• Linus Torvalds's avatar
    x86: clean up/fix 'copy_in_user()' tail zeroing · cae2a173
    Linus Torvalds authored
    The rule for 'copy_from_user()' is that it zeroes the remaining kernel
    buffer even when the copy fails halfway, just to make sure that we don't
    leave uninitialized kernel memory around.  Because even if we check for
    errors, some kernel buffers stay around after thge copy (think page
    cache).
    
    However, the x86-64 logic for user copies uses a copy_user_generic()
    function for all the cases, that set the "zerorest" flag for any fault
    on the source buffer.  Which meant that it didn't just try to clear the
    kernel buffer after a failure in copy_from_user(), it also tried to
    clear the destination user buffer for the "copy_in_user()" case.
    
    Not only is that pointless, it also means that the clearing code has to
    worry about the tail clearing taking page faults for the user buffer
    case.  Which is just stupid, since that case shouldn't happen in the
    first place.
    
    Get rid of the whole "zerorest" thing entirely, and instead just check
    if the destination is in kernel space or not.  And then just use
    memset() to clear the tail of the kernel buffer if necessary.
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    cae2a173
usercopy_64.c 2.1 KB