Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1620425

[PATCH 4.10 039/110] metag/usercopy: Fix src fixup in from user rapf loops

Show all headers | View raw

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Hogan <james.hogan@imgtec.com>

commit 2c0b1df88b987a12d95ea1d6beaf01894f3cc725 upstream.

The fixup code to rewind the source pointer in
__asm_copy_from_user_{32,64}bit_rapf_loop() always rewound the source by
a single unit (4 or 8 bytes), however this is insufficient if the fault
didn't occur on the first load in the loop, as the source pointer will
have been incremented but nothing will have been stored until all 4
register [pairs] are loaded.

Read the LSM_STEP field of TXSTATUS (which is already loaded into a
register), a bit like the copy_to_user versions, to determine how many
iterations of MGET[DL] have taken place, all of which need rewinding.

Fixes: 373cd784d0fc ("metag: Memory handling")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/metag/lib/usercopy.c |   36 ++++++++++++++++++++++++++++--------
 1 file changed, 28 insertions(+), 8 deletions(-)

--- a/arch/metag/lib/usercopy.c
+++ b/arch/metag/lib/usercopy.c
@@ -687,29 +687,49 @@ EXPORT_SYMBOL(__copy_user);
  *
  *	Rationale:
  *		A fault occurs while reading from user buffer, which is the
- *		source. Since the fault is at a single address, we only
- *		need to rewind by 8 bytes.
+ *		source.
  *		Since we don't write to kernel buffer until we read first,
  *		the kernel buffer is at the right state and needn't be
- *		corrected.
+ *		corrected, but the source must be rewound to the beginning of
+ *		the block, which is LSM_STEP*8 bytes.
+ *		LSM_STEP is bits 10:8 in TXSTATUS which is already read
+ *		and stored in D0Ar2
+ *
+ *		NOTE: If a fault occurs at the last operation in M{G,S}ETL
+ *			LSM_STEP will be 0. ie: we do 4 writes in our case, if
+ *			a fault happens at the 4th write, LSM_STEP will be 0
+ *			instead of 4. The code copes with that.
  */
 #define __asm_copy_from_user_64bit_rapf_loop(to, from, ret, n, id)	\
 	__asm_copy_user_64bit_rapf_loop(to, from, ret, n, id,		\
-		"SUB	%1, %1, #8\n")
+		"LSR	D0Ar2, D0Ar2, #5\n"				\
+		"ANDS	D0Ar2, D0Ar2, #0x38\n"				\
+		"ADDZ	D0Ar2, D0Ar2, #32\n"				\
+		"SUB	%1, %1, D0Ar2\n")
 
 /*	rewind 'from' pointer when a fault occurs
  *
  *	Rationale:
  *		A fault occurs while reading from user buffer, which is the
- *		source. Since the fault is at a single address, we only
- *		need to rewind by 4 bytes.
+ *		source.
  *		Since we don't write to kernel buffer until we read first,
  *		the kernel buffer is at the right state and needn't be
- *		corrected.
+ *		corrected, but the source must be rewound to the beginning of
+ *		the block, which is LSM_STEP*4 bytes.
+ *		LSM_STEP is bits 10:8 in TXSTATUS which is already read
+ *		and stored in D0Ar2
+ *
+ *		NOTE: If a fault occurs at the last operation in M{G,S}ETL
+ *			LSM_STEP will be 0. ie: we do 4 writes in our case, if
+ *			a fault happens at the 4th write, LSM_STEP will be 0
+ *			instead of 4. The code copes with that.
  */
 #define __asm_copy_from_user_32bit_rapf_loop(to, from, ret, n, id)	\
 	__asm_copy_user_32bit_rapf_loop(to, from, ret, n, id,		\
-		"SUB	%1, %1, #4\n")
+		"LSR	D0Ar2, D0Ar2, #6\n"				\
+		"ANDS	D0Ar2, D0Ar2, #0x1c\n"				\
+		"ADDZ	D0Ar2, D0Ar2, #16\n"				\
+		"SUB	%1, %1, D0Ar2\n")
 
 
 /*

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.10 000/110] 4.10.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 026/110] ACPI / scan: Prefer devices without _HID for _ADR matching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 011/110] arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 039/110] metag/usercopy: Fix src fixup in from user rapf loops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 020/110] mm/page_alloc.c: fix print order in show_free_areas() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 001/110] drm/vmwgfx: Type-check lookups of fence objects Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 022/110] dax: fix radix tree insertion race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 028/110] jump label: fix passing kbuild_cflags when checking for asm goto support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 032/110] mac80211: unconditionally start new netdev queues with iTXQ support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 024/110] dm verity fec: fix bufio leaks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 031/110] ring-buffer: Fix return value check in test_ringbuffer() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 014/110] iio: core: Fix IIO_VAL_FRACTIONAL_LOG2 for negative values Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  [PATCH 4.10 033/110] brcmfmac: use local iftype avoiding use-after-free of virtual interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:20 +0200
  Re: [PATCH 4.10 000/110] 4.10.10-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-10 22:40 +0200
    Re: [PATCH 4.10 000/110] 4.10.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 07:00 +0200
  Re: [PATCH 4.10 000/110] 4.10.10-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-11 05:20 +0200
    Re: [PATCH 4.10 000/110] 4.10.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 06:50 +0200
      Re: [PATCH 4.10 000/110] 4.10.10-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-11 07:10 +0200
  Re: [PATCH 4.10 000/110] 4.10.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 07:10 +0200

csiph-web