Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1319485

[PATCH 3.14 46/59] powerpc/tm: Block signal return setting invalid MSR state

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 3.14 46/59] powerpc/tm: Block signal return setting invalid MSR state
Date 2016-01-27 20:30 +0100
Message-ID <qVDWZ-8oV-71@gated-at.bofh.it> (permalink)
References <qVDNg-8kN-11@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Neuling <mikey@neuling.org>

commit d2b9d2a5ad5ef04ff978c9923d19730cb05efd55 upstream.

Currently we allow both the MSR T and S bits to be set by userspace on
a signal return.  Unfortunately this is a reserved configuration and
will cause a TM Bad Thing exception if attempted (via rfid).

This patch checks for this case in both the 32 and 64 bit signals
code.  If both T and S are set, we mark the context as invalid.

Found using a syscall fuzzer.

Fixes: 2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context")
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/reg.h  |    1 +
 arch/powerpc/kernel/signal_32.c |   14 +++++++++-----
 arch/powerpc/kernel/signal_64.c |    4 ++++
 3 files changed, 14 insertions(+), 5 deletions(-)

--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -108,6 +108,7 @@
 #define MSR_TS_T	__MASK(MSR_TS_T_LG)	/*  Transaction Transactional */
 #define MSR_TS_MASK	(MSR_TS_T | MSR_TS_S)   /* Transaction State bits */
 #define MSR_TM_ACTIVE(x) (((x) & MSR_TS_MASK) != 0) /* Transaction active? */
+#define MSR_TM_RESV(x) (((x) & MSR_TS_MASK) == MSR_TS_MASK) /* Reserved */
 #define MSR_TM_TRANSACTIONAL(x)	(((x) & MSR_TS_MASK) == MSR_TS_T)
 #define MSR_TM_SUSPENDED(x)	(((x) & MSR_TS_MASK) == MSR_TS_S)
 
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -876,6 +876,15 @@ static long restore_tm_user_regs(struct
 		return 1;
 #endif /* CONFIG_SPE */
 
+	/* Get the top half of the MSR from the user context */
+	if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
+		return 1;
+	msr_hi <<= 32;
+	/* If TM bits are set to the reserved value, it's an invalid context */
+	if (MSR_TM_RESV(msr_hi))
+		return 1;
+	/* Pull in the MSR TM bits from the user context */
+	regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
 	/* Now, recheckpoint.  This loads up all of the checkpointed (older)
 	 * registers, including FP and V[S]Rs.  After recheckpointing, the
 	 * transactional versions should be loaded.
@@ -885,11 +894,6 @@ static long restore_tm_user_regs(struct
 	current->thread.tm_texasr |= TEXASR_FS;
 	/* This loads the checkpointed FP/VEC state, if used */
 	tm_recheckpoint(&current->thread, msr);
-	/* Get the top half of the MSR */
-	if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
-		return 1;
-	/* Pull in MSR TM from user context */
-	regs->msr = (regs->msr & ~MSR_TS_MASK) | ((msr_hi<<32) & MSR_TS_MASK);
 
 	/* This loads the speculative FP/VEC state, if used */
 	if (msr & MSR_FP) {
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -428,6 +428,10 @@ static long restore_tm_sigcontexts(struc
 
 	/* get MSR separately, transfer the LE bit if doing signal return */
 	err |= __get_user(msr, &sc->gp_regs[PT_MSR]);
+	/* Don't allow reserved mode. */
+	if (MSR_TM_RESV(msr))
+		return -EINVAL;
+
 	/* pull in MSR TM from user context */
 	regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.14 00/59] 3.14.60-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 18/59] ALSA: timer: Fix double unlink of active_list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 42/59] ipv6: update skb->csum when CE mark is propagated Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 45/59] team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 05/59] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 08/59] ALSA: hda - Add Intel Lewisburg device IDs Audio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 22/59] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 02/59] xen/gntdev: Grant maps should not be subject to NUMA balancing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 03/59] x86/xen: dont reset vcpu_info on a cancelled suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 27/59] usb: xhci: fix config fail of FS hub behind a HS hub with MTT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 26/59] ASoC: compress: Fix compress device direction check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 24/59] ASoC: wm8974: set cache type for regmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 40/59] bonding: Prevent IPv6 link local address on enslaved devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 21/59] ALSA: hrtimer: Fix stall by hrtimer_cancel() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 07/59] ipmi: move timer init to before irq is setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 41/59] phonet: properly unshare skbs in phonet_rcv() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 04/59] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 20/59] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 28/59] USB: ipaq.c: fix a timeout loop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 30/59] xhci: refuse loading if nousb is used Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 52/59] arm64: fix building without CONFIG_UID16 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 19/59] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 09/59] ALSA: hda - Apply pin fixup for HP ProBook 6550b Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 53/59] arm64: Clear out any singlestep state on a ptrace detach operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 49/59] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 43/59] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 39/59] tcp_yeah: dont set ssthresh below 2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 46/59] powerpc/tm: Block signal return setting invalid MSR state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 06/59] x86/boot: Double BOOT_HEAP_SIZE to 64KB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 51/59] arm64: KVM: Fix AArch32 to AArch64 register mapping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
  [PATCH 3.14 11/59] ALSA: hda - Add inverted dmic for Packard Bell DOTS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 14/59] ALSA: seq: Fix missing NULL check at remove_events ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 23/59] ASoC: wm8962: correct addresses for HPF_C_0/1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 16/59] ALSA: timer: Harden slave timer list handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 17/59] ALSA: timer: Fix race among timer ioctls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 25/59] ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 10/59] ALSA: rme96: Fix unexpected volume reset after rate changes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 13/59] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 01/59] x86/signal: Fix restart_syscall number for x32 tasks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 12/59] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 15/59] ALSA: seq: Fix race at timer setup and close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
  [PATCH 3.14 32/59] ipv6/addrlabel: fix ip6addrlbl_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.14 59/59] arm64: restore bogomips information in /proc/cpuinfo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.14 38/59] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
  [PATCH 3.14 29/59] USB: cp210x: add ID for ELV Marble Sound Board 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.14 35/59] unix: properly account for FDs passed over unix sockets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.14 34/59] connector: bump skb->users before callback invocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.14 36/59] bridge: Only call /sbin/bridge-stp for the initial network namespace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.14 58/59] mn10300: Select CONFIG_HAVE_UID16 to fix build failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.14 37/59] net: possible use after free in dst_release Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
  [PATCH 3.14 33/59] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100

csiph-web