* Patch "arm64: traps: fix userspace cache maintenance emulation on a tagged pointer" has been added to the 4.11-stable tree
@ 2017-05-23 14:45 gregkh
0 siblings, 0 replies; only message in thread
From: gregkh @ 2017-05-23 14:45 UTC (permalink / raw)
To: kristina.martsenko, catalin.marinas, gregkh, will.deacon
Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
arm64: traps: fix userspace cache maintenance emulation on a tagged pointer
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
arm64-traps-fix-userspace-cache-maintenance-emulation-on-a-tagged-pointer.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 81cddd65b5c82758ea5571a25e31ff6f1f89ff02 Mon Sep 17 00:00:00 2001
From: Kristina Martsenko <kristina.martsenko@arm.com>
Date: Wed, 3 May 2017 16:37:45 +0100
Subject: arm64: traps: fix userspace cache maintenance emulation on a tagged pointer
From: Kristina Martsenko <kristina.martsenko@arm.com>
commit 81cddd65b5c82758ea5571a25e31ff6f1f89ff02 upstream.
When we emulate userspace cache maintenance in the kernel, we can
currently send the task a SIGSEGV even though the maintenance was done
on a valid address. This happens if the address has a non-zero address
tag, and happens to not be mapped in.
When we get the address from a user register, we don't currently remove
the address tag before performing cache maintenance on it. If the
maintenance faults, we end up in either __do_page_fault, where find_vma
can't find the VMA if the address has a tag, or in do_translation_fault,
where the tagged address will appear to be above TASK_SIZE. In both
cases, the address is not mapped in, and the task is sent a SIGSEGV.
This patch removes the tag from the address before using it. With this
patch, the fault is handled correctly, the address gets mapped in, and
the cache maintenance succeeds.
As a second bug, if cache maintenance (correctly) fails on an invalid
tagged address, the address gets passed into arm64_notify_segfault,
where find_vma fails to find the VMA due to the tag, and the wrong
si_code may be sent as part of the siginfo_t of the segfault. With this
patch, the correct si_code is sent.
Fixes: 7dd01aef0557 ("arm64: trap userspace "dc cvau" cache operation on errata-affected core")
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/traps.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -443,7 +443,7 @@ int cpu_enable_cache_maint_trap(void *__
}
#define __user_cache_maint(insn, address, res) \
- if (untagged_addr(address) >= user_addr_max()) { \
+ if (address >= user_addr_max()) { \
res = -EFAULT; \
} else { \
uaccess_ttbr0_enable(); \
@@ -469,7 +469,7 @@ static void user_cache_maint_handler(uns
int crm = (esr & ESR_ELx_SYS64_ISS_CRM_MASK) >> ESR_ELx_SYS64_ISS_CRM_SHIFT;
int ret = 0;
- address = pt_regs_read_reg(regs, rt);
+ address = untagged_addr(pt_regs_read_reg(regs, rt));
switch (crm) {
case ESR_ELx_SYS64_ISS_CRM_DC_CVAU: /* DC CVAU, gets promoted */
Patches currently in stable-queue which might be from kristina.martsenko@arm.com are
queue-4.11/arm64-hw_breakpoint-fix-watchpoint-matching-for-tagged-pointers.patch
queue-4.11/arm64-entry-improve-data-abort-handling-of-tagged-pointers.patch
queue-4.11/arm64-documentation-document-tagged-pointer-stack-constraints.patch
queue-4.11/arm64-traps-fix-userspace-cache-maintenance-emulation-on-a-tagged-pointer.patch
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2017-05-23 14:46 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-23 14:45 Patch "arm64: traps: fix userspace cache maintenance emulation on a tagged pointer" has been added to the 4.11-stable tree gregkh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.