01 Jan, 2016

3 commits


30 Dec, 2015

5 commits

  • Merge misc fixes from Andrew Morton:
    "9 fixes"

    * emailed patches from Andrew Morton :
    mm/vmstat: fix overflow in mod_zone_page_state()
    ocfs2/dlm: clear migration_pending when migration target goes down
    mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone()
    ocfs2: fix flock panic issue
    m32r: add io*_rep helpers
    m32r: fix build failure
    arch/x86/xen/suspend.c: include xen/xen.h
    mm: memcontrol: fix possible memcg leak due to interrupted reclaim
    ocfs2: fix BUG when calculate new backup super

    Linus Torvalds
     
  • m32r allmodconfig was failing with the error:

    error: implicit declaration of function 'read'

    On checking io.h it turned out that 'read' is not defined but 'readb' is
    defined and 'ioread8' will then obviously mean 'readb'.

    At the same time some of the helper functions ioreadN_rep() and
    iowriteN_rep() were missing which also led to the build failure.

    Signed-off-by: Sudip Mukherjee
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Sudip Mukherjee
     
  • m32r allmodconfig is failing with:

    In file included from ../include/linux/kvm_para.h:4:0,
    from ../kernel/watchdog.c:26:
    ../include/uapi/linux/kvm_para.h:30:26: fatal error: asm/kvm_para.h: No such file or directory

    kvm_para.h was not included in the build.

    Signed-off-by: Sudip Mukherjee
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Sudip Mukherjee
     
  • Fix the build warning:

    arch/x86/xen/suspend.c: In function 'xen_arch_pre_suspend':
    arch/x86/xen/suspend.c:70:9: error: implicit declaration of function 'xen_pv_domain' [-Werror=implicit-function-declaration]
    if (xen_pv_domain())
    ^

    Reported-by: kbuild test robot
    Cc: Sasha Levin
    Cc: Konrad Rzeszutek Wilk
    Cc: Boris Ostrovsky
    Cc: David Vrabel
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     
  • Cc: stable@vger.kernel.org # 3.15+
    Reviewed-by: Jeff Layton
    Signed-off-by: Al Viro

    Al Viro
     

28 Dec, 2015

3 commits

  • Pull MIPS fixes from Ralf Baechle:

    - Fix bitrot in __get_user_unaligned()
    - EVA userspace accessor bug fixes.
    - Fix for build issues with certain toolchains.
    - Fix build error for VDSO with particular toolchain versions.
    - Fix build error due to a variable that should have been removed by an
    earlier patch

    * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
    MIPS: Fix bitrot in __get_user_unaligned()
    MIPS: Fix build error due to unused variables.
    MIPS: VDSO: Fix build error
    MIPS: CPS: drop .set mips64r2 directives
    MIPS: uaccess: Take EVA into account in [__]clear_user
    MIPS: uaccess: Take EVA into account in __copy_from_user()
    MIPS: uaccess: Fix strlen_user with EVA

    Linus Torvalds
     
  • Pull ARM SoC fixes from Olof Johansson:
    "A smallish set of fixes that we've been sitting on for a while now,
    flushing the queue here so they go in. Summary:

    A handful of fixes for OMAP, i.MX, Allwinner and Tegra:

    - A clock rate and a PHY setup fix for i.MX6Q/DL
    - A couple of fixes for the reduced serial bus (sunxi-rsb) on
    Allwinner
    - UART wakeirq fix for an OMAP4 board, timer config fixes for AM43XX.
    - Suspend fix for Tegra124 Chromebooks
    - Fix for missing implicit include that's different between
    ARM/ARM64"

    * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
    ARM: tegra: Fix suspend hang on Tegra124 Chromebooks
    bus: sunxi-rsb: Fix peripheral IC mapping runtime address
    bus: sunxi-rsb: Fix primary PMIC mapping hardware address
    ARM: dts: Fix UART wakeirq for omap4 duovero parlor
    ARM: OMAP2+: AM43xx: select ARM TWD timer
    ARM: OMAP2+: am43xx: enable GENERIC_CLOCKEVENTS_BROADCAST
    fsl-ifc: add missing include on ARM64
    ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
    ARM: dts: imx: Fix the assigned-clock mismatch issue on imx6q/dl
    bus: sunxi-rsb: unlock on error in sunxi_rsb_read()
    ARM: dts: sunxi: sun6i-a31s-primo81.dts: add touchscreen axis swapping property

    Linus Torvalds
     
  • Signed-off-by: Al Viro
    Signed-off-by: Ralf Baechle

    Al Viro
     

27 Dec, 2015

1 commit

  • Pull ARC fixes from Vineet Gupta:
    "Sorry for this late pull request, but these are all important fixes
    for code introduced/updated in this release which we will otherwise
    end up back porting.

