[PATCH] x86: Use __builtin_object_size to validate the buffer size for copy_from_user

[PATCH] x86: Use __builtin_object_size to validate the buffer size for copy_from_user

[Arjan van de Ven]

>From 524a1da3c45683cec77480acc6cab1d33ae8d5cb Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Sat, 26 Sep 2009 12:36:21 +0200
Subject: [PATCH] x86: Use __builtin_object_size to validate the buffer size for copy_from_user

gcc (4.x) supports the __builtin_object_size() builtin, which reports the
size of an object that a pointer point to, when known at compile time.
If the buffer size is not known at compile time, a constant -1 is returned.

This patch uses this feature to add a sanity check to copy_from_user();
if the target buffer is known to be smaller than the copy size, the copy
is aborted and a WARNing is emitted in memory debug mode.

These extra checks compile away when the object size is not known,
or if both the buffer size and the copy length are constants.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Reviewed-by: Ingo Molnar <mingo@elte.hu>
---
 arch/x86/include/asm/uaccess_32.h |   19 ++++++++++++++++++-
 arch/x86/include/asm/uaccess_64.h |   19 ++++++++++++++++++-
 arch/x86/kernel/x8664_ksyms_64.c  |    2 +-
 arch/x86/lib/copy_user_64.S       |    4 ++--
 arch/x86/lib/usercopy_32.c        |    4 ++--
 include/linux/compiler-gcc4.h     |    2 ++
 include/linux/compiler.h          |    4 ++++
 7 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
index 632fb44..582d6ae 100644
--- a/arch/x86/include/asm/uaccess_32.h
+++ b/arch/x86/include/asm/uaccess_32.h
@@ -187,9 +187,26 @@ __copy_from_user_inatomic_nocache(void *to, const void __user *from,
 
 unsigned long __must_check copy_to_user(void __user *to,
 					const void *from, unsigned long n);
-unsigned long __must_check copy_from_user(void *to,
+unsigned long __must_check _copy_from_user(void *to,
 					  const void __user *from,
 					  unsigned long n);
+
+static inline unsigned long __must_check copy_from_user(void *to,
+					  const void __user *from,
+					  unsigned long n)
+{
+	int sz = __compiletime_object_size(to);
+	int ret = -EFAULT;
+
+	if (likely(sz == -1 || sz >= n))
+		ret = _copy_from_user(to, from, n);
+#ifdef CONFIG_DEBUG_VM
+	else
+		WARN(1, "Buffer overflow detected!\n");
+#endif
+	return ret;
+}
+
 long __must_check strncpy_from_user(char *dst, const char __user *src,
 				    long count);
 long __must_check __strncpy_from_user(char *dst,
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index db24b21..ce6fec7 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -21,10 +21,27 @@ copy_user_generic(void *to, const void *from, unsigned len);
 __must_check unsigned long
 copy_to_user(void __user *to, const void *from, unsigned len);
 __must_check unsigned long
-copy_from_user(void *to, const void __user *from, unsigned len);
+_copy_from_user(void *to, const void __user *from, unsigned len);
 __must_check unsigned long
 copy_in_user(void __user *to, const void __user *from, unsigned len);
 
+static inline unsigned long __must_check copy_from_user(void *to,
+					  const void __user *from,
+					  unsigned long n)
+{
+	int sz = __compiletime_object_size(to);
+	int ret = -EFAULT;
+
+	if (likely(sz == -1 || sz >= n))
+		ret = _copy_from_user(to, from, n);
+#ifdef CONFIG_DEBUG_VM
+	else
+		WARN(1, "Buffer overflow detected!\n");
+#endif
+	return ret;
+}
+
+
 static __always_inline __must_check
 int __copy_from_user(void *dst, const void __user *src, unsigned size)
 {
diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
index 3909e3b..a0cdd8c 100644
--- a/arch/x86/kernel/x8664_ksyms_64.c
+++ b/arch/x86/kernel/x8664_ksyms_64.c
@@ -30,7 +30,7 @@ EXPORT_SYMBOL(__put_user_8);
 
