diff options
Diffstat (limited to 'target/linux/bcm27xx/patches-5.4/950-0201-Fix-copy_from_user-if-BCM2835_FAST_MEMCPY-n.patch')
| -rw-r--r-- | target/linux/bcm27xx/patches-5.4/950-0201-Fix-copy_from_user-if-BCM2835_FAST_MEMCPY-n.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/target/linux/bcm27xx/patches-5.4/950-0201-Fix-copy_from_user-if-BCM2835_FAST_MEMCPY-n.patch b/target/linux/bcm27xx/patches-5.4/950-0201-Fix-copy_from_user-if-BCM2835_FAST_MEMCPY-n.patch new file mode 100644 index 0000000000..fc6efceacd --- /dev/null +++ b/target/linux/bcm27xx/patches-5.4/950-0201-Fix-copy_from_user-if-BCM2835_FAST_MEMCPY-n.patch @@ -0,0 +1,39 @@ +From dc516e6e8dfdaecf01efc7ee643a234191761062 Mon Sep 17 00:00:00 2001 +From: Tim Gover <tim.gover@raspberrypi.org> +Date: Thu, 14 Mar 2019 10:16:02 +0000 +Subject: [PATCH] Fix copy_from_user if BCM2835_FAST_MEMCPY=n + +The change which introduced CONFIG_BCM2835_FAST_MEMCPY unconditionally +changed the behaviour of arm_copy_from_user. The page pinning code +is not safe on ARMv7 if LPAE & high memory is enabled and causes +crashes which look like PTE corruption. + +Make __copy_from_user_memcpy conditional on CONFIG_2835_FAST_MEMCPY=y +which is really an ARMv6 / Pi1 optimization and not necessary on newer +ARM processors. +--- + arch/arm/lib/uaccess_with_memcpy.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/arm/lib/uaccess_with_memcpy.c ++++ b/arch/arm/lib/uaccess_with_memcpy.c +@@ -254,6 +254,7 @@ arm_copy_to_user(void __user *to, const + unsigned long __must_check + arm_copy_from_user(void *to, const void __user *from, unsigned long n) + { ++#ifdef CONFIG_BCM2835_FAST_MEMCPY + /* + * This test is stubbed out of the main function above to keep + * the overhead for small copies low by avoiding a large +@@ -268,6 +269,11 @@ arm_copy_from_user(void *to, const void + } else { + n = __copy_from_user_memcpy(to, from, n); + } ++#else ++ unsigned long ua_flags = uaccess_save_and_enable(); ++ n = __copy_from_user_std(to, from, n); ++ uaccess_restore(ua_flags); ++#endif + return n; + } + |