From patchwork Fri Sep 26 09:45:53 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Slaby X-Patchwork-Id: 37948 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-wg0-f71.google.com (mail-wg0-f71.google.com [74.125.82.71]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id DBC7020447 for ; Fri, 26 Sep 2014 09:47:45 +0000 (UTC) Received: by mail-wg0-f71.google.com with SMTP id y10sf5495241wgg.6 for ; Fri, 26 Sep 2014 02:47:45 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:in-reply-to:references:in-reply-to:references :sender:precedence:list-id:x-original-sender :x-original-authentication-results:mailing-list:list-post:list-help :list-archive:list-unsubscribe; bh=Yt/caxKOooQjGY4O6i09aI//mxTxKrxltjt6mK/GJs0=; b=hJGG8ZXlVdUkkwd256RFp7L+3zhV3MiHn0ovuDV30LA8j98XHoLExiQPQwumGfryNS HdJeX9apMwNlD1IARu5VYZILramVWQV39E9ef6PjA7BPdeqWUiw6hMvNyKKs5SvihpZM vjO+lz/Q3zRU+61B2F3rkkU5KED0EY8kvACkWICIHcFXId6ZEqsgH3eCoCVSx5TcXlL5 xSfomhXnjFKAHEBC7S0AFrJaK/rDm/Pd8xzrSA89DpqK7u8yDtb1jlj2Z5b+oLIptfqM cIxQnBFQmFf5H7DKUXtCtJGnBbn8+sjKWEHglHMdWITYVYUVaXTQ+Gn62/ukq8z3hn/W JXjw== X-Gm-Message-State: ALoCoQknNchxaGUAzS3sqCE8YygG+6N/vTwe0vu4gmA3h1w94PHUZpqgfhtg9oTG+s19ZN5JiOrl X-Received: by 10.152.2.97 with SMTP id 1mr443780lat.6.1411724865041; Fri, 26 Sep 2014 02:47:45 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.21.97 with SMTP id u1ls311529lae.105.gmail; Fri, 26 Sep 2014 02:47:44 -0700 (PDT) X-Received: by 10.112.198.74 with SMTP id ja10mr18338024lbc.14.1411724864899; Fri, 26 Sep 2014 02:47:44 -0700 (PDT) Received: from mail-lb0-f174.google.com (mail-lb0-f174.google.com [209.85.217.174]) by mx.google.com with ESMTPS id v2si6334401lav.132.2014.09.26.02.47.44 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 26 Sep 2014 02:47:44 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.174 as permitted sender) client-ip=209.85.217.174; Received: by mail-lb0-f174.google.com with SMTP id l4so13952876lbv.5 for ; Fri, 26 Sep 2014 02:47:44 -0700 (PDT) X-Received: by 10.152.7.8 with SMTP id f8mr18880604laa.27.1411724863296; Fri, 26 Sep 2014 02:47:43 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.112.130.169 with SMTP id of9csp30743lbb; Fri, 26 Sep 2014 02:47:42 -0700 (PDT) X-Received: by 10.68.162.228 with SMTP id yd4mr30110962pbb.24.1411724861767; Fri, 26 Sep 2014 02:47:41 -0700 (PDT) Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id ok10si8194632pbb.219.2014.09.26.02.47.41 for ; Fri, 26 Sep 2014 02:47:41 -0700 (PDT) Received-SPF: none (google.com: linux-kernel-owner@vger.kernel.org does not designate permitted sender hosts) client-ip=209.132.180.67; Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755290AbaIZJrF (ORCPT + 27 others); Fri, 26 Sep 2014 05:47:05 -0400 Received: from cantor2.suse.de ([195.135.220.15]:33055 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755208AbaIZJqy (ORCPT ); Fri, 26 Sep 2014 05:46:54 -0400 Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id DB660AE0C; Fri, 26 Sep 2014 09:45:55 +0000 (UTC) Received: from ku by ip4-83-240-18-248.cust.nbox.cz with local (Exim 4.83) (envelope-from ) id 1XXS67-0008W4-Ip; Fri, 26 Sep 2014 11:45:55 +0200 From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Will Deacon , Jiri Slaby Subject: [PATCH 3.12 142/142] arm64: flush TLS registers during exec Date: Fri, 26 Sep 2014 11:45:53 +0200 Message-Id: <7bcae251a2dfb6c0aa2c34dc505a5796c7c39426.1411724724.git.jslaby@suse.cz> X-Mailer: git-send-email 2.1.0 In-Reply-To: <406eb8e630446eff74211cba53a536f232bbefd1.1411724723.git.jslaby@suse.cz> References: <406eb8e630446eff74211cba53a536f232bbefd1.1411724723.git.jslaby@suse.cz> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org Precedence: list List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: linux-kernel-owner@vger.kernel.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.174 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , From: Will Deacon 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit eb35bdd7bca29a13c8ecd44e6fd747a84ce675db upstream. Nathan reports that we leak TLS information from the parent context during an exec, as we don't clear the TLS registers when flushing the thread state. This patch updates the flushing code so that we: (1) Unconditionally zero the tpidr_el0 register (since this is fully context switched for native tasks and zeroed for compat tasks) (2) Zero the tp_value state in thread_info before clearing the tpidrr0_el0 register for compat tasks (since this is only writable by the set_tls compat syscall and therefore not fully switched). A missing compiler barrier is also added to the compat set_tls syscall. Acked-by: Nathan Lynch Reported-by: Nathan Lynch Signed-off-by: Will Deacon Signed-off-by: Jiri Slaby --- arch/arm64/kernel/process.c | 18 ++++++++++++++++++ arch/arm64/kernel/sys_compat.c | 6 ++++++ 2 files changed, 24 insertions(+) diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c index 7ae8a1f00c3c..7af6183daa2e 100644 --- a/arch/arm64/kernel/process.c +++ b/arch/arm64/kernel/process.c @@ -183,9 +183,27 @@ void exit_thread(void) { } +static void tls_thread_flush(void) +{ + asm ("msr tpidr_el0, xzr"); + + if (is_compat_task()) { + current->thread.tp_value = 0; + + /* + * We need to ensure ordering between the shadow state and the + * hardware state, so that we don't corrupt the hardware state + * with a stale shadow state during context switch. + */ + barrier(); + asm ("msr tpidrro_el0, xzr"); + } +} + void flush_thread(void) { fpsimd_flush_thread(); + tls_thread_flush(); flush_ptrace_hw_breakpoint(current); } diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c index 26e9c4eeaba8..78039927c807 100644 --- a/arch/arm64/kernel/sys_compat.c +++ b/arch/arm64/kernel/sys_compat.c @@ -79,6 +79,12 @@ long compat_arm_syscall(struct pt_regs *regs) case __ARM_NR_compat_set_tls: current->thread.tp_value = regs->regs[0]; + + /* + * Protect against register corruption from context switch. + * See comment in tls_thread_flush. + */ + barrier(); asm ("msr tpidrro_el0, %0" : : "r" (regs->regs[0])); return 0;