Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Post fb041b598997d63c0f7d7305dfae70046bf66fe1 rw_copy_check_uvector
- 0000000000005170 <rw_copy_check_uvector>:
- * or a negative error code on error.
- */
- ssize_t rw_copy_check_uvector(int type, const struct iovec __user *uvector,
- unsigned long nr_segs, unsigned long fast_segs,
- struct iovec *fast_pointer, struct iovec **ret_pointer)
- {
- 5170: d503233f paciasp
- 5174: a9bb7bfd stp x29, x30, [sp, #-80]!
- 5178: f9000bf9 str x25, [sp, #16]
- 517c: a9025ff8 stp x24, x23, [sp, #32]
- 5180: a90357f6 stp x22, x21, [sp, #48]
- 5184: a9044ff4 stp x20, x19, [sp, #64]
- 5188: 910003fd mov x29, sp
- 518c: aa0503f3 mov x19, x5
- 5190: aa0403f4 mov x20, x4
- /*
- * SuS says "The readv() function *may* fail if the iovcnt argument
- * was less than or equal to 0, or greater than {IOV_MAX}. Linux has
- * traditionally returned zero for zero segments, so...
- */
- if (nr_segs == 0) {
- 5194: b40000c2 cbz x2, 51ac <rw_copy_check_uvector+0x3c>
- 5198: aa0203f6 mov x22, x2
- /*
- * First get the "struct iovec" from user memory and
- * verify all the pointers
- */
- if (nr_segs > UIO_MAXIOV) {
- 519c: f110005f cmp x2, #0x400
- 51a0: 54000189 b.ls 51d0 <rw_copy_check_uvector+0x60> // b.plast
- 51a4: 928002a0 mov x0, #0xffffffffffffffea // #-22
- 51a8: 14000002 b 51b0 <rw_copy_check_uvector+0x40>
- 51ac: aa1f03e0 mov x0, xzr
- iov[seg].iov_len = len;
- }
- ret += len;
- }
- out:
- *ret_pointer = iov;
- 51b0: f9000274 str x20, [x19]
- return ret;
- }
- 51b4: a9444ff4 ldp x20, x19, [sp, #64]
- 51b8: a94357f6 ldp x22, x21, [sp, #48]
- 51bc: a9425ff8 ldp x24, x23, [sp, #32]
- 51c0: f9400bf9 ldr x25, [sp, #16]
- 51c4: a8c57bfd ldp x29, x30, [sp], #80
- 51c8: d50323bf autiasp
- 51cc: d65f03c0 ret
- 51d0: aa0103f7 mov x23, x1
- 51d4: 2a0003f5 mov w21, w0
- if (nr_segs > fast_segs) {
- 51d8: eb0302df cmp x22, x3
- 51dc: 540000a9 b.ls 51f0 <rw_copy_check_uvector+0x80> // b.plast
- iov = kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL);
- 51e0: aa1603e0 mov x0, x22
- 51e4: 9400004b bl 5310 <kmalloc_array>
- 51e8: aa0003f4 mov x20, x0
- if (iov == NULL) {
- 51ec: b4000780 cbz x0, 52dc <rw_copy_check_uvector+0x16c>
- 51f0: d5384119 mrs x25, sp_el0
- (current->flags & PF_KTHREAD || test_thread_flag(TIF_TAGGED_ADDR)))
- 51f4: 3940bb2a ldrb w10, [x25, #46]
- unsigned long ret, limit = current_thread_info()->addr_limit;
- 51f8: f9400729 ldr x9, [x25, #8]
- if (copy_from_user(iov, uvector, nr_segs*sizeof(*uvector))) {
- 51fc: d37ceed8 lsl x24, x22, #4
- 5200: d378dee8 lsl x8, x23, #8
- (current->flags & PF_KTHREAD || test_thread_flag(TIF_TAGGED_ADDR)))
- 5204: 3728008a tbnz w10, #5, 5214 <rw_copy_check_uvector+0xa4>
- 5208: f940032b ldr x11, [x25]
- 520c: aa1703ea mov x10, x23
- if (IS_ENABLED(CONFIG_ARM64_TAGGED_ADDR_ABI) &&
- 5210: 36d0004b tbz w11, #26, 5218 <rw_copy_check_uvector+0xa8>
- addr = untagged_addr(addr);
- 5214: 8a8822ea and x10, x23, x8, asr #8
- asm volatile(
- 5218: ab18014a adds x10, x10, x24
- 521c: 9a8983e9 csel x9, xzr, x9, hi // hi = pmore
- 5220: da9f314a csinv x10, x10, xzr, cc // cc = lo, ul, last
- 5224: fa09015f sbcs xzr, x10, x9
- 5228: 9a9f87ea cset x10, ls // ls = plast
- if (likely(access_ok(from, n))) {
- 522c: b400060a cbz x10, 52ec <rw_copy_check_uvector+0x17c>