 EXPORT_SYMBOL(copy_user_generic);
 EXPORT_SYMBOL(__copy_user_nocache);
-EXPORT_SYMBOL(copy_from_user);
+EXPORT_SYMBOL(_copy_from_user);
 EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(__copy_from_user_inatomic);
 
diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
index 6ba0f7b..4be3c41 100644
--- a/arch/x86/lib/copy_user_64.S
+++ b/arch/x86/lib/copy_user_64.S
@@ -78,7 +78,7 @@ ENTRY(copy_to_user)
 ENDPROC(copy_to_user)
 
 /* Standard copy_from_user with segment limit checking */
-ENTRY(copy_from_user)
+ENTRY(_copy_from_user)
 	CFI_STARTPROC
 	GET_THREAD_INFO(%rax)
 	movq %rsi,%rcx
@@ -88,7 +88,7 @@ ENTRY(copy_from_user)
 	jae bad_from_user
 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
 	CFI_ENDPROC
-ENDPROC(copy_from_user)
+ENDPROC(_copy_from_user)
 
 ENTRY(copy_user_generic)
 	CFI_STARTPROC
diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
index 1f118d4..8498684 100644
--- a/arch/x86/lib/usercopy_32.c
+++ b/arch/x86/lib/usercopy_32.c
@@ -874,7 +874,7 @@ EXPORT_SYMBOL(copy_to_user);
  * data to the requested size using zero bytes.
  */
 unsigned long
-copy_from_user(void *to, const void __user *from, unsigned long n)
+_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
 	if (access_ok(VERIFY_READ, from, n))
 		n = __copy_from_user(to, from, n);
@@ -882,4 +882,4 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
 		memset(to, 0, n);
 	return n;
 }
-EXPORT_SYMBOL(copy_from_user);
+EXPORT_SYMBOL(_copy_from_user);
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 450fa59..a3aef5d 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -37,3 +37,5 @@
 #define __cold			__attribute__((__cold__))
 
 #endif
+
+#define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 9d4c4b0..9c42853 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -185,6 +185,10 @@ extern void __chk_io_ptr(const volatile void __iomem *);
 # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
 #endif
 
+/* Compile time object size, -1 for unknown */
+#ifndef __compiletime_object_size
+# define __compiletime_object_size(obj) -1
+#endif
 /*
  * Prevent the compiler from merging or refetching accesses.  The compiler
  * is also forbidden from reordering successive instances of ACCESS_ONCE(),
-- 
1.6.0.6



-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org

Re: [PATCH] x86: Use __builtin_object_size to validate the buffer size for copy_from_user

[Ingo Molnar]

* Arjan van de Ven <arjan@infradead.org> wrote:

> From 524a1da3c45683cec77480acc6cab1d33ae8d5cb Mon Sep 17 00:00:00 2001
> From: Arjan van de Ven <arjan@linux.intel.com>
> Date: Sat, 26 Sep 2009 12:36:21 +0200
> Subject: [PATCH] x86: Use __builtin_object_size to validate the buffer size for copy_from_user
> 
> gcc (4.x) supports the __builtin_object_size() builtin, which reports the
> size of an object that a pointer point to, when known at compile time.
> If the buffer size is not known at compile time, a constant -1 is returned.
> 
> This patch uses this feature to add a sanity check to copy_from_user();
> if the target buffer is known to be smaller than the copy size, the copy
> is aborted and a WARNing is emitted in memory debug mode.
> 
> These extra checks compile away when the object size is not known,
> or if both the buffer size and the copy length are constants.
> 
> Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
> Reviewed-by: Ingo Molnar <mingo@elte.hu>
> ---
>  arch/x86/include/asm/uaccess_32.h |   19 ++++++++++++++++++-
>  arch/x86/include/asm/uaccess_64.h |   19 ++++++++++++++++++-
>  arch/x86/kernel/x8664_ksyms_64.c  |    2 +-
>  arch/x86/lib/copy_user_64.S       |    4 ++--
>  arch/x86/lib/usercopy_32.c        |    4 ++--
>  include/linux/compiler-gcc4.h     |    2 ++
>  include/linux/compiler.h          |    4 ++++
>  7 files changed, 47 insertions(+), 7 deletions(-)