    - Unwinder rework (A revert followed by better fix)
    - Build errors: MMUv2, modules with -Os
    - highmem section mismatch build splat"

    * tag 'arc-4.4-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
    ARC: dw2 unwind: Catch Dwarf SNAFUs early
    ARC: dw2 unwind: Don't bail for CIE.version != 1
    Revert "ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing"
    ARC: Fix linking errors with CONFIG_MODULE + CONFIG_CC_OPTIMIZE_FOR_SIZE
    ARC: mm: fix building for MMU v2
    ARC: mm: HIGHMEM: Fix section mismatch splat

    Linus Torvalds
     

26 Dec, 2015

2 commits

  • Pull parisc system call restart fix from Helge Deller:
    "The architectural design of parisc always uses two instructions to
    call kernel syscalls (delayed branch feature). This means that the
    instruction following the branch (located in the delay slot of the
    branch instruction) is executed before control passes to the branch
    destination.

    Depending on which assembler instruction and how it is used in
    usersapce in the delay slot, this sometimes made restarted syscalls
    like futex() and poll() failing with -ENOSYS"

    * 'parisc-4.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
    parisc: Fix syscall restarts

    Linus Torvalds
     
  • Pull sparc fixes from David Miller:

    1) Finally make perf stack backtraces stable on sparc, several problems
    (mostly due to the context in which the user copies from the stack
    are done) contributed to this.

    From Rob Gardner.

    2) Export ADI capability if the cpu supports it.

    3) Hook up userfaultfd system call.

    4) When faults happen during user copies we really have to clean up and
    restore the FPU state fully. Also from Rob Gardner

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
    tty/serial: Skip 'NULL' char after console break when sysrq enabled
    sparc64: fix FP corruption in user copy functions
    sparc64: Perf should save/restore fault info
    sparc64: Ensure perf can access user stacks
    sparc64: Don't set %pil in rtrap_nmi too early
    sparc64: Add ADI capability to cpu capabilities
    tty: serial: constify sunhv_ops structs
    sparc: Hook up userfaultfd system call

    Linus Torvalds
     

25 Dec, 2015

5 commits

  • Short story: Exception handlers used by some copy_to_user() and
    copy_from_user() functions do not diligently clean up floating point
    register usage, and this can result in a user process seeing invalid
    values in floating point registers. This sometimes makes the process
    fail.

    Long story: Several cpu-specific (NG4, NG2, U1, U3) memcpy functions
    use floating point registers and VIS alignaddr/faligndata to
    accelerate data copying when source and dest addresses don't align
    well. Linux uses a lazy scheme for saving floating point registers; It
    is not done upon entering the kernel since it's a very expensive
    operation. Rather, it is done only when needed. If the kernel ends up
    not using FP regs during the course of some trap or system call, then
    it can return to user space without saving or restoring them.

    The various memcpy functions begin their FP code with VISEntry (or a
    variation thereof), which saves the FP regs. They conclude their FP
    code with VISExit (or a variation) which essentially marks the FP regs
    "clean", ie, they contain no unsaved values. fprs.FPRS_FEF is turned
    off so that a lazy restore will be triggered when/if the user process
    accesses floating point regs again.

    The bug is that the user copy variants of memcpy, copy_from_user() and
    copy_to_user(), employ an exception handling mechanism to detect faults
    when accessing user space addresses, and when this handler is invoked,
    an immediate return from the function is forced, and VISExit is not
    executed, thus leaving the fprs register in an indeterminate state,
    but often with fprs.FPRS_FEF set and one or more dirty bits. This
    results in a return to user space with invalid values in the FP regs,
    and since fprs.FPRS_FEF is on, no lazy restore occurs.

    This bug affects copy_to_user() and copy_from_user() for NG4, NG2,
    U3, and U1. All are fixed by using a new exception handler for those
    loads and stores that are done during the time between VISEnter and
    VISExit.

    n.b. In NG4memcpy, the problematic code can be triggered by a copy
    size greater than 128 bytes and an unaligned source address. This bug
    is known to be the cause of random user process memory corruptions
    while perf is running with the callgraph option (ie, perf record -g).
    This occurs because perf uses copy_from_user() to read user stacks,
    and may fault when it follows a stack frame pointer off to an
    invalid page. Validation checks on the stack address just obscure
    the underlying problem.

