* [PATCH v2] arm64: fix current_thread_info()->addr_limit setup
@ 2016-05-12 16:06 Yury Norov
2016-05-12 17:22 ` Catalin Marinas
0 siblings, 1 reply; 4+ messages in thread
From: Yury Norov @ 2016-05-12 16:06 UTC (permalink / raw)
To: arnd, catalin.marinas
Cc: linux-arm-kernel, linux-kernel, linux-arch, Yury Norov
At elf loading in flush_old_exec() in fs/exec.c, generic code sets
current_thread_info()->addr_limit to one that corresponds aarch64 value,
and ignores compat mode there as corresponding status setup happens
later on in load_elf_binary() by SET_PERSONALITY() macro. As result,
compat task has wrong addr_limit, and it may cause various bugs.
This patch fixes it. It also fixes USER_DS macro to return different
values depending on compat at runtime.
It was discovered during ilp32 development. See details here:
https://lkml.org/lkml/2016/5/11/975
v2:
flush tpidrro_el0 unconditionally in tls_thread_flush() as if exec() is
called by aarch64 task, is_compat_task() fails even if new thread is
aarch32.
Signed-off-by: Yury Norov <ynorov@caviumnetworks.com>
---
arch/arm64/include/asm/elf.h | 11 +++++++++--
arch/arm64/include/asm/uaccess.h | 2 +-
arch/arm64/kernel/process.c | 18 +++++++-----------
3 files changed, 17 insertions(+), 14 deletions(-)
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index 24ed037..fda75ce 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -138,7 +138,10 @@ typedef struct user_fpsimd_state elf_fpregset_t;
*/
#define ELF_PLAT_INIT(_r, load_addr) (_r)->regs[0] = 0
-#define SET_PERSONALITY(ex) clear_thread_flag(TIF_32BIT);
+#define SET_PERSONALITY(ex) do { \
+ clear_thread_flag(TIF_32BIT); \
+ set_fs(TASK_SIZE_64); \
+} while (0)
#define ARCH_DLINFO \
do { \
@@ -181,7 +184,11 @@ typedef compat_elf_greg_t compat_elf_gregset_t[COMPAT_ELF_NGREG];
((x)->e_flags & EF_ARM_EABI_MASK))
#define compat_start_thread compat_start_thread
-#define COMPAT_SET_PERSONALITY(ex) set_thread_flag(TIF_32BIT);
+#define COMPAT_SET_PERSONALITY(ex) do { \
+ set_thread_flag(TIF_32BIT); \
+ set_fs(TASK_SIZE_32); \
+} while (0)
+
#define COMPAT_ARCH_DLINFO
extern int aarch32_setup_vectors_page(struct linux_binprm *bprm,
int uses_interp);
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index 0685d74..5b269e6 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -60,7 +60,7 @@ extern int fixup_exception(struct pt_regs *regs);
#define KERNEL_DS (-1UL)
#define get_ds() (KERNEL_DS)
-#define USER_DS TASK_SIZE_64
+#define USER_DS TASK_SIZE
#define get_fs() (current_thread_info()->addr_limit)
static inline void set_fs(mm_segment_t fs)
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 8062482..2b25930 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -211,17 +211,13 @@ static void tls_thread_flush(void)
{
asm ("msr tpidr_el0, xzr");
- if (is_compat_task()) {
- current->thread.tp_value = 0;
-
- /*
- * We need to ensure ordering between the shadow state and the
- * hardware state, so that we don't corrupt the hardware state
- * with a stale shadow state during context switch.
- */
- barrier();
- asm ("msr tpidrro_el0, xzr");
- }
+ /*
+ * We need to ensure ordering between the shadow state and the
+ * hardware state, so that we don't corrupt the hardware state
+ * with a stale shadow state during context switch.
