* [PATCH] [IA64] Fix futex_atomic_cmpxchg_inatomic()
@ 2012-04-13 18:32 Luck, Tony
2012-04-13 22:31 ` Michel Lespinasse
2012-04-15 21:19 ` Émeric Maschino
0 siblings, 2 replies; 3+ messages in thread
From: Luck, Tony @ 2012-04-13 18:32 UTC (permalink / raw)
To: linux-ia64
Michel Lespinasse cleaned up the futex calling conventions in
commit 37a9d912b24f96a0591773e6e6c3642991ae5a70
futex: Sanitize cmpxchg_futex_value_locked API
But the ia64 implementation was subtly broken. Gcc does not know
that register "r8" will be updated by the fault handler if the
cmpxchg instruction takes an exception. So it feels safe in letting
the initialization of r8 slide to after the cmpxchg. Result: we
always return 0 whether the user address faulted or not.
Fix by moving the initialization of r8 into the __asm__ code so
gcc won't move it.
Reported-by: <emeric.maschino@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?idB757
Cc: stable@vger.kernel.org # v2.6.39+
Signed-off-by: Tony Luck <tony.luck@intel.com>
---
arch/ia64/include/asm/futex.h | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/arch/ia64/include/asm/futex.h b/arch/ia64/include/asm/futex.h
index 0ab82cc..841b062 100644
--- a/arch/ia64/include/asm/futex.h
+++ b/arch/ia64/include/asm/futex.h
@@ -106,10 +106,11 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
return -EFAULT;
{
- register unsigned long r8 __asm ("r8") = 0;
+ register unsigned long r8 __asm ("r8");
unsigned long prev;
__asm__ __volatile__(
" mf;; \n"
+ " mov r8=r0 \n"
" mov ar.ccv=%3;; \n"
"[1:] cmpxchg4.acq %0=[%1],%2,ar.ccv \n"
" .xdata4 \"__ex_table\", 1b-., 2f-. \n"
--
1.7.9.rc2.1.g69204
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] [IA64] Fix futex_atomic_cmpxchg_inatomic()
2012-04-13 18:32 [PATCH] [IA64] Fix futex_atomic_cmpxchg_inatomic() Luck, Tony
@ 2012-04-13 22:31 ` Michel Lespinasse
2012-04-15 21:19 ` Émeric Maschino
1 sibling, 0 replies; 3+ messages in thread
From: Michel Lespinasse @ 2012-04-13 22:31 UTC (permalink / raw)
To: linux-ia64
On Fri, Apr 13, 2012 at 8:32 PM, Luck, Tony <tony.luck@intel.com> wrote:
> Michel Lespinasse cleaned up the futex calling conventions in
> commit 37a9d912b24f96a0591773e6e6c3642991ae5a70
> futex: Sanitize cmpxchg_futex_value_locked API
>
> But the ia64 implementation was subtly broken. Gcc does not know
> that register "r8" will be updated by the fault handler if the
> cmpxchg instruction takes an exception. So it feels safe in letting
> the initialization of r8 slide to after the cmpxchg. Result: we
> always return 0 whether the user address faulted or not.
>
> Fix by moving the initialization of r8 into the __asm__ code so
> gcc won't move it.
Looks good. Sorry for the trouble.
--
Michel "Walken" Lespinasse
A program is never fully debugged until the last user dies.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] [IA64] Fix futex_atomic_cmpxchg_inatomic()
2012-04-13 18:32 [PATCH] [IA64] Fix futex_atomic_cmpxchg_inatomic() Luck, Tony
2012-04-13 22:31 ` Michel Lespinasse
@ 2012-04-15 21:19 ` Émeric Maschino
1 sibling, 0 replies; 3+ messages in thread
From: Émeric Maschino @ 2012-04-15 21:19 UTC (permalink / raw)
To: linux-ia64
Hi,
Just rebuilt kernel with the patch proposed by Tony: issue fixed :-)
Many thanks,
Emeric
Le 14 avril 2012 00:31, Michel Lespinasse <walken@google.com> a écrit :
> On Fri, Apr 13, 2012 at 8:32 PM, Luck, Tony <tony.luck@intel.com> wrote:
>> Michel Lespinasse cleaned up the futex calling conventions in
>> commit 37a9d912b24f96a0591773e6e6c3642991ae5a70
>> futex: Sanitize cmpxchg_futex_value_locked API
>>
>> But the ia64 implementation was subtly broken. Gcc does not know
>> that register "r8" will be updated by the fault handler if the
>> cmpxchg instruction takes an exception. So it feels safe in letting
>> the initialization of r8 slide to after the cmpxchg. Result: we
>> always return 0 whether the user address faulted or not.
>>
>> Fix by moving the initialization of r8 into the __asm__ code so
>> gcc won't move it.
>
> Looks good. Sorry for the trouble.
>
> --
> Michel "Walken" Lespinasse
> A program is never fully debugged until the last user dies.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-04-15 21:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-04-13 18:32 [PATCH] [IA64] Fix futex_atomic_cmpxchg_inatomic() Luck, Tony
2012-04-13 22:31 ` Michel Lespinasse
2012-04-15 21:19 ` Émeric Maschino
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.