    Signed-off-by: Rob Gardner
    Signed-off-by: Dave Aldridge
    Signed-off-by: David S. Miller

    Rob Gardner
     
  • There have been several reports of random processes being killed with
    a bus error or segfault during userspace stack walking in perf. One
    of the root causes of this problem is an asynchronous modification to
    thread_info fault_address and fault_code, which stems from a perf
    counter interrupt arriving during kernel processing of a "benign"
    fault, such as a TSB miss. Since perf_callchain_user() invokes
    copy_from_user() to read user stacks, a fault is not only possible,
    but probable. Validity checks on the stack address merely cover up the
    problem and reduce its frequency.

    The solution here is to save and restore fault_address and fault_code
    in perf_callchain_user() so that the benign fault handler is not
    disturbed by a perf interrupt.

    Signed-off-by: Rob Gardner
    Signed-off-by: Dave Aldridge
    Signed-off-by: David S. Miller

    Rob Gardner
     
  • When an interrupt (such as a perf counter interrupt) is delivered
    while executing in user space, the trap entry code puts ASI_AIUS in
    %asi so that copy_from_user() and copy_to_user() will access the
    correct memory. But if a perf counter interrupt is delivered while the
    cpu is already executing in kernel space, then the trap entry code
    will put ASI_P in %asi, and this will prevent copy_from_user() from
    reading any useful stack data in either of the perf_callchain_user_X
    functions, and thus no user callgraph data will be collected for this
    sample period. An additional problem is that a fault is guaranteed
    to occur, and though it will be silently covered up, it wastes time
    and could perturb state.

    In perf_callchain_user(), we ensure that %asi contains ASI_AIUS
    because we know for a fact that the subsequent calls to
    copy_from_user() are intended to read the user's stack.

    [ Use get_fs()/set_fs() -DaveM ]

    Signed-off-by: Rob Gardner
    Signed-off-by: Dave Aldridge
    Signed-off-by: David S. Miller

    Rob Gardner
     
  • Commit 28a1f53 delays setting %pil to avoid potential
    hardirq stack overflow in the common rtrap_irq path.
    Setting %pil also needs to be delayed in the rtrap_nmi
    path for the same reason.

    Signed-off-by: Rob Gardner
    Signed-off-by: Dave Aldridge
    Signed-off-by: David S. Miller

    Rob Gardner
     
  • Add ADI (Application Data Integrity) capability to cpu capabilities list.
    ADI capability allows virtual addresses to be encoded with a tag in
    bits 63-60. This tag serves as an access control key for the regions
    of virtual address with ADI enabled and a key set on them. Hypervisor
    encodes this capability as "adp" in "hwcap-list" property in machine
    description.

    Signed-off-by: Khalid Aziz
    Signed-off-by: David S. Miller

    Khalid Aziz
     

24 Dec, 2015

1 commit


23 Dec, 2015

6 commits

  • Pull kvm fixes from Paolo Bonzini:

    - A series of fixes to the MTRR emulation, tested in the BZ by several
    users so they should be safe this late

    - A fix for a division by zero

    - Two very simple ARM and PPC fixes

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
    KVM: x86: Reload pit counters for all channels when restoring state
    KVM: MTRR: treat memory as writeback if MTRR is disabled in guest CPUID
    KVM: MTRR: observe maxphyaddr from guest CPUID, not host
    KVM: MTRR: fix fixed MTRR segment look up
    KVM: VMX: Fix host initiated access to guest MSR_TSC_AUX
    KVM: arm/arm64: vgic: Fix kvm_vgic_map_is_active's dist check
    kvm: x86: move tracepoints outside extended quiescent state
    KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR

    Linus Torvalds
     
  • Pull s390 fixes from Martin Schwidefsky:
    "Two late bug fixes for kernel 4.4.

    Merry Christmas"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
    s390/dis: Fix handling of format specifiers
    s390/zcrypt: Fix AP queue handling if queue is full

    Linus Torvalds
     
  • Enabling CPUFreq support for Tegra124 Chromebooks is causing the Tegra124
    to hang when resuming from suspend.