+ */
+ barrier();
+ asm ("msr tpidrro_el0, xzr");
}
void flush_thread(void)
--
2.5.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] arm64: fix current_thread_info()->addr_limit setup
2016-05-12 16:06 [PATCH v2] arm64: fix current_thread_info()->addr_limit setup Yury Norov
@ 2016-05-12 17:22 ` Catalin Marinas
2016-05-12 18:03 ` Yury Norov
0 siblings, 1 reply; 4+ messages in thread
From: Catalin Marinas @ 2016-05-12 17:22 UTC (permalink / raw)
To: Yury Norov; +Cc: arnd, linux-arch, linux-kernel, linux-arm-kernel
On Thu, May 12, 2016 at 07:06:03PM +0300, Yury Norov wrote:
> diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
> index 24ed037..fda75ce 100644
> --- a/arch/arm64/include/asm/elf.h
> +++ b/arch/arm64/include/asm/elf.h
> @@ -138,7 +138,10 @@ typedef struct user_fpsimd_state elf_fpregset_t;
> */
> #define ELF_PLAT_INIT(_r, load_addr) (_r)->regs[0] = 0
>
> -#define SET_PERSONALITY(ex) clear_thread_flag(TIF_32BIT);
> +#define SET_PERSONALITY(ex) do { \
> + clear_thread_flag(TIF_32BIT); \
> + set_fs(TASK_SIZE_64); \
> +} while (0)
>
> #define ARCH_DLINFO \
> do { \
> @@ -181,7 +184,11 @@ typedef compat_elf_greg_t compat_elf_gregset_t[COMPAT_ELF_NGREG];
> ((x)->e_flags & EF_ARM_EABI_MASK))
>
> #define compat_start_thread compat_start_thread
> -#define COMPAT_SET_PERSONALITY(ex) set_thread_flag(TIF_32BIT);
> +#define COMPAT_SET_PERSONALITY(ex) do { \
> + set_thread_flag(TIF_32BIT); \
> + set_fs(TASK_SIZE_32); \
> +} while (0)
> +
> #define COMPAT_ARCH_DLINFO
> extern int aarch32_setup_vectors_page(struct linux_binprm *bprm,
> int uses_interp);
> diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> index 0685d74..5b269e6 100644
> --- a/arch/arm64/include/asm/uaccess.h
> +++ b/arch/arm64/include/asm/uaccess.h
> @@ -60,7 +60,7 @@ extern int fixup_exception(struct pt_regs *regs);
> #define KERNEL_DS (-1UL)
> #define get_ds() (KERNEL_DS)
>
> -#define USER_DS TASK_SIZE_64
> +#define USER_DS TASK_SIZE
We can avoid the USER_DS change as long as SET_PERSONALITY updates the
thread's addr_limit. There are very few explicit set_fs(USER_DS) calls
and they are on the thread exit path (or exec).
That's unless we try to make a generic set_fs(USER_DS) addition to
something like setup_new_exec() and we wouldn't need the SET_PERSONALITY
changes:
diff --git a/fs/exec.c b/fs/exec.c
index c4010b8207a1..54cc537f5986 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1226,6 +1226,9 @@ EXPORT_SYMBOL(would_dump);
void setup_new_exec(struct linux_binprm * bprm)
{
+ /* set the address limit for the new executable */
+ set_fs(USER_DS);
+
arch_pick_mmap_layout(current->mm);
/* This is the point of no return */
> #define get_fs() (current_thread_info()->addr_limit)
>
> static inline void set_fs(mm_segment_t fs)
> diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
> index 8062482..2b25930 100644
> --- a/arch/arm64/kernel/process.c
> +++ b/arch/arm64/kernel/process.c
> @@ -211,17 +211,13 @@ static void tls_thread_flush(void)
> {
> asm ("msr tpidr_el0, xzr");
>
> - if (is_compat_task()) {
> - current->thread.tp_value = 0;
> -
> - /*
> - * We need to ensure ordering between the shadow state and the
> - * hardware state, so that we don't corrupt the hardware state
> - * with a stale shadow state during context switch.
> - */
> - barrier();
> - asm ("msr tpidrro_el0, xzr");
> - }
> + /*
> + * We need to ensure ordering between the shadow state and the
> + * hardware state, so that we don't corrupt the hardware state
> + * with a stale shadow state during context switch.
> + */
> + barrier();
> + asm ("msr tpidrro_el0, xzr");
> }
Why did you dropped tp_value initialisation? Context switching on native
64-bit tasks rely on copying the tpidr_el0 in and out of tp_value.
However, compat tasks use the read-only tpidrro_el0 register set
explicitly via a system call. Until this call happens, the TLS register
would contain some garbage after the thread has been switched back in.
