Skip to content

Commit b686ecd

Browse files
SiFiveHollandpalmer-dabbelt
authored andcommitted
riscv: misaligned: Restrict user access to kernel memory
raw_copy_{to,from}_user() do not call access_ok(), so this code allowed userspace to access any virtual memory address. Cc: [email protected] Fixes: 7c83232 ("riscv: add support for misaligned trap handling in S-mode") Fixes: 4413815 ("riscv: misaligned: remove CONFIG_RISCV_M_MODE specific code") Signed-off-by: Samuel Holland <[email protected]> Reviewed-by: Alexandre Ghiti <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Palmer Dabbelt <[email protected]>
1 parent 84cfab9 commit b686ecd

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

arch/riscv/kernel/traps_misaligned.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -417,7 +417,7 @@ int handle_misaligned_load(struct pt_regs *regs)
417417

418418
val.data_u64 = 0;
419419
if (user_mode(regs)) {
420-
if (raw_copy_from_user(&val, (u8 __user *)addr, len))
420+
if (copy_from_user(&val, (u8 __user *)addr, len))
421421
return -1;
422422
} else {
423423
memcpy(&val, (u8 *)addr, len);
@@ -515,7 +515,7 @@ int handle_misaligned_store(struct pt_regs *regs)
515515
return -EOPNOTSUPP;
516516

517517
if (user_mode(regs)) {
518-
if (raw_copy_to_user((u8 __user *)addr, &val, len))
518+
if (copy_to_user((u8 __user *)addr, &val, len))
519519
return -1;
520520
} else {
521521
memcpy((u8 *)addr, &val, len);

0 commit comments

Comments
 (0)