I have tested this on a buffer overflow and it caught it:

[   87.056952] ------------[ cut here ]------------
[   87.061628] WARNING: at /home/mingo/linux/arch/x86/include/asm/uaccess_64.h:35 sys_perf_counter_open+0x112/0x65b()
[   87.072600] Hardware name: System Product Name
[   87.077072] Buffer overflow detected!
[   87.080762] Modules linked in:
[   87.083858] Pid: 2670, comm: exploit Not tainted 2.6.31 #17235
[   87.089708] Call Trace:
[   87.092180]  [<ffffffff810a3241>] ? sys_perf_counter_open+0x112/0x65b
[   87.098654]  [<ffffffff8104303c>] warn_slowpath_common+0x77/0xa4
[   87.104684]  [<ffffffff810430b6>] warn_slowpath_fmt+0x3c/0x3e
[   87.110458]  [<ffffffff810e41c3>] ? putname+0x30/0x39
[   87.115570]  [<ffffffff810a3241>] sys_perf_counter_open+0x112/0x65b
[   87.121880]  [<ffffffff8105b6df>] ? up_read+0x9/0xb
[   87.126802]  [<ffffffff8100ba6b>] system_call_fastpath+0x16/0x1b
[   87.132851] ---[ end trace 7469dba2cd3cfea8 ]---


> +static inline unsigned long __must_check copy_from_user(void *to,
> +					  const void __user *from,
> +					  unsigned long n)
> +{
> +	int sz = __compiletime_object_size(to);
> +	int ret = -EFAULT;
> +
> +	if (likely(sz == -1 || sz >= n))
> +		ret = _copy_from_user(to, from, n);
> +#ifdef CONFIG_DEBUG_VM
> +	else
> +		WARN(1, "Buffer overflow detected!\n");
> +#endif
> +	return ret;
> +}

This is pretty optimal in the !CONFIG_DEBUG_VM case. Would be nice to 
see precisely how optimal - how many new instructions in the default 
!CONFIG_DEBUG_VM case?


	Ingo

Re: [PATCH] x86: Use __builtin_object_size to validate the buffer size for copy_from_user

[Arjan van de Ven]

On Sat, 26 Sep 2009 14:41:51 +0200
Ingo Molnar <mingo@elte.hu> wrote:

> 
> * Arjan van de Ven <arjan@infradead.org> wrote:
> 
> > From 524a1da3c45683cec77480acc6cab1d33ae8d5cb Mon Sep 17 00:00:00
> > 2001 From: Arjan van de Ven <arjan@linux.intel.com>
> > Date: Sat, 26 Sep 2009 12:36:21 +0200
> > Subject: [PATCH] x86: Use __builtin_object_size to validate the
> > buffer size for copy_from_user
> > 
> > gcc (4.x) supports the __builtin_object_size() builtin, which
> > reports the size of an object that a pointer point to, when known
> > at compile time. If the buffer size is not known at compile time, a
> > constant -1 is returned.
> > 
> > This patch uses this feature to add a sanity check to
> > copy_from_user(); if the target buffer is known to be smaller than
> > the copy size, the copy is aborted and a WARNing is emitted in
> > memory debug mode.
> > 
> > These extra checks compile away when the object size is not known,
> > or if both the buffer size and the copy length are constants.
> > 
> > Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
> > Reviewed-by: Ingo Molnar <mingo@elte.hu>
> > ---
> >  arch/x86/include/asm/uaccess_32.h |   19 ++++++++++++++++++-
> >  arch/x86/include/asm/uaccess_64.h |   19 ++++++++++++++++++-
> >  arch/x86/kernel/x8664_ksyms_64.c  |    2 +-
> >  arch/x86/lib/copy_user_64.S       |    4 ++--
> >  arch/x86/lib/usercopy_32.c        |    4 ++--
> >  include/linux/compiler-gcc4.h     |    2 ++
> >  include/linux/compiler.h          |    4 ++++
> >  7 files changed, 47 insertions(+), 7 deletions(-)
> 
> I have tested this on a buffer overflow and it caught it:
> 
> [   87.056952] ------------[ cut here ]------------
> [   87.061628] WARNING:
> at /home/mingo/linux/arch/x86/include/asm/uaccess_64.h:35
> sys_perf_counter_open+0x112/0x65b() [   87.072600] Hardware name:
> System Product Name [   87.077072] Buffer overflow detected!
> [   87.080762] Modules linked in: [   87.083858] Pid: 2670, comm:
> exploit Not tainted 2.6.31 #17235 [   87.089708] Call Trace:
> [   87.092180]  [<ffffffff810a3241>] ?
> sys_perf_counter_open+0x112/0x65b [   87.098654]
> [<ffffffff8104303c>] warn_slowpath_common+0x77/0xa4 [   87.104684]
> [<ffffffff810430b6>] warn_slowpath_fmt+0x3c/0x3e [   87.110458]
> [<ffffffff810e41c3>] ? putname+0x30/0x39 [   87.115570]
> [<ffffffff810a3241>] sys_perf_counter_open+0x112/0x65b
> [   87.121880]  [<ffffffff8105b6df>] ? up_read+0x9/0xb
> [   87.126802]  [<ffffffff8100ba6b>] system_call_fastpath+0x16/0x1b
> [   87.132851] ---[ end trace 7469dba2cd3cfea8 ]---
> 
> 
> > +static inline unsigned long __must_check copy_from_user(void *to,
> > +					  const void __user *from,
> > +					  unsigned long n)
> > +{
> > +	int sz = __compiletime_object_size(to);
> > +	int ret = -EFAULT;
> > +
> > +	if (likely(sz == -1 || sz >= n))
> > +		ret = _copy_from_user(to, from, n);
> > +#ifdef CONFIG_DEBUG_VM
> > +	else
> > +		WARN(1, "Buffer overflow detected!\n");
> > +#endif
> > +	return ret;
> > +}
> 
> This is pretty optimal in the !CONFIG_DEBUG_VM case. Would be nice to 
> see precisely how optimal - how many new instructions in the default 
> !CONFIG_DEBUG_VM case?
> 

a test ->write method:

static ssize_t test_write(struct file *fp, const char __user *buf,
                         size_t len, loff_t *off)
{
        char buffer[10];
        int ret;

        ret = copy_from_user(&buffer, buf, len);

        return ret;
}

with the patch turns into

   0:   55                      push   %ebp

*  1:   b8 f2 ff ff ff          mov    $0xfffffff2,%eax
   6:   89 e5                   mov    %esp,%ebp
   8:   83 ec 0c                sub    $0xc,%esp
*  b:   83 f9 0a                cmp    $0xa,%ecx
*  e:   77 08                   ja     18 <test_write+0x18>
  10:   8d 45 f6                lea    -0xa(%ebp),%eax
  13:   e8 fc ff ff ff          call   14 <_copy_from_user>
  18:   c9                      leave  
  19:   c3                      ret  

while without it gets

   0:   55                      push   %ebp
   1:   89 e5                   mov    %esp,%ebp
   3:   83 ec 0c                sub    $0xc,%esp
   6:   8d 45 f6                lea    -0xa(%ebp),%eax
   9:   e8 fc ff ff ff          call   <copy_from_user>
   e:   c9                      leave  
   f:   c3                      ret  

This is for the case where you have a known stack variable, but
variable copy size.
If you have either an unknown target size and/or a fixed sized copy,
the code goes away entirely.