--
Catalin
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] arm64: fix current_thread_info()->addr_limit setup
2016-05-12 17:22 ` Catalin Marinas
@ 2016-05-12 18:03 ` Yury Norov
2016-05-13 10:05 ` Catalin Marinas
0 siblings, 1 reply; 4+ messages in thread
From: Yury Norov @ 2016-05-12 18:03 UTC (permalink / raw)
To: Catalin Marinas; +Cc: linux-arch, linux-kernel, arnd, linux-arm-kernel
On Thu, May 12, 2016 at 06:22:03PM +0100, Catalin Marinas wrote:
> On Thu, May 12, 2016 at 07:06:03PM +0300, Yury Norov wrote:
> > diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
> > index 24ed037..fda75ce 100644
> > --- a/arch/arm64/include/asm/elf.h
> > +++ b/arch/arm64/include/asm/elf.h
> > @@ -138,7 +138,10 @@ typedef struct user_fpsimd_state elf_fpregset_t;
> > */
> > #define ELF_PLAT_INIT(_r, load_addr) (_r)->regs[0] = 0
> >
> > -#define SET_PERSONALITY(ex) clear_thread_flag(TIF_32BIT);
> > +#define SET_PERSONALITY(ex) do { \
> > + clear_thread_flag(TIF_32BIT); \
> > + set_fs(TASK_SIZE_64); \
> > +} while (0)
> >
> > #define ARCH_DLINFO \
> > do { \
> > @@ -181,7 +184,11 @@ typedef compat_elf_greg_t compat_elf_gregset_t[COMPAT_ELF_NGREG];
> > ((x)->e_flags & EF_ARM_EABI_MASK))
> >
> > #define compat_start_thread compat_start_thread
> > -#define COMPAT_SET_PERSONALITY(ex) set_thread_flag(TIF_32BIT);
> > +#define COMPAT_SET_PERSONALITY(ex) do { \
> > + set_thread_flag(TIF_32BIT); \
> > + set_fs(TASK_SIZE_32); \
> > +} while (0)
> > +
> > #define COMPAT_ARCH_DLINFO
> > extern int aarch32_setup_vectors_page(struct linux_binprm *bprm,
> > int uses_interp);
> > diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> > index 0685d74..5b269e6 100644
> > --- a/arch/arm64/include/asm/uaccess.h
> > +++ b/arch/arm64/include/asm/uaccess.h
> > @@ -60,7 +60,7 @@ extern int fixup_exception(struct pt_regs *regs);
> > #define KERNEL_DS (-1UL)
> > #define get_ds() (KERNEL_DS)
> >
> > -#define USER_DS TASK_SIZE_64
> > +#define USER_DS TASK_SIZE
>
> We can avoid the USER_DS change as long as SET_PERSONALITY updates the
> thread's addr_limit. There are very few explicit set_fs(USER_DS) calls
> and they are on the thread exit path (or exec).
>
> That's unless we try to make a generic set_fs(USER_DS) addition to
> something like setup_new_exec() and we wouldn't need the SET_PERSONALITY
> changes:
>
I think we'd better leave it fixed. Just because it's correct. Now it
looks like we have fixed early usages (before SET_PERSONALITY()) of
set_fs() explicitly, and normal usages (and possible in future) by
fixing USER_DS.
> diff --git a/fs/exec.c b/fs/exec.c
> index c4010b8207a1..54cc537f5986 100644
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -1226,6 +1226,9 @@ EXPORT_SYMBOL(would_dump);
>
> void setup_new_exec(struct linux_binprm * bprm)
> {
> + /* set the address limit for the new executable */
> + set_fs(USER_DS);
> +
> arch_pick_mmap_layout(current->mm);
>
> /* This is the point of no return */
>
> > #define get_fs() (current_thread_info()->addr_limit)
> >
> > static inline void set_fs(mm_segment_t fs)
> > diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
> > index 8062482..2b25930 100644
> > --- a/arch/arm64/kernel/process.c
> > +++ b/arch/arm64/kernel/process.c
> > @@ -211,17 +211,13 @@ static void tls_thread_flush(void)
> > {
> > asm ("msr tpidr_el0, xzr");
> >
> > - if (is_compat_task()) {
> > - current->thread.tp_value = 0;
> > -
> > - /*
> > - * We need to ensure ordering between the shadow state and the
> > - * hardware state, so that we don't corrupt the hardware state
> > - * with a stale shadow state during context switch.
> > - */
> > - barrier();
> > - asm ("msr tpidrro_el0, xzr");
> > - }
> > + /*
> > + * We need to ensure ordering between the shadow state and the
> > + * hardware state, so that we don't corrupt the hardware state
> > + * with a stale shadow state during context switch.
> > + */
> > + barrier();
> > + asm ("msr tpidrro_el0, xzr");
> > }
>
> Why did you dropped tp_value initialisation? Context switching on native
> 64-bit tasks rely on copying the tpidr_el0 in and out of tp_value.
> However, compat tasks use the read-only tpidrro_el0 register set
> explicitly via a system call. Until this call happens, the TLS register
> would contain some garbage after the thread has been switched back in.
>
OOPS, my fault. I just missed a line. Should I send v3, or you or Arnd
can apply it and fix in your branch?
