All of lore.kernel.org
 help / color / mirror / Atom feed
From: David Long <dave.long@linaro.org>
To: <stable@vger.kernel.org>,
	Russell King - ARM Linux <linux@armlinux.org.uk>,
	Florian Fainelli <f.fainelli@gmail.com>,
	Tony Lindgren <tony@atomide.com>,
	Marc Zyngier <marc.zyngier@arm.com>,
	Mark Rutland <mark.rutland@arm.com>
Cc: Greg KH <gregkh@linuxfoundation.org>, Mark Brown <broonie@kernel.org>
Subject: [PATCH 4.14 19/24] ARM: signal: copy registers using __copy_from_user()
Date: Mon, 15 Oct 2018 11:32:13 -0400	[thread overview]
Message-ID: <1539617538-22328-20-git-send-email-dave.long@linaro.org> (raw)
In-Reply-To: <1539617538-22328-1-git-send-email-dave.long@linaro.org>

From: Russell King <rmk+kernel@armlinux.org.uk>

Commit c32cd419d6650e42b9cdebb83c672ec945e6bd7e upstream.

__get_user_error() is used as a fast accessor to make copying structure
members in the signal handling path as efficient as possible.  However,
with software PAN and the recent Spectre variant 1, the efficiency is
reduced as these are no longer fast accessors.

In the case of software PAN, it has to switch the domain register around
each access, and with Spectre variant 1, it would have to repeat the
access_ok() check for each access.

It becomes much more efficient to use __copy_from_user() instead, so
let's use this for the ARM integer registers.

Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David A. Long <dave.long@linaro.org>
---
 arch/arm/kernel/signal.c | 38 +++++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index b67ae12..80da0cd 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -184,6 +184,7 @@ struct rt_sigframe {
 
 static int restore_sigframe(struct pt_regs *regs, struct sigframe __user *sf)
 {
+	struct sigcontext context;
 	char __user *aux;
 	sigset_t set;
 	int err;
@@ -192,23 +193,26 @@ static int restore_sigframe(struct pt_regs *regs, struct sigframe __user *sf)
 	if (err == 0)
 		set_current_blocked(&set);
 
-	__get_user_error(regs->ARM_r0, &sf->uc.uc_mcontext.arm_r0, err);
-	__get_user_error(regs->ARM_r1, &sf->uc.uc_mcontext.arm_r1, err);
-	__get_user_error(regs->ARM_r2, &sf->uc.uc_mcontext.arm_r2, err);
-	__get_user_error(regs->ARM_r3, &sf->uc.uc_mcontext.arm_r3, err);
-	__get_user_error(regs->ARM_r4, &sf->uc.uc_mcontext.arm_r4, err);
-	__get_user_error(regs->ARM_r5, &sf->uc.uc_mcontext.arm_r5, err);
-	__get_user_error(regs->ARM_r6, &sf->uc.uc_mcontext.arm_r6, err);
-	__get_user_error(regs->ARM_r7, &sf->uc.uc_mcontext.arm_r7, err);
-	__get_user_error(regs->ARM_r8, &sf->uc.uc_mcontext.arm_r8, err);
-	__get_user_error(regs->ARM_r9, &sf->uc.uc_mcontext.arm_r9, err);
-	__get_user_error(regs->ARM_r10, &sf->uc.uc_mcontext.arm_r10, err);
-	__get_user_error(regs->ARM_fp, &sf->uc.uc_mcontext.arm_fp, err);
-	__get_user_error(regs->ARM_ip, &sf->uc.uc_mcontext.arm_ip, err);
-	__get_user_error(regs->ARM_sp, &sf->uc.uc_mcontext.arm_sp, err);
-	__get_user_error(regs->ARM_lr, &sf->uc.uc_mcontext.arm_lr, err);
-	__get_user_error(regs->ARM_pc, &sf->uc.uc_mcontext.arm_pc, err);
-	__get_user_error(regs->ARM_cpsr, &sf->uc.uc_mcontext.arm_cpsr, err);
+	err |= __copy_from_user(&context, &sf->uc.uc_mcontext, sizeof(context));
+	if (err == 0) {
+		regs->ARM_r0 = context.arm_r0;
+		regs->ARM_r1 = context.arm_r1;
+		regs->ARM_r2 = context.arm_r2;
+		regs->ARM_r3 = context.arm_r3;
+		regs->ARM_r4 = context.arm_r4;
+		regs->ARM_r5 = context.arm_r5;
+		regs->ARM_r6 = context.arm_r6;
+		regs->ARM_r7 = context.arm_r7;
+		regs->ARM_r8 = context.arm_r8;
+		regs->ARM_r9 = context.arm_r9;
+		regs->ARM_r10 = context.arm_r10;
+		regs->ARM_fp = context.arm_fp;
+		regs->ARM_ip = context.arm_ip;
+		regs->ARM_sp = context.arm_sp;
+		regs->ARM_lr = context.arm_lr;
+		regs->ARM_pc = context.arm_pc;
+		regs->ARM_cpsr = context.arm_cpsr;
+	}
 
 	err |= !valid_user_regs(regs);
 
