From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755516AbcECHsG (ORCPT ); Tue, 3 May 2016 03:48:06 -0400 Received: from terminus.zytor.com ([198.137.202.10]:36966 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751131AbcECHr0 (ORCPT ); Tue, 3 May 2016 03:47:26 -0400 Date: Tue, 3 May 2016 00:46:05 -0700 From: tip-bot for Kees Cook Message-ID: Cc: mingo@kernel.org, brgerst@gmail.com, tglx@linutronix.de, yinghai@kernel.org, gnomes@lxorguk.ukuu.org.uk, dvlasenk@redhat.com, bp@suse.de, bp@alien8.de, keescook@chromium.org, bhe@redhat.com, hpa@zytor.com, linux-kernel@vger.kernel.org, peterz@infradead.org, luto@amacapital.net, lasse.collin@tukaani.org, torvalds@linux-foundation.org Reply-To: bhe@redhat.com, keescook@chromium.org, hpa@zytor.com, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, lasse.collin@tukaani.org, luto@amacapital.net, peterz@infradead.org, tglx@linutronix.de, mingo@kernel.org, brgerst@gmail.com, gnomes@lxorguk.ukuu.org.uk, dvlasenk@redhat.com, yinghai@kernel.org, bp@suse.de, bp@alien8.de In-Reply-To: <1462229461-3370-3-git-send-email-keescook@chromium.org> References: <1462229461-3370-3-git-send-email-keescook@chromium.org> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/boot] x86/boot: Warn on future overlapping memcpy() use Git-Commit-ID: 00ec2c37031eb1b1feda006c84748d126dc2ef27 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 00ec2c37031eb1b1feda006c84748d126dc2ef27 Gitweb: http://git.kernel.org/tip/00ec2c37031eb1b1feda006c84748d126dc2ef27 Author: Kees Cook AuthorDate: Mon, 2 May 2016 15:51:01 -0700 Committer: Ingo Molnar CommitDate: Tue, 3 May 2016 08:15:58 +0200 x86/boot: Warn on future overlapping memcpy() use If an overlapping memcpy() is ever attempted, we should at least report it, in case it might lead to problems, so it could be changed to a memmove() call instead. Suggested-by: Ingo Molnar Signed-off-by: Kees Cook Cc: Andy Lutomirski Cc: Baoquan He Cc: Borislav Petkov Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Lasse Collin Cc: Linus Torvalds Cc: One Thousand Gnomes Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yinghai Lu Link: http://lkml.kernel.org/r/1462229461-3370-3-git-send-email-keescook@chromium.org Signed-off-by: Ingo Molnar --- arch/x86/boot/compressed/string.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/arch/x86/boot/compressed/string.c b/arch/x86/boot/compressed/string.c index faa4dc7..cea140c 100644 --- a/arch/x86/boot/compressed/string.c +++ b/arch/x86/boot/compressed/string.c @@ -10,7 +10,7 @@ #include "../string.c" #ifdef CONFIG_X86_32 -void *memcpy(void *dest, const void *src, size_t n) +static void *__memcpy(void *dest, const void *src, size_t n) { int d0, d1, d2; asm volatile( @@ -24,7 +24,7 @@ void *memcpy(void *dest, const void *src, size_t n) return dest; } #else -void *memcpy(void *dest, const void *src, size_t n) +static void *__memcpy(void *dest, const void *src, size_t n) { long d0, d1, d2; asm volatile( @@ -55,10 +55,20 @@ void *memmove(void *dest, const void *src, size_t n) const unsigned char *s = src; if (d <= s || d - s >= n) - return memcpy(dest, src, n); + return __memcpy(dest, src, n); while (n-- > 0) d[n] = s[n]; return dest; } + +/* Detect and warn about potential overlaps, but handle them with memmove. */ +void *memcpy(void *dest, const void *src, size_t n) +{ + if (dest > src && dest - src < n) { + warn("Avoiding potentially unsafe overlapping memcpy()!"); + return memmove(dest, src, n); + } + return __memcpy(dest, src, n); +}