-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org

Re: [PATCH] x86: Use __builtin_object_size to validate the buffer size for copy_from_user

[Ingo Molnar]

* Arjan van de Ven <arjan@infradead.org> wrote:

> On Sat, 26 Sep 2009 14:41:51 +0200
> Ingo Molnar <mingo@elte.hu> wrote:
> 
> > 
> > * Arjan van de Ven <arjan@infradead.org> wrote:
> > 
> > > From 524a1da3c45683cec77480acc6cab1d33ae8d5cb Mon Sep 17 00:00:00
> > > 2001 From: Arjan van de Ven <arjan@linux.intel.com>
> > > Date: Sat, 26 Sep 2009 12:36:21 +0200
> > > Subject: [PATCH] x86: Use __builtin_object_size to validate the
> > > buffer size for copy_from_user
> > > 
> > > gcc (4.x) supports the __builtin_object_size() builtin, which
> > > reports the size of an object that a pointer point to, when known
> > > at compile time. If the buffer size is not known at compile time, a
> > > constant -1 is returned.
> > > 
> > > This patch uses this feature to add a sanity check to
> > > copy_from_user(); if the target buffer is known to be smaller than
> > > the copy size, the copy is aborted and a WARNing is emitted in
> > > memory debug mode.
> > > 
> > > These extra checks compile away when the object size is not known,
> > > or if both the buffer size and the copy length are constants.
> > > 
> > > Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
> > > Reviewed-by: Ingo Molnar <mingo@elte.hu>
> > > ---
> > >  arch/x86/include/asm/uaccess_32.h |   19 ++++++++++++++++++-
> > >  arch/x86/include/asm/uaccess_64.h |   19 ++++++++++++++++++-
> > >  arch/x86/kernel/x8664_ksyms_64.c  |    2 +-
> > >  arch/x86/lib/copy_user_64.S       |    4 ++--
> > >  arch/x86/lib/usercopy_32.c        |    4 ++--
> > >  include/linux/compiler-gcc4.h     |    2 ++
> > >  include/linux/compiler.h          |    4 ++++
> > >  7 files changed, 47 insertions(+), 7 deletions(-)
> > 
> > I have tested this on a buffer overflow and it caught it:
> > 
> > [   87.056952] ------------[ cut here ]------------
> > [   87.061628] WARNING:
> > at /home/mingo/linux/arch/x86/include/asm/uaccess_64.h:35
> > sys_perf_counter_open+0x112/0x65b() [   87.072600] Hardware name:
> > System Product Name [   87.077072] Buffer overflow detected!
> > [   87.080762] Modules linked in: [   87.083858] Pid: 2670, comm:
> > exploit Not tainted 2.6.31 #17235 [   87.089708] Call Trace:
> > [   87.092180]  [<ffffffff810a3241>] ?
> > sys_perf_counter_open+0x112/0x65b [   87.098654]
> > [<ffffffff8104303c>] warn_slowpath_common+0x77/0xa4 [   87.104684]
> > [<ffffffff810430b6>] warn_slowpath_fmt+0x3c/0x3e [   87.110458]
> > [<ffffffff810e41c3>] ? putname+0x30/0x39 [   87.115570]
> > [<ffffffff810a3241>] sys_perf_counter_open+0x112/0x65b
> > [   87.121880]  [<ffffffff8105b6df>] ? up_read+0x9/0xb
> > [   87.126802]  [<ffffffff8100ba6b>] system_call_fastpath+0x16/0x1b
> > [   87.132851] ---[ end trace 7469dba2cd3cfea8 ]---
> > 
> > 
> > > +static inline unsigned long __must_check copy_from_user(void *to,
> > > +					  const void __user *from,
> > > +					  unsigned long n)
> > > +{
> > > +	int sz = __compiletime_object_size(to);
> > > +	int ret = -EFAULT;
> > > +
> > > +	if (likely(sz == -1 || sz >= n))
> > > +		ret = _copy_from_user(to, from, n);
> > > +#ifdef CONFIG_DEBUG_VM
> > > +	else
> > > +		WARN(1, "Buffer overflow detected!\n");
> > > +#endif
> > > +	return ret;
> > > +}
> > 
> > This is pretty optimal in the !CONFIG_DEBUG_VM case. Would be nice to 
> > see precisely how optimal - how many new instructions in the default 
> > !CONFIG_DEBUG_VM case?
> > 
> 
> a test ->write method:
> 
> static ssize_t test_write(struct file *fp, const char __user *buf,
>                          size_t len, loff_t *off)
> {
>         char buffer[10];
>         int ret;
> 
>         ret = copy_from_user(&buffer, buf, len);
> 
>         return ret;
> }
> 
> with the patch turns into
> 
>    0:   55                      push   %ebp
> 
> *  1:   b8 f2 ff ff ff          mov    $0xfffffff2,%eax
>    6:   89 e5                   mov    %esp,%ebp
>    8:   83 ec 0c                sub    $0xc,%esp
> *  b:   83 f9 0a                cmp    $0xa,%ecx
> *  e:   77 08                   ja     18 <test_write+0x18>
>   10:   8d 45 f6                lea    -0xa(%ebp),%eax
>   13:   e8 fc ff ff ff          call   14 <_copy_from_user>
>   18:   c9                      leave  
>   19:   c3                      ret  
> 
> while without it gets
> 
>    0:   55                      push   %ebp
>    1:   89 e5                   mov    %esp,%ebp
>    3:   83 ec 0c                sub    $0xc,%esp
>    6:   8d 45 f6                lea    -0xa(%ebp),%eax
>    9:   e8 fc ff ff ff          call   <copy_from_user>
>    e:   c9                      leave  
>    f:   c3                      ret  
> 
> This is for the case where you have a known stack variable, but
> variable copy size.
> If you have either an unknown target size and/or a fixed sized copy,
> the code goes away entirely.