-- 
2.5.0

  parent reply	other threads:[~2018-10-15 23:18 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-15 15:31 [PATCH 4.14 00/24] V4.14 backport of 32-bit arm spectre patches David Long
2018-10-15 15:31 ` [PATCH 4.14 01/24] ARM: add more CPU part numbers for Cortex and Brahma B15 CPUs David Long
2018-10-15 15:31 ` [PATCH 4.14 02/24] ARM: bugs: prepare processor bug infrastructure David Long
2018-10-15 15:31 ` [PATCH 4.14 03/24] ARM: bugs: hook processor bug checking into SMP and suspend paths David Long
2018-10-15 15:31 ` [PATCH 4.14 04/24] ARM: bugs: add support for per-processor bug checking David Long
2018-10-15 15:31 ` [PATCH 4.14 05/24] ARM: spectre: add Kconfig symbol for CPUs vulnerable to Spectre David Long
2018-10-15 15:32 ` [PATCH 4.14 06/24] ARM: spectre-v2: harden branch predictor on context switches David Long
2018-10-15 15:32 ` [PATCH 4.14 07/24] ARM: spectre-v2: add Cortex A8 and A15 validation of the IBE bit David Long
2018-10-15 15:32 ` [PATCH 4.14 08/24] ARM: spectre-v2: harden user aborts in kernel space David Long
2018-10-15 15:32 ` [PATCH 4.14 09/24] ARM: spectre-v2: add firmware based hardening David Long
2018-10-15 15:32 ` [PATCH 4.14 10/24] ARM: spectre-v2: warn about incorrect context switching functions David Long
2018-10-15 15:32 ` [PATCH 4.14 11/24] ARM: KVM: invalidate BTB on guest exit for Cortex-A12/A17 David Long
2018-10-15 15:32 ` [PATCH 4.14 12/24] ARM: KVM: invalidate icache on guest exit for Cortex-A15 David Long
2018-10-15 15:32 ` [PATCH 4.14 13/24] ARM: spectre-v2: KVM: invalidate icache on guest exit for Brahma B15 David Long
2018-10-15 15:32 ` [PATCH 4.14 14/24] ARM: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling David Long
2018-10-15 15:32 ` [PATCH 4.14 15/24] ARM: KVM: report support for SMCCC_ARCH_WORKAROUND_1 David Long
2018-10-15 15:32 ` [PATCH 4.14 16/24] ARM: spectre-v1: add speculation barrier (csdb) macros David Long
2018-10-15 15:32 ` [PATCH 4.14 17/24] ARM: spectre-v1: add array_index_mask_nospec() implementation David Long
2018-10-15 15:32 ` [PATCH 4.14 18/24] ARM: spectre-v1: fix syscall entry David Long
2018-10-15 15:32 ` David Long [this message]
2018-10-15 15:32 ` [PATCH 4.14 20/24] ARM: vfp: use __copy_from_user() when restoring VFP state David Long
2018-10-15 15:32 ` [PATCH 4.14 21/24] ARM: oabi-compat: copy semops using __copy_from_user() David Long
2018-10-15 15:32 ` [PATCH 4.14 22/24] ARM: use __inttype() in get_user() David Long
2018-10-15 15:32 ` [PATCH 4.14 23/24] ARM: spectre-v1: use get_user() for __get_user() David Long
2018-10-15 15:32 ` [PATCH 4.14 24/24] ARM: spectre-v1: mitigate user accesses David Long
2018-10-16 16:10 ` [PATCH 4.14 00/24] V4.14 backport of 32-bit arm spectre patches Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1539617538-22328-20-git-send-email-dave.long@linaro.org \
    --to=dave.long@linaro.org \
    --cc=broonie@kernel.org \
    --cc=f.fainelli@gmail.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux@armlinux.org.uk \
    --cc=marc.zyngier@arm.com \
    --cc=mark.rutland@arm.com \
    --cc=stable@vger.kernel.org \
    --cc=tony@atomide.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.