On Mon, Apr 1, 2019 at 4:36 PM David Laight <[email protected]> wrote: > > From: Jann Horn > > Sent: 28 March 2019 21:23 > > Fix __user annotations in various places across the x86 tree: > > > ... > > - generic_load_microcode() deals with a pointer that can be either a > > kernel pointer or a user pointer; change the code to pass it around as > > a __user pointer, and add explicit casts to convert between __user and > > __kernel > ... > > -static int get_ucode_fw(void *to, const void *from, size_t n) > > +static int get_ucode_fw(void *to, const void __user *from, size_t n) > > { > > - memcpy(to, from, n); > > + /* cast paired with request_microcode_fw() */ > > + memcpy(to, (const void __force *)from, n); > > return 0; > > } > > > > @@ -993,7 +996,8 @@ static enum ucode_state request_microcode_fw(int cpu, > > struct device *device, > > return UCODE_NFOUND; > > } > > > > - ret = generic_load_microcode(cpu, (void *)firmware->data, > > + /* cast paired with get_ucode_fw() */ > > + ret = generic_load_microcode(cpu, (void __force __user > > *)firmware->data, > > firmware->size, &get_ucode_fw); > > > > release_firmware(firmware); > > @@ -1001,7 +1005,7 @@ static enum ucode_state request_microcode_fw(int cpu, > > struct device *device, > > return ret; > > } > > > > -static int get_ucode_user(void *to, const void *from, size_t n) > > +static int get_ucode_user(void *to, const void __user *from, size_t n) > > { > > return copy_from_user(to, from, n); > > } > > @@ -1012,7 +1016,7 @@ request_microcode_user(int cpu, const void __user > > *buf, size_t size) > > if (is_blacklisted(cpu)) > > return UCODE_NFOUND; > > > > - return generic_load_microcode(cpu, (void *)buf, size, > > &get_ucode_user); > > + return generic_load_microcode(cpu, buf, size, &get_ucode_user); > > That is all an 'accident waiting to happen' ...
What's your suggestion? The code used to store user pointers in kernel-typed pointers. Now it only stores kernel pointers in user-typed pointers, which is much less hazardous.