That's pretty convincing.

Linus, any objections?

	Ingo

[tip:x86/asm] x86: Use __builtin_object_size() to validate the buffer size for copy_from_user()

[tip-bot for Arjan van de Ven]

Commit-ID:  9f0cf4adb6aa0bfccf675c938124e68f7f06349d
Gitweb:     http://git.kernel.org/tip/9f0cf4adb6aa0bfccf675c938124e68f7f06349d
Author:     Arjan van de Ven <arjan@infradead.org>
AuthorDate: Sat, 26 Sep 2009 14:33:01 +0200
Committer:  Ingo Molnar <mingo@elte.hu>
CommitDate: Sat, 26 Sep 2009 16:25:41 +0200

x86: Use __builtin_object_size() to validate the buffer size for copy_from_user()

gcc (4.x) supports the __builtin_object_size() builtin, which
reports the size of an object that a pointer point to, when known
at compile time. If the buffer size is not known at compile time, a
constant -1 is returned.

This patch uses this feature to add a sanity check to
copy_from_user(); if the target buffer is known to be smaller than
the copy size, the copy is aborted and a WARNing is emitted in
memory debug mode.

These extra checks compile away when the object size is not known,
or if both the buffer size and the copy length are constants.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
LKML-Reference: <20090926143301.2c396b94@infradead.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>


---
 arch/x86/include/asm/uaccess_32.h |   19 ++++++++++++++++++-
 arch/x86/include/asm/uaccess_64.h |   19 ++++++++++++++++++-
 arch/x86/kernel/x8664_ksyms_64.c  |    2 +-
 arch/x86/lib/copy_user_64.S       |    4 ++--
 arch/x86/lib/usercopy_32.c        |    4 ++--
 include/linux/compiler-gcc4.h     |    2 ++
 include/linux/compiler.h          |    4 ++++
 7 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
index 632fb44..582d6ae 100644
--- a/arch/x86/include/asm/uaccess_32.h
+++ b/arch/x86/include/asm/uaccess_32.h
@@ -187,9 +187,26 @@ __copy_from_user_inatomic_nocache(void *to, const void __user *from,
 
