Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1230785

[PATCH 3.13.y-ckt 49/57] sparc64: Fix userspace FPU register corruptions.

From Kamal Mostafa <kamal@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.13.y-ckt 49/57] sparc64: Fix userspace FPU register corruptions.
Date 2015-09-22 21:00 +0200
Message-ID <qbAXi-5tC-67@gated-at.bofh.it> (permalink)
References <qbzRv-3UF-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


3.13.11-ckt27 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: "David S. Miller" <davem@davemloft.net>

[ Upstream commit 44922150d87cef616fd183220d43d8fde4d41390 ]

If we have a series of events from userpsace, with %fprs=FPRS_FEF,
like follows:

ETRAP
	ETRAP
		VIS_ENTRY(fprs=0x4)
		VIS_EXIT
		RTRAP (kernel FPU restore with fpu_saved=0x4)
	RTRAP

We will not restore the user registers that were clobbered by the FPU
using kernel code in the inner-most trap.

Traps allocate FPU save slots in the thread struct, and FPU using
sequences save the "dirty" FPU registers only.

This works at the initial trap level because all of the registers
get recorded into the top-level FPU save area, and we'll return
to userspace with the FPU disabled so that any FPU use by the user
will take an FPU disabled trap wherein we'll load the registers
back up properly.

But this is not how trap returns from kernel to kernel operate.

The simplest fix for this bug is to always save all FPU register state
for anything other than the top-most FPU save area.

Getting rid of the optimized inner-slot FPU saving code ends up
making VISEntryHalf degenerate into plain VISEntry.

Longer term we need to do something smarter to reinstate the partial
save optimizations.  Perhaps the fundament error is having trap entry
and exit allocate FPU save slots and restore register state.  Instead,
the VISEntry et al. calls should be doing that work.

This bug is about two decades old.

Reported-by: James Y Knight <jyknight@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/sparc/include/asm/visasm.h | 16 +++-------
 arch/sparc/lib/NG4memcpy.S      |  5 ++-
 arch/sparc/lib/VISsave.S        | 67 ++---------------------------------------
 arch/sparc/lib/ksyms.c          |  4 ---
 4 files changed, 11 insertions(+), 81 deletions(-)

diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
index 11fdf0e..50d6f16 100644
--- a/arch/sparc/include/asm/visasm.h
+++ b/arch/sparc/include/asm/visasm.h
@@ -28,16 +28,10 @@
  * Must preserve %o5 between VISEntryHalf and VISExitHalf */
 
 #define VISEntryHalf					\
-	rd		%fprs, %o5;			\
-	andcc		%o5, FPRS_FEF, %g0;		\
-	be,pt		%icc, 297f;			\
-	 sethi		%hi(298f), %g7;			\
-	sethi		%hi(VISenterhalf), %g1;		\
-	jmpl		%g1 + %lo(VISenterhalf), %g0;	\
-	 or		%g7, %lo(298f), %g7;		\
-	clr		%o5;				\
-297:	wr		%o5, FPRS_FEF, %fprs;		\
-298:
+	VISEntry
+
+#define VISExitHalf					\
+	VISExit
 
 #define VISEntryHalfFast(fail_label)			\
 	rd		%fprs, %o5;			\
@@ -47,7 +41,7 @@
 	ba,a,pt		%xcc, fail_label;		\
 297:	wr		%o5, FPRS_FEF, %fprs;
 
-#define VISExitHalf					\
+#define VISExitHalfFast					\
 	wr		%o5, 0, %fprs;
 
