Skip to content
  • Jan Beulich's avatar
    x86: Unify copy_from_user() size checking · 3df7b41a
    Jan Beulich authored
    Commits 4a312769 ("x86: Turn the
    copy_from_user check into an (optional) compile time warning")
    and 63312b6a ("x86: Add a
    Kconfig option to turn the copy_from_user warnings into errors")
    touched only the 32-bit variant of copy_from_user(), whereas the
    original commit 9f0cf4ad ("x86:
    Use __builtin_object_size() to validate the buffer size for
    copy_from_user()") also added the same code to the 64-bit one.
    
    Further the earlier conversion from an inline WARN() to the call
    to copy_from_user_overflow() went a little too far: When the
    number of bytes to be copied is not a constant (e.g. [looking at
    3.11] in drivers/net/tun.c:__tun_chr_ioctl() or
    drivers/pci/pcie/aer/aer_inject.c:aer_inject_write()), the
    compiler will always have to keep the funtion call, and hence
    there will always be a warning. By using __builtin_constant_p()
    we can avoid this.
    
    And then this slightly extends the effect of
    CONFIG_DEBUG_STRICT_USER_COPY_CHECKS in that apart from
    converting warnings to errors in the constant size case, it
    retains the (possibly wrong) warnings in the non-constant size
    case, such that if someone is prepared to get a few false
    positives, (s)he'll be able to recover the current behavior
    (except that these diagnostics now will never be converted to
    errors).
    
    Since the 32-bit variant (intentionally) didn't call
    might_fault(), the unification results in this being called
    twice now. Adding a suitable #ifdef would be the alternative if
    that's a problem.
    
    I'd like to point out though that with
    __compiletime_object_size() being restricted to gcc before 4.6,
    the whole construct is going to become more and more pointless
    going forward. I would question however that commit
    2fb0815c
    
     ("gcc4: disable
    __compiletime_object_size for GCC 4.6+") was really necessary,
    and instead this should have been dealt with as is done here
    from the beginning.
    
    Signed-off-by: default avatarJan Beulich <jbeulich@suse.com>
    Cc: Arjan van de Ven <arjan@linux.intel.com>
    Cc: Guenter Roeck <linux@roeck-us.net>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Link: http://lkml.kernel.org/r/5265056D02000078000FC4F3@nat28.tlf.novell.com
    
    
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    3df7b41a