linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Andy Lutomirski <luto@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>
Subject: [PATCH 4.4 03/27] x86/vdso: Fix asm constraints on vDSO syscall fallbacks
Date: Thu, 11 Oct 2018 17:34:50 +0200	[thread overview]
Message-ID: <20181011152534.181196336@linuxfoundation.org> (raw)
In-Reply-To: <20181011152534.014964888@linuxfoundation.org>

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <luto@kernel.org>

commit 715bd9d12f84d8f5cc8ad21d888f9bc304a8eb0b upstream.

The syscall fallbacks in the vDSO have incorrect asm constraints.
They are not marked as writing to their outputs -- instead, they are
marked as clobbering "memory", which is useless.  In particular, gcc
is smart enough to know that the timespec parameter hasn't escaped,
so a memory clobber doesn't clobber it.  And passing a pointer as an
asm *input* does not tell gcc that the pointed-to value is changed.

Add in the fact that the asm instructions weren't volatile, and gcc
was free to omit them entirely unless their sole output (the return
value) is used.  Which it is (phew!), but that stops happening with
some upcoming patches.

As a trivial example, the following code:

void test_fallback(struct timespec *ts)
{
	vdso_fallback_gettime(CLOCK_MONOTONIC, ts);
}

compiles to:

00000000000000c0 <test_fallback>:
  c0:   c3                      retq

To add insult to injury, the RCX and R11 clobbers on 64-bit
builds were missing.

The "memory" clobber is also unnecessary -- no ordering with respect to
other memory operations is needed, but that's going to be fixed in a
separate not-for-stable patch.

Fixes: 2aae950b21e4 ("x86_64: Add vDSO for x86-64 with gettimeofday/clock_gettime/getcpu")
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/2c0231690551989d2fafa60ed0e7b5cc8b403908.1538422295.git.luto@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/entry/vdso/vclock_gettime.c |   18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

--- a/arch/x86/entry/vdso/vclock_gettime.c
+++ b/arch/x86/entry/vdso/vclock_gettime.c
@@ -51,8 +51,9 @@ extern u8 pvclock_page
 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
 {
 	long ret;
-	asm("syscall" : "=a" (ret) :
-	    "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : "memory");
+	asm ("syscall" : "=a" (ret), "=m" (*ts) :
+	     "0" (__NR_clock_gettime), "D" (clock), "S" (ts) :
+	     "memory", "rcx", "r11");
 	return ret;
 }
 
@@ -60,8 +61,9 @@ notrace static long vdso_fallback_gtod(s
 {
 	long ret;
 
-	asm("syscall" : "=a" (ret) :
-	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
+	asm ("syscall" : "=a" (ret), "=m" (*tv), "=m" (*tz) :
+	     "0" (__NR_gettimeofday), "D" (tv), "S" (tz) :
+	     "memory", "rcx", "r11");
 	return ret;
 }
 
@@ -143,12 +145,12 @@ notrace static long vdso_fallback_gettim
 {
 	long ret;
 
-	asm(
+	asm (
 		"mov %%ebx, %%edx \n"
 		"mov %2, %%ebx \n"
 		"call __kernel_vsyscall \n"
 		"mov %%edx, %%ebx \n"
-		: "=a" (ret)
+		: "=a" (ret), "=m" (*ts)
 		: "0" (__NR_clock_gettime), "g" (clock), "c" (ts)
 		: "memory", "edx");
 	return ret;
@@ -158,12 +160,12 @@ notrace static long vdso_fallback_gtod(s
 {
 	long ret;
 
-	asm(
+	asm (
 		"mov %%ebx, %%edx \n"
 		"mov %2, %%ebx \n"
 		"call __kernel_vsyscall \n"
 		"mov %%edx, %%ebx \n"
-		: "=a" (ret)
+		: "=a" (ret), "=m" (*tv), "=m" (*tz)
 		: "0" (__NR_gettimeofday), "g" (tv), "c" (tz)
 		: "memory", "edx");
 	return ret;



  parent reply	other threads:[~2018-10-11 15:42 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-11 15:34 [PATCH 4.4 00/27] 4.4.161-stable review Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 01/27] mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 02/27] fbdev/omapfb: fix omapfb_memory_read infoleak Greg Kroah-Hartman
2018-10-11 15:34 ` Greg Kroah-Hartman [this message]
2018-10-11 15:34 ` [PATCH 4.4 04/27] x86/vdso: Fix vDSO syscall fallback asm constraint regression Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 05/27] PCI: Reprogram bridge prefetch registers on resume Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 06/27] mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 07/27] PM / core: Clear the direct_complete flag on errors Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 08/27] dm cache: fix resize crash if user doesnt reload cache table Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 09/27] xhci: Add missing CAS workaround for Intel Sunrise Point xHCI Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 10/27] USB: serial: simple: add Motorola Tetra MTP6550 id Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 11/27] of: unittest: Disable interrupt node tests for old world MAC systems Greg Kroah-Hartman
2018-10-11 15:34 ` [PATCH 4.4 12/27] ext4: add corruption check in ext4_xattr_set_entry() Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 13/27] ext4: always verify the magic number in xattr blocks Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 14/27] cgroup: Fix deadlock in cpu hotplug path Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 15/27] ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 16/27] powerpc/fadump: Return error when fadump registration fails Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 17/27] ARC: clone syscall to setp r25 as thread pointer Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 18/27] ucma: fix a use-after-free in ucma_resolve_ip() Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 19/27] ubifs: Check for name being NULL while mounting Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 20/27] tcp: increment sk_drops for dropped rx packets Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 21/27] tcp: use an RB tree for ooo receive queue Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 22/27] tcp: fix a stale ooo_last_skb after a replace Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 23/27] tcp: free batches of packets in tcp_prune_ofo_queue() Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 24/27] tcp: call tcp_drop() from tcp_data_queue_ofo() Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 25/27] tcp: add tcp_ooo_try_coalesce() helper Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 26/27] ath10k: fix scan crash due to incorrect length calculation Greg Kroah-Hartman
2018-10-11 15:35 ` [PATCH 4.4 27/27] ebtables: arpreply: Add the standard target sanity check Greg Kroah-Hartman
2018-10-11 22:43 ` [PATCH 4.4 00/27] 4.4.161-stable review Shuah Khan
2018-10-12  4:38 ` Naresh Kamboju
     [not found] ` <5bbfcd13.1c69fb81.477c6.d7d9@mx.google.com>
2018-10-12  6:14   ` Greg Kroah-Hartman
2018-10-12 12:22     ` Guenter Roeck
2018-10-12  7:52 ` Jon Hunter
2018-10-12 15:42 ` Guenter Roeck
2018-10-12 17:07 ` Nathan Chancellor

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181011152534.181196336@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).