metag: copy_from_user() should zero the destination on access_ok() failure

Al Viro · Al Viro · commit 8ae95ed4ae5f · 2016-09-13T17:49:40.000-04:00
Cc: stable@vger.kernel.org
Acked-by: James Hogan &lt;james.hogan@imgtec.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
@@ -204,8 +204,9 @@ extern unsigned long __must_check __copy_user_zeroing(void *to,
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-	if (access_ok(VERIFY_READ, from, n))
+	if (likely(access_ok(VERIFY_READ, from, n)))
 		return __copy_user_zeroing(to, from, n);
+	memset(to, 0, n);
 	return n;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -204,8 +204,9 @@ extern unsigned long __must_check __copy_user_zeroing(void *to,`
`204`	`204`	`static inline unsigned long`
`205`	`205`	`copy_from_user(void to, const void __user from, unsigned long n)`
`206`	`206`	`{`
`207`		`- if (access_ok(VERIFY_READ, from, n))`
	`207`	`+ if (likely(access_ok(VERIFY_READ, from, n)))`
`208`	`208`	`return __copy_user_zeroing(to, from, n);`
	`209`	`+ memset(to, 0, n);`
`209`	`210`	`return n;`
`210`	`211`	`}`
`211`	`212`