[PATCH 3.2 040/126] powerpc/64: Fix incorrect return value from __copy_tofrom_user

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	[PATCH 3.2 040/126] powerpc/64: Fix incorrect return value from __copy_tofrom_user
Date	2017-02-16 01:40 +0100
Message-ID	<tbih4-768-37@gated-at.bofh.it> (permalink)
References	<tbgIi-5XZ-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.2.85-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Mackerras <paulus@ozlabs.org>

commit 1a34439e5a0b2235e43f96816dbb15ee1154f656 upstream.

Debugging a data corruption issue with virtio-net/vhost-net led to
the observation that __copy_tofrom_user was occasionally returning
a value 16 larger than it should.  Since the return value from
__copy_tofrom_user is the number of bytes not copied, this means
that __copy_tofrom_user can occasionally return a value larger
than the number of bytes it was asked to copy.  In turn this can
cause higher-level copy functions such as copy_page_to_iter_iovec
to corrupt memory by copying data into the wrong memory locations.

It turns out that the failing case involves a fault on the store
at label 79, and at that point the first unmodified byte of the
destination is at R3 + 16.  Consequently the exception handler
for that store needs to add 16 to R3 before using it to work out
how many bytes were not copied, but in this one case it was not
adding the offset to R3.  To fix it, this moves the label 179 to
the point where we add 16 to R3.  I have checked manually all the
exception handlers for the loads and stores in this code and the
rest of them are correct (it would be excellent to have an
automated test of all the exception cases).

This bug has been present since this code was initially
committed in May 2002 to Linux version 2.5.20.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/powerpc/lib/copyuser_64.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/lib/copyuser_64.S
+++ b/arch/powerpc/lib/copyuser_64.S
@@ -330,6 +330,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_
 	addi	r3,r3,8
 171:
 177:
+179:
 	addi	r3,r3,8
 370:
 372:
@@ -344,7 +345,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_
 173:
 174:
 175:
-179:
 181:
 184:
 186:

Thread

[PATCH 3.2 000/126] 3.2.85-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 111/126] lockdep: Silence warning if CONFIG_LOCKDEP  isn't set Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 095/126] locking/rtmutex: Prevent dequeue vs. unlock race Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 057/126] scsi: arcmsr: Send SYNCHRONIZE_CACHE command  to firmware Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 110/126] perf: Fix perf_event_for_each() to use sibling Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 098/126] net: ping: check minimum size on ICMP header  length Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
  [PATCH 3.2 114/126] perf/core: Fix concurrent sys_perf_event_open()  vs. 'move_group' race Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:40 +0100
    Re: [PATCH 3.2 114/126] perf/core: Fix concurrent  sys_perf_event_open() vs. 'move_group' race Ben Hutchings <ben@decadent.org.uk> - 2017-02-21 01:50 +0100
  [PATCH 3.2 085/126] Fix USB CB/CBI storage devices with  CONFIG_VMAP_STACK=y Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 124/126] sg_write()/bsg_write() is not fit to be  called under KERNEL_DS Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 053/126] scsi: megaraid_sas: Fix data integrity  failure for JBOD (passthrough) devices Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 112/126] perf: Fix event->ctx locking Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 089/126] IB/uverbs: Fix leak of XRC target QPs Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 00:50 +0100
  [PATCH 3.2 037/126] fuse: fix killing s[ug]id in setattr Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 026/126] net/mlx4_core: Fix deadlock when switching  between polling and event fw commands Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 047/126] ubifs: Abort readdir upon error Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 003/126] zfcp: fix ELS/GS request&response length for  hardware data router Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 065/126] ubifs: Fix regression in ubifs_readdir() Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 046/126] ubifs: Fix xattr_names length in exit paths Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 039/126] crypto: gcm - Fix IV buffer size in  crypto_gcm_setkey Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 015/126] [media] mb86a20s: fix the locking logic Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 049/126] batman-adv: fix splat on disabling an interface Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
    Re: [PATCH 3.2 049/126] batman-adv: fix splat on disabling an  interface Linus Lüssing <linus.luessing@c0d3.blue> - 2017-02-16 08:00 +0100
      Re: [PATCH 3.2 049/126] batman-adv: fix splat on disabling an  interface Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 17:10 +0100
  [PATCH 3.2 005/126] zfcp: retain trace level for SCSI and HBA FSF  response records Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 032/126] powerpc/vdso64: Use double word compare on  pointers Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 027/126] ALSA: usb-audio: Extend DragonFly dB scale  quirk to cover other variants Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 061/126] vt: clear selection before resizing Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 040/126] powerpc/64: Fix incorrect return value from  __copy_tofrom_user Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 044/126] isofs: Do not return EACCES for unknown  filesystems Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 030/126] USB: serial: cp210x: Add ID for a Juniper console Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 034/126] s390/con3270: fix use of uninitialised data Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 016/126] [media] cx231xx: don't return error on success Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 033/126] ext4: release bh in make_indexed_dir Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 035/126] s390/con3270: fix insufficient space padding Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 024/126] ALSA: ali5451: Fix out-of-bound position  reporting Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:40 +0100
  [PATCH 3.2 010/126] zfcp: fix payload trace length for SAN  request&response Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 028/126] regulator: tps65910: Work around silicon  erratum SWCZ010 Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 008/126] zfcp: restore tracing of handle for port and  LUN with HBA records Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 022/126] scsi: ibmvfc: Fix I/O hang when port is not  mapped Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 004/126] zfcp: close window with unblocked rport  during rport gone Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 017/126] [media] cx231xx: fix GPIOs for Pixelview  SBTVD hybrid Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 029/126] mmc: block: don't use CMD23 with very old MMC  cards Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 014/126] rtlwifi: Fix missing country code for Great  Britain Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 011/126] zfcp: trace full payload of all SAN records  (req,resp,iels) Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 002/126] zfcp: fix fc_host port_type with NPIV Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 013/126] rtlwifi: Update regulatory database Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 006/126] zfcp: restore: Dont use 0 to indicate invalid  LUN in rec trace Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 009/126] zfcp: fix D_ID field with actual value on  tracing SAN responses Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 025/126] usb: misc: legousbtower: Fix NULL pointer  deference Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 038/126] fuse: listxattr: verify xattr list Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 043/126] scsi: zfcp: spin_lock_irqsave() is not nestable Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 036/126] fuse: invalidate dir dentry after chmod Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  [PATCH 3.2 019/126] reiserfs: Unlock superblock before calling  reiserfs_quota_on_mount() Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 01:50 +0100
  Re: [PATCH 3.2 000/126] 3.2.85-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-02-16 07:10 +0100
    Re: [PATCH 3.2 000/126] 3.2.85-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-02-16 17:00 +0100

csiph-web