 #ifndef __ASSEMBLY__
diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 140527a..83aeeb1 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -240,8 +240,11 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	add		%o0, 0x40, %o0
 	bne,pt		%icc, 1b
 	 LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
+#ifdef NON_USER_COPY
+	VISExitHalfFast
+#else
 	VISExitHalf
-
+#endif
 	brz,pn		%o2, .Lexit
 	 cmp		%o2, 19
 	ble,pn		%icc, .Lsmall_unaligned
diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S
index b320ae9..a063d84 100644
--- a/arch/sparc/lib/VISsave.S
+++ b/arch/sparc/lib/VISsave.S
@@ -44,9 +44,8 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
 
 	 stx		%g3, [%g6 + TI_GSR]
 2:	add		%g6, %g1, %g3
-	cmp		%o5, FPRS_DU
-	be,pn		%icc, 6f
-	 sll		%g1, 3, %g1
+	mov		FPRS_DU | FPRS_DL | FPRS_FEF, %o5
+	sll		%g1, 3, %g1
 	stb		%o5, [%g3 + TI_FPSAVED]
 	rd		%gsr, %g2
 	add		%g6, %g1, %g3
@@ -80,65 +79,3 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
 	.align		32
 80:	jmpl		%g7 + %g0, %g0
 	 nop
-
-6:	ldub		[%g3 + TI_FPSAVED], %o5
-	or		%o5, FPRS_DU, %o5
-	add		%g6, TI_FPREGS+0x80, %g2
-	stb		%o5, [%g3 + TI_FPSAVED]
-
-	sll		%g1, 5, %g1
-	add		%g6, TI_FPREGS+0xc0, %g3
-	wr		%g0, FPRS_FEF, %fprs
-	membar		#Sync
-	stda		%f32, [%g2 + %g1] ASI_BLK_P
-	stda		%f48, [%g3 + %g1] ASI_BLK_P
-	membar		#Sync
-	ba,pt		%xcc, 80f
-	 nop
-
-	.align		32
-80:	jmpl		%g7 + %g0, %g0
-	 nop
-
-	.align		32
-VISenterhalf:
-	ldub		[%g6 + TI_FPDEPTH], %g1
-	brnz,a,pn	%g1, 1f
-	 cmp		%g1, 1
-	stb		%g0, [%g6 + TI_FPSAVED]
-	stx		%fsr, [%g6 + TI_XFSR]
-	clr		%o5
-	jmpl		%g7 + %g0, %g0
-	 wr		%g0, FPRS_FEF, %fprs
-
-1:	bne,pn		%icc, 2f
-	 srl		%g1, 1, %g1
-	ba,pt		%xcc, vis1
-	 sub		%g7, 8, %g7
-2:	addcc		%g6, %g1, %g3
-	sll		%g1, 3, %g1
-	andn		%o5, FPRS_DU, %g2
-	stb		%g2, [%g3 + TI_FPSAVED]
-
-	rd		%gsr, %g2
-	add		%g6, %g1, %g3
-	stx		%g2, [%g3 + TI_GSR]
-	add		%g6, %g1, %g2
-	stx		%fsr, [%g2 + TI_XFSR]
-	sll		%g1, 5, %g1
-3:	andcc		%o5, FPRS_DL, %g0
-	be,pn		%icc, 4f
-	 add		%g6, TI_FPREGS, %g2
-
-	add		%g6, TI_FPREGS+0x40, %g3
-	membar		#Sync
-	stda		%f0, [%g2 + %g1] ASI_BLK_P
-	stda		%f16, [%g3 + %g1] ASI_BLK_P
-	membar		#Sync
-	ba,pt		%xcc, 4f
-	 nop
-
-	.align		32
-4:	and		%o5, FPRS_DU, %o5
-	jmpl		%g7 + %g0, %g0
-	 wr		%o5, FPRS_FEF, %fprs
diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
index 323335b..ac094de 100644
--- a/arch/sparc/lib/ksyms.c
+++ b/arch/sparc/lib/ksyms.c
@@ -126,10 +126,6 @@ EXPORT_SYMBOL(copy_user_page);
 void VISenter(void);
 EXPORT_SYMBOL(VISenter);
 