 unsigned long __must_check copy_to_user(void __user *to,
 					const void *from, unsigned long n);
-unsigned long __must_check copy_from_user(void *to,
+unsigned long __must_check _copy_from_user(void *to,
 					  const void __user *from,
 					  unsigned long n);
+
+static inline unsigned long __must_check copy_from_user(void *to,
+					  const void __user *from,
+					  unsigned long n)
+{
+	int sz = __compiletime_object_size(to);
+	int ret = -EFAULT;
+
+	if (likely(sz == -1 || sz >= n))
+		ret = _copy_from_user(to, from, n);
+#ifdef CONFIG_DEBUG_VM
+	else
+		WARN(1, "Buffer overflow detected!\n");
+#endif
+	return ret;
+}
+
 long __must_check strncpy_from_user(char *dst, const char __user *src,
 				    long count);
 long __must_check __strncpy_from_user(char *dst,
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index db24b21..ce6fec7 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -21,10 +21,27 @@ copy_user_generic(void *to, const void *from, unsigned len);
 __must_check unsigned long
 copy_to_user(void __user *to, const void *from, unsigned len);
 __must_check unsigned long
-copy_from_user(void *to, const void __user *from, unsigned len);
+_copy_from_user(void *to, const void __user *from, unsigned len);
 __must_check unsigned long
 copy_in_user(void __user *to, const void __user *from, unsigned len);
 
+static inline unsigned long __must_check copy_from_user(void *to,
+					  const void __user *from,
+					  unsigned long n)
+{
+	int sz = __compiletime_object_size(to);
+	int ret = -EFAULT;
+
+	if (likely(sz == -1 || sz >= n))
+		ret = _copy_from_user(to, from, n);
+#ifdef CONFIG_DEBUG_VM
+	else
+		WARN(1, "Buffer overflow detected!\n");
+#endif
+	return ret;
+}
+
+
 static __always_inline __must_check
 int __copy_from_user(void *dst, const void __user *src, unsigned size)
 {
diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
index 3909e3b..a0cdd8c 100644
--- a/arch/x86/kernel/x8664_ksyms_64.c
+++ b/arch/x86/kernel/x8664_ksyms_64.c
@@ -30,7 +30,7 @@ EXPORT_SYMBOL(__put_user_8);
 
 EXPORT_SYMBOL(copy_user_generic);
 EXPORT_SYMBOL(__copy_user_nocache);
-EXPORT_SYMBOL(copy_from_user);
+EXPORT_SYMBOL(_copy_from_user);
 EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(__copy_from_user_inatomic);
 
diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
index 6ba0f7b..4be3c41 100644
--- a/arch/x86/lib/copy_user_64.S
+++ b/arch/x86/lib/copy_user_64.S
@@ -78,7 +78,7 @@ ENTRY(copy_to_user)
 ENDPROC(copy_to_user)
 
 /* Standard copy_from_user with segment limit checking */
-ENTRY(copy_from_user)
+ENTRY(_copy_from_user)
 	CFI_STARTPROC
 	GET_THREAD_INFO(%rax)
 	movq %rsi,%rcx
@@ -88,7 +88,7 @@ ENTRY(copy_from_user)
 	jae bad_from_user
 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
 	CFI_ENDPROC
-ENDPROC(copy_from_user)
+ENDPROC(_copy_from_user)
 
 ENTRY(copy_user_generic)
 	CFI_STARTPROC
diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
index 1f118d4..8498684 100644
--- a/arch/x86/lib/usercopy_32.c
+++ b/arch/x86/lib/usercopy_32.c
@@ -874,7 +874,7 @@ EXPORT_SYMBOL(copy_to_user);
  * data to the requested size using zero bytes.
  */
 unsigned long
-copy_from_user(void *to, const void __user *from, unsigned long n)
+_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
 	if (access_ok(VERIFY_READ, from, n))
 		n = __copy_from_user(to, from, n);
@@ -882,4 +882,4 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
 		memset(to, 0, n);
 	return n;
 }
-EXPORT_SYMBOL(copy_from_user);
+EXPORT_SYMBOL(_copy_from_user);
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 450fa59..a3aef5d 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -37,3 +37,5 @@
 #define __cold			__attribute__((__cold__))
 
 #endif
+
+#define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 04fb513..8e54108 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -266,6 +266,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
 # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
 #endif
 
+/* Compile time object size, -1 for unknown */
+#ifndef __compiletime_object_size
+# define __compiletime_object_size(obj) -1
+#endif
 /*
  * Prevent the compiler from merging or refetching accesses.  The compiler
  * is also forbidden from reordering successive instances of ACCESS_ONCE(),