From: Alexey Dobriyan <adobriyan@gmail.com>
To: hpa@zytor.com, mingo@kernel.org
Cc: x86@kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 2/2] x86: fix incomplete clear by clear_user()
Date: Sun, 21 Jun 2015 00:47:15 +0300 [thread overview]
Message-ID: <20150620214715.GB14099@p183.telecom.by> (raw)
In-Reply-To: <20150620214536.GA14099@p183.telecom.by>
clear_user() used MOVQ+MOVB and if MOVQ faults, code simply exits and
honestly returns remaining length. In case of unaligned area, unaligned
remainder would count towards return value (correctly) but not cleared
(lazy code at least):
clear_user(p + 4096 - 4, 8) = 8
No one would have noticed but REP MOVSB addition to clear_user()
repertoire creates a problem: REP MOVSB does everything correctly,
clears and counts to the last possible byte, but REP STOSQ and MOVQ
variants DO NOT:
MOVQ clear_user(p + 4096 - 4, 8) = 8
REP STOSQ clear_user(p + 4096 - 4, 8) = 8
REP STOSB clear_user(p + 4096 - 4, 8) = 4
Patch fixes incomplete clear on 32-bit and 64-bit REP STOSQ, MOVQ.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
---
arch/x86/lib/clear_user_64.S | 9 ++++++---
arch/x86/lib/usercopy_32.c | 3 ++-
2 files changed, 8 insertions(+), 4 deletions(-)
--- a/arch/x86/lib/clear_user_64.S
+++ b/arch/x86/lib/clear_user_64.S
@@ -26,7 +26,8 @@ ENTRY(__clear_user)
.section .fixup,"ax"
4: lea (%rsi,%rcx,8),%rcx
- jmp 3b
+ # Fill as much as possible with byte stores.
+ jmp 2b
.previous
_ASM_EXTABLE(1b,4b)
@@ -57,7 +58,8 @@ ENTRY(__clear_user_movq)
3:
movb $0, (%rdi)
add $1, %rdi
- sub $1, %ecx
+ # Unaligned area and 4GB+ tail after recovery require RCX here.
+ sub $1, %rcx
jnz 3b
4:
mov %rcx, %rax
@@ -66,7 +68,8 @@ ENTRY(__clear_user_movq)
.section .fixup,"ax"
5: lea (%rsi,%rcx,8),%rcx
- jmp 4b
+ # Fill as much as possible with byte stores.
+ jmp 3b
.previous
_ASM_EXTABLE(1b,5b)
--- a/arch/x86/lib/usercopy_32.c
+++ b/arch/x86/lib/usercopy_32.c
@@ -49,7 +49,8 @@ do { \
"2: " ASM_CLAC "\n" \
".section .fixup,\"ax\"\n" \
"3: lea 0(%2,%0,4),%0\n" \
- " jmp 2b\n" \
+ /* Fill as much as possible with byte stores. */ \
+ " jmp 1b\n" \
".previous\n" \
_ASM_EXTABLE(0b,3b) \
_ASM_EXTABLE(1b,2b) \
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
Please read the FAQ at http://www.tux.org/lkml/
next prev parent reply other threads:[~2015-06-20 21:47 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-06-20 21:45 [PATCH 1/2] x86: use alternatives for clear_user() Alexey Dobriyan
2015-06-20 21:47 ` Alexey Dobriyan [this message]
2015-06-21 6:55 ` [PATCH 2/2] x86: fix incomplete clear by clear_user() Ingo Molnar
2015-06-21 6:52 ` [PATCH 1/2] x86: use alternatives for clear_user() Ingo Molnar
2015-06-22 12:18 ` Alexey Dobriyan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150620214715.GB14099@p183.telecom.by \
--to=adobriyan@gmail.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).