From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Breno Leitao <leitao@debian.org>,
Michael Neuling <mikey@neuling.org>,
Michael Ellerman <mpe@ellerman.id.au>,
Sasha Levin <alexander.levin@microsoft.com>
Subject: [PATCH 4.4 42/48] powerpc/tm: Avoid possible userspace r1 corruption on reclaim
Date: Thu, 18 Oct 2018 19:55:17 +0200 [thread overview]
Message-ID: <20181018175430.154133456@linuxfoundation.org> (raw)
In-Reply-To: <20181018175427.133690306@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <mikey@neuling.org>
[ Upstream commit 96dc89d526ef77604376f06220e3d2931a0bfd58 ]
Current we store the userspace r1 to PACATMSCRATCH before finally
saving it to the thread struct.
In theory an exception could be taken here (like a machine check or
SLB miss) that could write PACATMSCRATCH and hence corrupt the
userspace r1. The SLB fault currently doesn't touch PACATMSCRATCH, but
others do.
We've never actually seen this happen but it's theoretically
possible. Either way, the code is fragile as it is.
This patch saves r1 to the kernel stack (which can't fault) before we
turn MSR[RI] back on. PACATMSCRATCH is still used but only with
MSR[RI] off. We then copy r1 from the kernel stack to the thread
struct once we have MSR[RI] back on.
Suggested-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/tm.S | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -202,6 +202,13 @@ dont_backup_fp:
std r11, GPR11(r1) /* Temporary stash */
/*
+ * Move the saved user r1 to the kernel stack in case PACATMSCRATCH is
+ * clobbered by an exception once we turn on MSR_RI below.
+ */
+ ld r11, PACATMSCRATCH(r13)
+ std r11, GPR1(r1)
+
+ /*
* Store r13 away so we can free up the scratch SPR for the SLB fault
* handler (needed once we start accessing the thread_struct).
*/
@@ -237,7 +244,7 @@ dont_backup_fp:
SAVE_GPR(8, r7) /* user r8 */
SAVE_GPR(9, r7) /* user r9 */
SAVE_GPR(10, r7) /* user r10 */
- ld r3, PACATMSCRATCH(r13) /* user r1 */
+ ld r3, GPR1(r1) /* user r1 */
ld r4, GPR7(r1) /* user r7 */
ld r5, GPR11(r1) /* user r11 */
ld r6, GPR12(r1) /* user r12 */
next prev parent reply other threads:[~2018-10-18 18:07 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-18 17:54 [PATCH 4.4 00/48] 4.4.162-stable review Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 01/48] ASoC: wm8804: Add ACPI support Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 02/48] ASoC: sigmadsp: safeload should not have lower byte limit Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 03/48] selftests/efivarfs: add required kernel configs Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 04/48] mfd: omap-usb-host: Fix dts probe of children Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 05/48] sound: enable interrupt after dma buffer initialization Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 06/48] stmmac: fix valid numbers of unicast filter entries Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 07/48] net: macb: disable scatter-gather for macb on sama5d3 Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 08/48] ARM: dts: at91: add new compatibility string " Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 09/48] drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7 Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 10/48] ext4: add corruption check in ext4_xattr_set_entry() Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 11/48] mm/vmstat.c: fix outdated vmstat_text Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 12/48] mach64: detect the dot clock divider correctly on sparc Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 13/48] perf script python: Fix export-to-postgresql.py occasional failure Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 14/48] i2c: i2c-scmi: fix for i2c_smbus_write_block_data Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 15/48] xhci: Dont print a warning when setting link state for disabled ports Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 16/48] jffs2: return -ERANGE when xattr buffer is too small Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 17/48] bnxt_en: Fix TX timeout during netpoll Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 18/48] bonding: avoid possible dead-lock Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 19/48] ip6_tunnel: be careful when accessing the inner header Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 20/48] ip_tunnel: " Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 21/48] ipv4: fix use-after-free in ip_cmsg_recv_dstaddr() Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 22/48] net: ipv4: update fnhe_pmtu when first hops MTU changes Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 23/48] net/ipv6: Display all addresses in output of /proc/net/if_inet6 Greg Kroah-Hartman
2018-10-18 17:54 ` [PATCH 4.4 24/48] netlabel: check for IPV4MASK in addrinfo_get Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 25/48] net/usb: cancel pending work when unbinding smsc75xx Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 26/48] qlcnic: fix Tx descriptor corruption on 82xx devices Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 27/48] team: Forbid enslaving team device to itself Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 28/48] net: mvpp2: Extract the correct ethtype from the skb for tx csum offload Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 29/48] net: systemport: Fix wake-up interrupt race during resume Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 30/48] rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096 Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 31/48] KVM: x86: remove eager_fpu field of struct kvm_vcpu_arch Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 32/48] x86/fpu: Remove use_eager_fpu() Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 33/48] x86/fpu: Remove struct fpu::counter Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 34/48] x86/fpu: Finish excising eagerfpu Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 35/48] media: af9035: prevent buffer overflow on write Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 36/48] clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-am43 SoCs Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 37/48] Input: atakbd - fix Atari keymap Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 38/48] Input: atakbd - fix Atari CapsLock behaviour Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 39/48] net/mlx4: Use cpumask_available for eq->affinity_mask Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 40/48] RISC-V: include linux/ftrace.h in asm-prototypes.h Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 41/48] powerpc/tm: Fix userspace r13 corruption Greg Kroah-Hartman
2018-10-18 17:55 ` Greg Kroah-Hartman [this message]
2018-10-18 17:55 ` [PATCH 4.4 43/48] ARC: build: Get rid of toolchain check Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 44/48] usb: gadget: serial: fix oops when data rxd after close Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 45/48] Drivers: hv: utils: Invoke the poll function after handshake Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 46/48] Drivers: hv: util: Pass the channel information during the init call Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 47/48] Drivers: hv: kvp: fix IP Failover Greg Kroah-Hartman
2018-10-18 17:55 ` [PATCH 4.4 48/48] HV: properly delay KVP packets when negotiation is in progress Greg Kroah-Hartman
2018-10-19 1:40 ` [PATCH 4.4 00/48] 4.4.162-stable review Nathan Chancellor
2018-10-19 8:40 ` Sebastian Gottschall
2018-10-19 9:15 ` Greg Kroah-Hartman
2018-10-19 13:58 ` Rafael David Tinoco
2018-10-19 19:50 ` Guenter Roeck
2018-10-19 20:47 ` Shuah Khan
2018-10-19 22:30 ` Shuah Khan
2018-10-22 13:05 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181018175430.154133456@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alexander.levin@microsoft.com \
--cc=leitao@debian.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mikey@neuling.org \
--cc=mpe@ellerman.id.au \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).