Patch "metag/usercopy: Zero rest of buffer from copy_from_user" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

metag/usercopy: Zero rest of buffer from copy_from_user

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
metag-usercopy-zero-rest-of-buffer-from-copy_from_user.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: James Hogan <[email protected]>
Date: Fri, 31 Mar 2017 11:14:02 +0100
Subject: metag/usercopy: Zero rest of buffer from copy_from_user

From: James Hogan <[email protected]>

commit 563ddc1076109f2b3f88e6d355eab7b6fd4662cb upstream.

Currently we try to zero the destination for a failed read from userland in fixup code in the usercopy.c macros. The rest of the destination buffer is then zeroed from __copy_user_zeroing(), which is used for both copy_from_user() and __copy_from_user().

Unfortunately we fail to zero in the fixup code as D1Ar1 is set to 0 before the fixup code entry labels, and __copy_from_user() shouldn't even be zeroing the rest of the buffer.

Move the zeroing out into copy_from_user() and rename __copy_user_zeroing() to raw_copy_from_user() since it no longer does any zeroing. This also conveniently matches the name needed for RAW_COPY_USER support in a later patch.

---
 arch/metag/include/asm/uaccess.h |   15 +++++-----
 arch/metag/lib/usercopy.c        |   57 ++++++++++++---------------------------
 2 files changed, 26 insertions(+), 46 deletions(-)

@@ -197,20 +197,21 @@ extern long __must_check strnlen_user(co
 
 #define strlen_user(str) strnlen_user(str, 32767)
 
-extern unsigned long __must_check __copy_user_zeroing(void *to,
-						      const void __user *from,
-						      unsigned long n);
+extern unsigned long raw_copy_from_user(void *to, const void __user *from,
+					unsigned long n);
 
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+	unsigned long res = n;
 	if (likely(access_ok(VERIFY_READ, from, n)))
-		return __copy_user_zeroing(to, from, n);
-	memset(to, 0, n);
-	return n;
+		res = raw_copy_from_user(to, from, n);
+	if (unlikely(res))
+		memset(to + (n - res), 0, res);
+	return res;
 }
 
-#define __copy_from_user(to, from, n) __copy_user_zeroing(to, from, n)
+#define __copy_from_user(to, from, n) raw_copy_from_user(to, from, n)
 #define __copy_from_user_inatomic __copy_from_user
 
 extern unsigned long __must_check __copy_user(void __user *to,

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/mips-end-spinlocks-with-.insn.patch queue-4.9/metag-usercopy-add-missing-fixups.patch queue-4.9/metag-usercopy-add-early-abort-to-copy_to_user.patch queue-4.9/mips-ralink-fix-typos-in-rt3883-pinctrl.patch queue-4.9/metag-usercopy-set-flags-before-addz.patch queue-4.9/metag-usercopy-fix-src-fixup-in-from-user-rapf-loops.patch queue-4.9/metag-usercopy-drop-unused-macros.patch queue-4.9/mips-lantiq-fix-missing-xbar-kernel-panic.patch queue-4.9/metag-usercopy-zero-rest-of-buffer-from-copy_from_user.patch queue-4.9/metag-usercopy-fix-alignment-error-checking.patch queue-4.9/mips-force-o32-fp64-support-on-32bit-mips64r6-kernels.patch