    When CPUFreq is enabled, the CPU clock is changed from the PLLX clock to
    the DFLL clock during kernel boot. When resuming from suspend the CPU
    clock is temporarily changed back to the PLLX clock before switching back
    to the DFLL. If the DFLL is operating at a much lower frequency than the
    PLLX when we enter suspend, and so the CPU voltage rail is at a voltage
    too low for the CPUs to operate at the PLLX frequency, then the device
    will hang.

    Please note that the PLLX is used in the resume sequence to switch the CPU
    clock from the very slow 32K clock to a faster clock during early resume
    to speed up the resume sequence before the DFLL is resumed.

    Ideally, we should fix this by setting the suspend frequency so that it
    matches the PLLX frequency, however, that would be a bigger change. For
    now simply disable CPUFreq support for Tegra124 Chromebooks to avoid the
    hang when resuming from suspend.

    Fixes: 9a0baee960a7 ("ARM: tegra: Enable CPUFreq support for Tegra124
    Chromebooks")

    Signed-off-by: Jon Hunter
    Signed-off-by: Olof Johansson

    Jon Hunter
     
  • Fix a pointer cast typo introduced in v4.4-rc5 especially visible for
    the i386 subarchitecture where it results in a kernel crash.

    [ Also removed pointless cast as per Al Viro - Linus ]

    Fixes: 8090bfd2bb9a ("um: Fix fpstate handling")
    Signed-off-by: Mickaël Salaün
    Cc: Jeff Dike
    Acked-by: Richard Weinberger
    Signed-off-by: Linus Torvalds

    Mickaël Salaün
     
  • …/git/tmlind/linux-omap into fixes

    Few fixes for omaps to allow am437x only builds to boot properly with
    CPU_IDLE and ARM TWD timer. This is probably a common configuration setup
    for people making products with these SoCs so let's make sure it works.

    Also a wakeirq fix for duovero parlor making my life a bit easier as that
    allows me to run basic PM regression tests on it.

    It would be nice to have these in v4.4, but if it gets too late for that
    because of the holidays, it is not super critical if these get merged for
    v4.5.

    * tag 'omap-for-v4.4/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
    ARM: dts: Fix UART wakeirq for omap4 duovero parlor
    ARM: OMAP2+: AM43xx: select ARM TWD timer
    ARM: OMAP2+: am43xx: enable GENERIC_CLOCKEVENTS_BROADCAST

    Signed-off-by: Olof Johansson <olof@lixom.net>

    Olof Johansson
     
  • …wnguo/linux into fixes

    The i.MX fixes for 4.4, 3rd round:
    - Fix Ethernet PHY mode on i.MX6 Ventana boards, which can result in
    a non-functional Ethernet when Marvell phy driver rather than generic
    phy driver is selected.
    - Fix an assigned-clock configuration bug on imx6qdl-sabreauto board
    which was introduced by commit ed339363de1b ("ARM: dts:
    imx6qdl-sabreauto: Allow HDMI and LVDS to work simultaneously").

    * tag 'imx-fixes-4.4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
    ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
    ARM: dts: imx: Fix the assigned-clock mismatch issue on imx6q/dl

    Olof Johansson
     

22 Dec, 2015

10 commits

  • Currently if userspace restores the pit counters with a count of 0
    on channels 1 or 2 and the guest attempts to read the count on those
    channels, then KVM will perform a mod of 0 and crash. This will ensure
    that 0 values are converted to 65536 as per the spec.

    This is CVE-2015-7513.

    Signed-off-by: Andy Honig
    Signed-off-by: Paolo Bonzini

    Andrew Honig
     
  • Virtual machines can be run with CPUID such that there are no MTRRs.
    In that case, the firmware will never enable MTRRs and it is obviously
    undesirable to run the guest entirely with UC memory. Check out guest
    CPUID, and use WB memory if MTRR do not exist.

    Cc: qemu-stable@nongnu.org
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=107561
    Signed-off-by: Paolo Bonzini

    Paolo Bonzini
     
  • Conversion of MTRRs to ranges used the maxphyaddr from the boot CPU.
    This is wrong, because var_mtrr_range's mask variable then is discontiguous
    (like FF00FFFF000, where the first run of 0s corresponds to the bits
    between host and guest maxphyaddr). Instead always set up the masks
    to be full 64-bit values---we know that the reserved bits at the top
    are zero, and we can restore them when reading the MSR. This way
    var_mtrr_range gets a mask that just works.