-/* CRYPTO code needs this */
-void VISenterhalf(void);
-EXPORT_SYMBOL(VISenterhalf);
-
 extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
 extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
 		unsigned long *);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt27 stable review Kamal Mostafa <kamal@canonical.com> - 2015-09-22 19:50 +0200
  [PATCH 3.13.y-ckt 15/57] target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT Kamal Mostafa <kamal@canonical.com> - 2015-09-22 19:50 +0200
  [PATCH 3.13.y-ckt 12/57] xen-blkback: replace work_pending with work_busy in purge_persistent_gnt() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 19:50 +0200
  [PATCH 3.13.y-ckt 16/57] rbd: fix copyup completion race Kamal Mostafa <kamal@canonical.com> - 2015-09-22 19:50 +0200
  [PATCH 3.13.y-ckt 57/57] net: gso: use feature flag argument in all protocol gso handlers Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 50/57] ipv6: lock socket in ip6_datagram_connect() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 47/57] rds: fix an integer overflow test in rds_info_getsockopt() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 53/57] net: pktgen: fix race between pktgen_thread_worker() and kthread_stop() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 54/57] net: call rcu_read_lock early in process_backlog Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 52/57] net/tipc: initialize security state for new connection socket Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 40/57] ipc/sem.c: update/correct memory barriers Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 21/57] perf: Fix fasync handling on inherited events Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 51/57] rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 56/57] netlink: don't hold mutex in rcu callback when releasing mmapd ring Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 48/57] udp: fix dst races with multicast early demux Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:00 +0200
  [PATCH 3.13.y-ckt 49/57] sparc64: Fix userspace FPU register corruptions. Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:00 +0200
  [PATCH 3.13.y-ckt 44/57] ip6_gre: release cached dst on tunnel removal Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:00 +0200
  [PATCH 3.13.y-ckt 46/57] net: Fix skb_set_peeked use-after-free bug Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:00 +0200
  [PATCH 3.13.y-ckt 39/57] ipc/sem.c: change memory barrier in sem_lock() to smp_rmb() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 43/57] batman-adv: protect tt_local_entry from concurrent delete events Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 36/57] crypto: caam - fix memory corruption in ahash_final_ctx Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 32/57] libiscsi: Fix host busy blocking during connection teardown Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 24/57] ipc: modify message queue accounting to not take kernel data structures into account Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 42/57] arm64: KVM: Fix host crash when injecting a fault into a 32bit guest Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 35/57] EDAC, ppc4xx: Access mci->csrows array elements properly Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 33/57] libfc: Fix fc_exch_recv_req() error path Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 38/57] ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 37/57] mm/hwpoison: fix page refcount of unknown non LRU page Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 25/57] ocfs2: fix BUG in ocfs2_downconvert_thread_do_work() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 17/57] md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 45/57] net: Fix RCU splat in af_key Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 34/57] libfc: Fix fc_fcp_cleanup_each_cmd() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 41/57] Add factory recertified Crucial M500s to blacklist Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 04/57] virtio-net: drop NETIF_F_FRAGLIST Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 14/57] regmap: regcache-rbtree: Clean new present bits on present bitmap resize Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 27/57] KVM: x86: Use adjustment in guest cycles when handling MSR_IA32_TSC_ADJUST Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 05/57] RDS: verify the underlying transport exists before creating a connection Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 07/57] xen/gntdevt: Fix race condition in gntdev_release() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 13/57] USB: sierra: add 1199:68AB device ID Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 31/57] drm/radeon: add new OLAND pci id Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 10/57] crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 29/57] dm thin metadata: delete btrees when releasing metadata snapshot Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 20/57] xhci: fix off by one error in TRB DMA address boundary check Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 30/57] dm btree: add ref counting ops for the leaves of top level btrees Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 18/57] target: REPORT LUNS should return LUN 0 even for dynamic ACLs Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 02/57] md: flush ->event_work before stopping array. Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 03/57] ipv6: addrconf: validate new MTU before applying it Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 22/57] mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 19/57] MIPS: Fix sched_getaffinity with MT FPAFF enabled Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 28/57] localmodconfig: Use Kbuild files too Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 09/57] nfsd: Drop BUG_ON and ignore SECLABEL on absent filesystem Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 11/57] xen-blkfront: don't add indirect pages to list when !feature_persistent Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 08/57] PCI: Restore PCI_MSIX_FLAGS_BIRMASK definition Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 23/57] MIPS: Make set_pte() SMP safe. Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 26/57] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200

csiph-web