- __uaccess_enable(ARM64_ALT_PAN_NOT_UAO);
- 5230: d503201f nop
- : "r" (ptr), "r" (current_thread_info()->addr_limit),
- 5234: f9400729 ldr x9, [x25, #8]
- "r" (untagged_addr(ptr))
- 5238: 8a8822e8 and x8, x23, x8, asr #8
- asm volatile(
- 523c: ea29011f bics xzr, x8, x9
- 5240: 9a9f02e1 csel x1, x23, xzr, eq // eq = none
- csdb();
- 5244: d503229f csdb
- res = raw_copy_from_user(to, from, n);
- 5248: aa1403e0 mov x0, x20
- 524c: aa1803e2 mov x2, x24
- 5250: 94000000 bl 0 <__arch_copy_from_user>
- __uaccess_disable(ARM64_ALT_PAN_NOT_UAO);
- 5254: d503201f nop
- if (unlikely(res))
- 5258: b50004e0 cbnz x0, 52f4 <rw_copy_check_uvector+0x184>
- for (seg = 0; seg < nr_segs; seg++) {
- 525c: f10006df cmp x22, #0x1
- 5260: 91002288 add x8, x20, #0x8
- 5264: 9a9f86c9 csinc x9, x22, xzr, hi // hi = pmore
- 5268: 32144bea mov w10, #0x7ffff000 // #2147479552
- 526c: 14000005 b 5280 <rw_copy_check_uvector+0x110>
- ret += len;
- 5270: 8b000160 add x0, x11, x0
- for (seg = 0; seg < nr_segs; seg++) {
- 5274: f1000529 subs x9, x9, #0x1
- 5278: 91004108 add x8, x8, #0x10
- 527c: 54fff9a0 b.eq 51b0 <rw_copy_check_uvector+0x40> // b.none
- ssize_t len = (ssize_t)iov[seg].iov_len;
- 5280: f940010b ldr x11, [x8]
- if (len < 0) {
- 5284: b7fff90b tbnz x11, #63, 51a4 <rw_copy_check_uvector+0x34>
- && unlikely(!access_ok(buf, len))) {
- 5288: 37f801f5 tbnz w21, #31, 52c4 <rw_copy_check_uvector+0x154>
- 528c: f85f810c ldur x12, [x8, #-8]
- (current->flags & PF_KTHREAD || test_thread_flag(TIF_TAGGED_ADDR)))
- 5290: 3940bb2e ldrb w14, [x25, #46]
- unsigned long ret, limit = current_thread_info()->addr_limit;
- 5294: f940072d ldr x13, [x25, #8]
- (current->flags & PF_KTHREAD || test_thread_flag(TIF_TAGGED_ADDR)))
- 5298: 3728006e tbnz w14, #5, 52a4 <rw_copy_check_uvector+0x134>
- 529c: f940032e ldr x14, [x25]
- if (IS_ENABLED(CONFIG_ARM64_TAGGED_ADDR_ABI) &&
- 52a0: 36d0006e tbz w14, #26, 52ac <rw_copy_check_uvector+0x13c>
- 52a4: d378dd8e lsl x14, x12, #8
- addr = untagged_addr(addr);
- 52a8: 8a8e218c and x12, x12, x14, asr #8
- asm volatile(
- 52ac: ab0b018c adds x12, x12, x11
- 52b0: 9a8d83ed csel x13, xzr, x13, hi // hi = pmore
- 52b4: da9f318c csinv x12, x12, xzr, cc // cc = lo, ul, last
- 52b8: fa0d019f sbcs xzr, x12, x13
- 52bc: 9a9f87ec cset x12, ls // ls = plast
- if (type >= 0
- 52c0: b400012c cbz x12, 52e4 <rw_copy_check_uvector+0x174>
- if (len > MAX_RW_COUNT - ret) {
- 52c4: cb00014c sub x12, x10, x0
- 52c8: eb0c017f cmp x11, x12
- 52cc: 54fffd29 b.ls 5270 <rw_copy_check_uvector+0x100> // b.plast
- 52d0: aa0c03eb mov x11, x12
- iov[seg].iov_len = len;
- 52d4: f900010c str x12, [x8]
- 52d8: 17ffffe6 b 5270 <rw_copy_check_uvector+0x100>
- 52dc: 92800160 mov x0, #0xfffffffffffffff4 // #-12
- 52e0: 17ffffb4 b 51b0 <rw_copy_check_uvector+0x40>
- 52e4: 928001a0 mov x0, #0xfffffffffffffff2 // #-14
- 52e8: 17ffffb2 b 51b0 <rw_copy_check_uvector+0x40>
- 52ec: aa1803e2 mov x2, x24
- 52f0: 14000002 b 52f8 <rw_copy_check_uvector+0x188>
- 52f4: aa0003e2 mov x2, x0
- memset(to + (n - res), 0, res);
- 52f8: cb020308 sub x8, x24, x2
- 52fc: 8b080280 add x0, x20, x8
- 5300: 2a1f03e1 mov w1, wzr
- 5304: 94000000 bl 0 <memset>
- 5308: 928001a0 mov x0, #0xfffffffffffffff2 // #-14
- 530c: 17ffffa9 b 51b0 <rw_copy_check_uvector+0x40>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