    Fixes: a13842dc668b40daef4327294a6d3bdc8bd30276
    Cc: qemu-stable@nongnu.org
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=107561
    Signed-off-by: Paolo Bonzini

    Paolo Bonzini
     
  • This fixes the slow-down of VM running with pci-passthrough, since some MTRR
    range changed from MTRR_TYPE_WRBACK to MTRR_TYPE_UNCACHABLE. Memory in the
    0K-640K range was incorrectly treated as uncacheable.

    Fixes: f7bfb57b3e89ff89c0da9f93dedab89f68d6ca27
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=107561
    Cc: qemu-stable@nongnu.org
    Signed-off-by: Alexis Dambricourt
    [Use correct BZ for "Fixes" annotation. - Paolo]
    Signed-off-by: Paolo Bonzini

    Alexis Dambricourt
     
  • c861519fcf95b2d46cb4275903423b43ae150a40 ("MIPS: Fix delay loops which may
    be removed by GCC.") which made it upstream was an outdated version of the
    patch and is lacking some the removal of two variables that became unused
    thus resulting in further warnings and build breakage. The commit
    from ae878615d7cee5d7346946cf1ae1b60e427013c2 was correct however.

    Signed-off-by: Ralf Baechle

    Ralf Baechle
     
  • Commit ebb5e78cc634 ("MIPS: Initial implementation of a VDSO") introduced a
    build error.

    For MIPS VDSO to be compiled it requires binutils version 2.25 or above but
    the check in the Makefile had inverted logic causing it to be compiled in if
    binutils is below 2.25.

    This fixes the following compilation error:

    CC arch/mips/vdso/gettimeofday.o
    /tmp/ccsExcUd.s: Assembler messages:
    /tmp/ccsExcUd.s:62: Error: can't resolve `_start' {*UND* section} - `L0' {.text section}
    /tmp/ccsExcUd.s:467: Error: can't resolve `_start' {*UND* section} - `L0' {.text section}
    make[2]: *** [arch/mips/vdso/gettimeofday.o] Error 1
    make[1]: *** [arch/mips/vdso] Error 2
    make: *** [arch/mips] Error 2

    [ralf@linux-mips: Fixed Sergei's complaint on the formatting of the
    cited commit and generally reformatted the log message.]

    Signed-off-by: Qais Yousef
    Cc: alex@alex-smith.me.uk
    Cc: linux-mips@linux-mips.org
    Cc: linux-kernel@vger.kernel.org
    Patchwork: https://patchwork.linux-mips.org/patch/11745/
    Signed-off-by: Ralf Baechle

    Qais Yousef
     
  • Commit 977e043d5ea1 ("MIPS: kernel: cps-vec: Replace mips32r2 ISA level
    with mips64r2") leads to .set mips64r2 directives being present in 32
    bit (ie. CONFIG_32BIT=y) kernels. This is incorrect & leads to MIPS64
    instructions being emitted by the assembler when expanding
    pseudo-instructions. For example the "move" instruction can legitimately
    be expanded to a "daddu". This causes problems when the kernel is run on
    a MIPS32 CPU, as CONFIG_32BIT kernels of course often are...

    Fix this by dropping the .set directives entirely now that Kconfig
    should be ensuring that kernels including this code are built with a
    suitable -march= compiler flag.

    Signed-off-by: Paul Burton
    Cc: Markos Chandras
    Cc: James Hogan
    Cc: # 3.16+
    Cc: linux-mips@linux-mips.org
    Cc: linux-kernel@vger.kernel.org
    Patchwork: https://patchwork.linux-mips.org/patch/10869/
    Signed-off-by: Ralf Baechle

    Paul Burton
     
  • __clear_user() (and clear_user() which uses it), always access the user
    mode address space, which results in EVA store instructions when EVA is
    enabled even if the current user address limit is KERNEL_DS.

    Fix this by adding a new symbol __bzero_kernel for the normal kernel
    address space bzero in EVA mode, and call that from __clear_user() if
    eva_kernel_access().

    Signed-off-by: James Hogan
    Cc: Markos Chandras
    Cc: Paul Burton
    Cc: Leonid Yegoshin
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/10844/
    Signed-off-by: Ralf Baechle

    James Hogan
     
  • When EVA is in use, __copy_from_user() was unconditionally using the EVA
    instructions to read the user address space, however this can also be
    used for kernel access. If the address isn't a valid user address it
    will cause an address error or TLB exception, and if it is then user
    memory may be read instead of kernel memory.

    For example in the following stack trace from Linux v3.10 (changes since
    then will prevent this particular one still happening) kernel_sendmsg()
    set the user address limit to KERNEL_DS, and tcp_sendmsg() goes on to
    use __copy_from_user() with a kernel address in KSeg0.

