-5-git-send-email-keescook@chromium.org> References: <1461185746-8017-5-git-send-email-keescook@chromium.org> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/boot] x86/boot: Make memcpy() handle overlaps Git-Commit-ID: bf0118dbba9542ceb5d33d4a86830a6c88b0bbf6 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3445 Lines: 103 Commit-ID: bf0118dbba9542ceb5d33d4a86830a6c88b0bbf6 Gitweb: http://git.kernel.org/tip/bf0118dbba9542ceb5d33d4a86830a6c88b0bbf6 Author: Kees Cook AuthorDate: Wed, 20 Apr 2016 13:55:45 -0700 Committer: Ingo Molnar CommitDate: Fri, 22 Apr 2016 10:00:50 +0200 x86/boot: Make memcpy() handle overlaps Two uses of memcpy() (screen scrolling and ELF parsing) were handling overlapping memory areas. While there were no explicitly noticed bugs here (yet), it is best to fix this so that the copying will always be safe. Instead of making a new memmove() function that might collide with other memmove() definitions in the decompressors, this just makes the compressed boot code's copy of memcpy() overlap-safe. Suggested-by: Lasse Collin Reported-by: Yinghai Lu Signed-off-by: Kees Cook Cc: Andrew Morton Cc: Andrey Ryabinin Cc: Andy Lutomirski Cc: Andy Lutomirski Cc: Baoquan He Cc: Borislav Petkov Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: Dmitry Vyukov Cc: H. Peter Anvin Cc: H.J. Lu Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1461185746-8017-5-git-send-email-keescook@chromium.org Signed-off-by: Ingo Molnar --- arch/x86/boot/compressed/misc.c | 4 +--- arch/x86/boot/compressed/string.c | 22 ++++++++++++++++++++-- 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c index 0381e25..eacc855 100644 --- a/arch/x86/boot/compressed/misc.c +++ b/arch/x86/boot/compressed/misc.c @@ -301,9 +301,7 @@ static void parse_elf(void *output) #else dest = (void *)(phdr->p_paddr); #endif - memcpy(dest, - output + phdr->p_offset, - phdr->p_filesz); + memcpy(dest, output + phdr->p_offset, phdr->p_filesz); break; default: /* Ignore other PT_* */ break; } diff --git a/arch/x86/boot/compressed/string.c b/arch/x86/boot/compressed/string.c index 00e788b..1e10e40 100644 --- a/arch/x86/boot/compressed/string.c +++ b/arch/x86/boot/compressed/string.c @@ -1,7 +1,7 @@ #include "../string.c" #ifdef CONFIG_X86_32 -void *memcpy(void *dest, const void *src, size_t n) +void *__memcpy(void *dest, const void *src, size_t n) { int d0, d1, d2; asm volatile( @@ -15,7 +15,7 @@ void *memcpy(void *dest, const void *src, size_t n) return dest; } #else -void *memcpy(void *dest, const void *src, size_t n) +void *__memcpy(void *dest, const void *src, size_t n) { long d0, d1, d2; asm volatile( @@ -39,3 +39,21 @@ void *memset(void *s, int c, size_t n) ss[i] = c; return s; } + +/* + * This memcpy is overlap safe (i.e. it is memmove without conflicting + * with other definitions of memmove from the various decompressors. + */ +void *memcpy(void *dest, const void *src, size_t n) +{ + unsigned char *d = dest; + const unsigned char *s = src; + + if (d <= s || d - s >= n) + return __memcpy(dest, src, n); + + while (n-- > 0) + d[n] = s[n]; + + return dest; +}