powerpc/tm: Avoid possible userspace r1 corruption on reclaim [Linux 3.18.125]

This Linux kernel change "powerpc/tm: Avoid possible userspace r1 corruption on reclaim" is included in the Linux 3.18.125 release. This change is authored by Michael Neuling <mikey [at] neuling.org> on Tue Sep 25 19:36:47 2018 +1000. The commit for this change in Linux stable tree is d623e25 (patch) which is from upstream commit 96dc89d. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream 96dc89d.

powerpc/tm: Avoid possible userspace r1 corruption on reclaim

[ Upstream commit 96dc89d526ef77604376f06220e3d2931a0bfd58 ]

Current we store the userspace r1 to PACATMSCRATCH before finally
saving it to the thread struct.

In theory an exception could be taken here (like a machine check or
SLB miss) that could write PACATMSCRATCH and hence corrupt the
userspace r1. The SLB fault currently doesn't touch PACATMSCRATCH, but
others do.

We've never actually seen this happen but it's theoretically
possible. Either way, the code is fragile as it is.

This patch saves r1 to the kernel stack (which can't fault) before we
turn MSR[RI] back on. PACATMSCRATCH is still used but only with
MSR[RI] off. We then copy r1 from the kernel stack to the thread
struct once we have MSR[RI] back on.

Suggested-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There are 9 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 arch/powerpc/kernel/tm.S | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index 8a627cc..6f7b2b9 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -202,6 +202,13 @@ dont_backup_fp:
    std r11, GPR11(r1)          /* Temporary stash */

+    * Move the saved user r1 to the kernel stack in case PACATMSCRATCH is
+    * clobbered by an exception once we turn on MSR_RI below.
+    */
+   ld  r11, PACATMSCRATCH(r13)
+   std r11, GPR1(r1)
+   /*
     * Store r13 away so we can free up the scratch SPR for the SLB fault
     * handler (needed once we start accessing the thread_struct).
@@ -237,7 +244,7 @@ dont_backup_fp:
    SAVE_GPR(8, r7)             /* user r8 */
    SAVE_GPR(9, r7)             /* user r9 */
    SAVE_GPR(10, r7)            /* user r10 */
-   ld  r3, PACATMSCRATCH(r13)      /* user r1 */
+   ld  r3, GPR1(r1)            /* user r1 */
    ld  r4, GPR7(r1)            /* user r7 */
    ld  r5, GPR11(r1)           /* user r11 */
    ld  r6, GPR12(r1)           /* user r12 */

Leave a Reply

Your email address will not be published. Required fields are marked *