Originally, the rule used to be that you'd have to do access_ok()
separately, and then user_access_begin() before actually doing the
direct (optimized) user access.
But experience has shown that people then decide not to do access_ok()
at all, and instead rely on it being implied by other operations or
similar. Which makes it very hard to verify that the access has
actually been range-checked.
If you use the unsafe direct user accesses, hardware features (either
SMAP - Supervisor Mode Access Protection - on x86, or PAN - Privileged
Access Never - on ARM) do force you to use user_access_begin(). But
nothing really forces the range check.
By putting the range check into user_access_begin(), we actually force
people to do the right thing (tm), and the range check vill be visible
near the actual accesses. We have way too long a history of people
trying to avoid them.
Bug 200630541
CVE-2018-20669
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: I1d25229cd41495b782e6f2bc67a4bb638dec4540
Reviewed-on: https://git-master.nvidia.com/r/c/linux-4.9/+/2374142
(cherry picked from commit e77a94059008f0f812474d05a9f75accecaeb583)
Reviewed-on: https://git-master.nvidia.com/r/c/linux-4.9/+/2466485
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
GVS: Gerrit_Virtual_Submit
Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
660716ee5f