    [] __copy_fromuser_common+0x10c/0x254
    [] tcp_sendmsg+0x5f4/0xf00
    [] sock_sendmsg+0x78/0xa0
    [] kernel_sendmsg+0x24/0x38
    [] sock_no_sendpage+0x70/0x7c
    [] pipe_to_sendpage+0x80/0x98
    [] splice_from_pipe_feed+0xa8/0x198
    [] __splice_from_pipe+0x4c/0x8c
    [] splice_from_pipe+0x58/0x78
    [] generic_splice_sendpage+0x20/0x2c
    [] do_splice_from+0xb4/0x110
    [] direct_splice_actor+0x24/0x30
    [] splice_direct_to_actor+0xd8/0x208
    [] do_splice_direct+0x58/0x7c
    [] do_sendfile+0x1dc/0x39c
    [] SyS_sendfile+0x90/0xf8

    Add the eva_kernel_access() check in __copy_from_user() like the one in
    copy_from_user().

    Signed-off-by: James Hogan
    Cc: Markos Chandras
    Cc: Paul Burton
    Cc: Leonid Yegoshin
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/10843/
    Signed-off-by: Ralf Baechle

    James Hogan
     
  • The strlen_user() function calls __strlen_kernel_asm in both branches of
    the eva_kernel_access() conditional. For EVA it should be calling
    __strlen_user_eva for user accesses, otherwise it will load from the
    kernel address space instead of the user address space, and the access
    checking will likely be ineffective at preventing it due to EVA's
    overlapping user and kernel address spaces.

    This was found after extending the test_user_copy module to cover user
    string access functions, which gave the following error with EVA:

    test_user_copy: illegal strlen_user passed

    Fortunately the use of strlen_user() has been all but eradicated from
    the mainline kernel, so only out of tree modules could be affected.

    Fixes: e3a9b07a9caf ("MIPS: asm: uaccess: Add EVA support for str*_user operations")
    Signed-off-by: James Hogan
    Cc: Markos Chandras
    Cc: Paul Burton
    Cc: Leonid Yegoshin
    Cc: linux-mips@linux-mips.org
    Cc: # 3.15.x-
    Patchwork: https://patchwork.linux-mips.org/patch/10842/
    Signed-off-by: Ralf Baechle

    James Hogan
     

21 Dec, 2015

4 commits

  • On parisc syscalls which are interrupted by signals sometimes failed to
    restart and instead returned -ENOSYS which in the worst case lead to
    userspace crashes.
    A similiar problem existed on MIPS and was fixed by commit e967ef02
    ("MIPS: Fix restart of indirect syscalls").

    On parisc the current syscall restart code assumes that all syscall
    callers load the syscall number in the delay slot of the ble
    instruction. That's how it is e.g. done in the unistd.h header file:
    ble 0x100(%sr2, %r0)
    ldi #syscall_nr, %r20
    Because of that assumption the current code never restored %r20 before
    returning to userspace.

    This assumption is at least not true for code which uses the glibc
    syscall() function, which instead uses this syntax:
    ble 0x100(%sr2, %r0)
    copy regX, %r20
    where regX depend on how the compiler optimizes the code and register
    usage.

    This patch fixes this problem by adding code to analyze how the syscall
    number is loaded in the delay branch and - if needed - copy the syscall
    number to regX prior returning to userspace for the syscall restart.

    Signed-off-by: Helge Deller
    Cc: stable@vger.kernel.org
    Cc: Mathieu Desnoyers

    Helge Deller
     
  • Instead of seeing empty stack traces, let kernel fail early so dwarf
    issues can be fixed sooner

    Signed-off-by: Vineet Gupta

    Vineet Gupta
     
  • The rudimentary CIE.version == 3 handling is already present in code
    (for return address register specification)

    Signed-off-by: Vineet Gupta

    Vineet Gupta
     
  • Blingly ignoring CIE.version != 1 was a bad idea.
    It still leaves "desirability" when running perf with callgraphing where libgcc
    symbols might show in hotspot.

    More importantly, basic CIE.version == 3 support already exists in code:

    |
    | retAddrReg = state.version <= 1 ? *ptr++ : get_uleb128(&ptr, end);
    |

    Next commit with simply add continue-not-bail for CIE.version != 1

    This reverts commit 323f41f9e7d0cb5b1d1586aded6682855f1e646d.

    Vineet Gupta