> --
> Catalin
>
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] arm64: fix current_thread_info()->addr_limit setup
2016-05-12 18:03 ` Yury Norov
@ 2016-05-13 10:05 ` Catalin Marinas
0 siblings, 0 replies; 4+ messages in thread
From: Catalin Marinas @ 2016-05-13 10:05 UTC (permalink / raw)
To: Yury Norov; +Cc: linux-arch, linux-kernel, arnd, linux-arm-kernel, Al Viro
On Thu, May 12, 2016 at 09:03:42PM +0300, Yury Norov wrote:
> On Thu, May 12, 2016 at 06:22:03PM +0100, Catalin Marinas wrote:
> > On Thu, May 12, 2016 at 07:06:03PM +0300, Yury Norov wrote:
> > > diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
> > > index 24ed037..fda75ce 100644
> > > --- a/arch/arm64/include/asm/elf.h
> > > +++ b/arch/arm64/include/asm/elf.h
> > > @@ -138,7 +138,10 @@ typedef struct user_fpsimd_state elf_fpregset_t;
> > > */
> > > #define ELF_PLAT_INIT(_r, load_addr) (_r)->regs[0] = 0
> > >
> > > -#define SET_PERSONALITY(ex) clear_thread_flag(TIF_32BIT);
> > > +#define SET_PERSONALITY(ex) do { \
> > > + clear_thread_flag(TIF_32BIT); \
> > > + set_fs(TASK_SIZE_64); \
> > > +} while (0)
> > >
> > > #define ARCH_DLINFO \
> > > do { \
> > > @@ -181,7 +184,11 @@ typedef compat_elf_greg_t compat_elf_gregset_t[COMPAT_ELF_NGREG];
> > > ((x)->e_flags & EF_ARM_EABI_MASK))
> > >
> > > #define compat_start_thread compat_start_thread
> > > -#define COMPAT_SET_PERSONALITY(ex) set_thread_flag(TIF_32BIT);
> > > +#define COMPAT_SET_PERSONALITY(ex) do { \
> > > + set_thread_flag(TIF_32BIT); \
> > > + set_fs(TASK_SIZE_32); \
> > > +} while (0)
> > > +
> > > #define COMPAT_ARCH_DLINFO
> > > extern int aarch32_setup_vectors_page(struct linux_binprm *bprm,
> > > int uses_interp);
> > > diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> > > index 0685d74..5b269e6 100644
> > > --- a/arch/arm64/include/asm/uaccess.h
> > > +++ b/arch/arm64/include/asm/uaccess.h
> > > @@ -60,7 +60,7 @@ extern int fixup_exception(struct pt_regs *regs);
> > > #define KERNEL_DS (-1UL)
> > > #define get_ds() (KERNEL_DS)
> > >
> > > -#define USER_DS TASK_SIZE_64
> > > +#define USER_DS TASK_SIZE
> >
> > We can avoid the USER_DS change as long as SET_PERSONALITY updates the
> > thread's addr_limit. There are very few explicit set_fs(USER_DS) calls
> > and they are on the thread exit path (or exec).
> >
> > That's unless we try to make a generic set_fs(USER_DS) addition to
> > something like setup_new_exec() and we wouldn't need the SET_PERSONALITY
> > changes:
>
> I think we'd better leave it fixed. Just because it's correct. Now it
> looks like we have fixed early usages (before SET_PERSONALITY()) of
> set_fs() explicitly, and normal usages (and possible in future) by
> fixing USER_DS.
Thinking some more, let's first try to change USER_DS to the dynamic
TASK_SIZE and add a generic set_fs(USER_DS) call in setup_new_exec() as
below:
> > diff --git a/fs/exec.c b/fs/exec.c
> > index c4010b8207a1..54cc537f5986 100644
> > --- a/fs/exec.c
> > +++ b/fs/exec.c
> > @@ -1226,6 +1226,9 @@ EXPORT_SYMBOL(would_dump);
> >
> > void setup_new_exec(struct linux_binprm * bprm)
> > {
> > + /* set the address limit for the new executable */
> > + set_fs(USER_DS);
> > +
> > arch_pick_mmap_layout(current->mm);
> >
> > /* This is the point of no return */
> >
Cc'ing Al Viro for his opinion here.
In summary: access_ok() behaves differently on native 32-bit kernels vs
64-bit + compat applications because for the latter USER_DS is always
set to the maximum 64-bit TASK_SIZE (x86 and powerpc seem to do
something similar). Changing USER_DS alone in the arch code does not
help since the set_fs(USER_DS) in flush_old_exec() is called prior to
COMPAT_SET_PERSONALITY().
(it's not a serious bug, just some LTP tests failing when they test an
address range going beyond the 4GB limit)
Thanks.
--
Catalin
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-05-13 10:06 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-05-12 16:06 [PATCH v2] arm64: fix current_thread_info()->addr_limit setup Yury Norov
2016-05-12 17:22 ` Catalin Marinas
2016-05-12 18:03 ` Yury Norov
2016-05-13 10:05 ` Catalin Marinas
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).