Attachment #248808 for bug #337659

Lines 199-205 ptr_to_compat(void __user *uptr) Link Here

(-)a/arch/ia64/include/asm/compat.h (-1 / +1 lines)
199	}	199	}
200		200
201	static __inline__ void __user *	201	static __inline__ void __user *
202	compat_alloc_user_space (long len)	202	arch_compat_alloc_user_space (long len)
203	{	203	{
204	struct pt_regs *regs = task_pt_regs(current);	204	struct pt_regs *regs = task_pt_regs(current);
205	return (void __user *) (((regs->r12 & 0xffffffff) & -16) - len);	205	return (void __user *) (((regs->r12 & 0xffffffff) & -16) - len);

Lines 145-151 static inline compat_uptr_t ptr_to_compat(void __user *uptr) Link Here

(-)a/arch/mips/include/asm/compat.h (-1 / +1 lines)
145	return (u32)(unsigned long)uptr;	145	return (u32)(unsigned long)uptr;
146	}	146	}
147		147
148	static inline void __user *compat_alloc_user_space(long len)	148	static inline void __user *arch_compat_alloc_user_space(long len)
149	{	149	{
150	struct pt_regs regs = (struct pt_regs )	150	struct pt_regs regs = (struct pt_regs )
151	((unsigned long) current_thread_info() + THREAD_SIZE - 32) - 1;	151	((unsigned long) current_thread_info() + THREAD_SIZE - 32) - 1;

Lines 147-153 static inline compat_uptr_t ptr_to_compat(void __user *uptr) Link Here

(-)a/arch/parisc/include/asm/compat.h (-1 / +1 lines)
147	return (u32)(unsigned long)uptr;	147	return (u32)(unsigned long)uptr;
148	}	148	}
149		149
150	static __inline__ void __user *compat_alloc_user_space(long len)	150	static __inline__ void __user *arch_compat_alloc_user_space(long len)
151	{	151	{
152	struct pt_regs *regs = &current->thread.regs;	152	struct pt_regs *regs = &current->thread.regs;
153	return (void __user *)regs->gr[30];	153	return (void __user *)regs->gr[30];

Lines 134-140 static inline compat_uptr_t ptr_to_compat(void __user *uptr) Link Here

(-)a/arch/powerpc/include/asm/compat.h (-1 / +1 lines)
134	return (u32)(unsigned long)uptr;	134	return (u32)(unsigned long)uptr;
135	}	135	}
136		136
137	static inline void __user *compat_alloc_user_space(long len)	137	static inline void __user *arch_compat_alloc_user_space(long len)
138	{	138	{
139	struct pt_regs *regs = current->thread.regs;	139	struct pt_regs *regs = current->thread.regs;
140	unsigned long usp = regs->gpr[1];	140	unsigned long usp = regs->gpr[1];

Lines 181-187 static inline int is_compat_task(void) Link Here

(-)a/arch/s390/include/asm/compat.h (-1 / +1 lines)
181		181
182	#endif	182	#endif
183		183
184	static inline void __user *compat_alloc_user_space(long len)	184	static inline void __user *arch_compat_alloc_user_space(long len)
185	{	185	{
186	unsigned long stack;	186	unsigned long stack;
187		187

Lines 167-173 static inline compat_uptr_t ptr_to_compat(void __user *uptr) Link Here

(-)a/arch/sparc/include/asm/compat.h (-1 / +1 lines)
167	return (u32)(unsigned long)uptr;	167	return (u32)(unsigned long)uptr;
168	}	168	}
169		169
170	static inline void __user *compat_alloc_user_space(long len)	170	static inline void __user *arch_compat_alloc_user_space(long len)
171	{	171	{
172	struct pt_regs *regs = current_thread_info()->kregs;	172	struct pt_regs *regs = current_thread_info()->kregs;
173	unsigned long usp = regs->u_regs[UREG_I6];	173	unsigned long usp = regs->u_regs[UREG_I6];

Lines 205-211 static inline compat_uptr_t ptr_to_compat(void __user *uptr) Link Here

(-)a/arch/x86/include/asm/compat.h (-1 / +1 lines)
205	return (u32)(unsigned long)uptr;	205	return (u32)(unsigned long)uptr;
206	}	206	}
207		207
208	static inline void __user *compat_alloc_user_space(long len)	208	static inline void __user *arch_compat_alloc_user_space(long len)
209	{	209	{
210	struct pt_regs *regs = task_pt_regs(current);	210	struct pt_regs *regs = task_pt_regs(current);
211	return (void __user *)regs->sp - len;	211	return (void __user *)regs->sp - len;

Lines 356-360 asmlinkage long compat_sys_newfstatat(un Link Here

(-)a/include/linux/compat.h (+2 lines)
356	asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,	356	asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,
357	int flags, int mode);	357	int flags, int mode);
358		358
		359	extern void __user *compat_alloc_user_space(unsigned long len);
		360
359	#endif /* CONFIG_COMPAT */	361	#endif /* CONFIG_COMPAT */
360	#endif /* _LINUX_COMPAT_H */	362	#endif /* _LINUX_COMPAT_H */





	return 0;
}

/*
 * Allocate user-space memory for the duration of a single system call,
 * in order to marshall parameters inside a compat thunk.
 */
void __user *compat_alloc_user_space(unsigned long len)
{
	void __user *ptr;

	/* If len would occupy more than half of the entire compat space... */
	if (unlikely(len > (((compat_uptr_t)~0) >> 1)))
		return NULL;

	ptr = arch_compat_alloc_user_space(len);

	if (unlikely(!access_ok(VERIFY_WRITE, ptr, len)))
		return NULL;

	return ptr;
}
EXPORT_SYMBOL_GPL(compat_alloc_user_space);

Return to bug 337659

Lines 1126-1128 compat_sys_sysinfo(struct compat_sysinfo __user *info) Link Here

(-)a/kernel/compat.c (-1 / +21 lines)
1126		1140
1127	return 0;	1141	return 0;
1128	}	1142	}
1129	-	1143
		1144	/*
		1145	* Allocate user-space memory for the duration of a single system call,
		1146	* in order to marshall parameters inside a compat thunk.
		1147	*/
		1148	void __user *compat_alloc_user_space(unsigned long len)
		1149	{
		1150	void __user *ptr;
		1151
		1152	/* If len would occupy more than half of the entire compat space... */
		1153	if (unlikely(len > (((compat_uptr_t)~0) >> 1)))
		1154	return NULL;
		1155
		1156	ptr = arch_compat_alloc_user_space(len);
		1157
		1158	if (unlikely(!access_ok(VERIFY_WRITE, ptr, len)))
		1159	return NULL;
		1160
		1161	return ptr;
		1162	}
		1163	EXPORT_SYMBOL_GPL(compat_alloc_user_space);