From patchwork Wed May 24 09:58:42 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 100425 Delivered-To: patch@linaro.org Received: by 10.140.96.100 with SMTP id j91csp194793qge; Wed, 24 May 2017 02:59:25 -0700 (PDT) X-Received: by 10.98.71.214 with SMTP id p83mr36849212pfi.236.1495619965656; Wed, 24 May 2017 02:59:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1495619965; cv=none; d=google.com; s=arc-20160816; b=J0XDtC3E1VvBpgxlwhTMie/rMbpN+u50BK+UjOz5DCSPX8TkA/MP0i2U3luxOKyQta G+Y5O2eCdPd7HeMVCpz2le8+ZWdM4hOWg6Ev4N/oqmPJDaOUx0obgEF1pq+KIvpcu5RI lo0ZfKohApC93WTi5RmfnAW76xuvSHAA+UgKmhXlIGtE8JpuYuysFdXsDdzZYbotcRZt gOwmwxgwCJdNR14ElLiFFtw7X35bbaV2TVHJzqQEd23ZaNQUOz+W4DBn0Flx8d4z3x8j rLF3YYOp6IzMiUva57H1SR3rcPcqsZz7tae8bzGCUUiaWYOenBXQV4+exrbJvIPkp5tD bzug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:to:from :arc-authentication-results; bh=eWvrV0kW0GFc8Ehqh9rcGr2wEVSzfI4PZJv637itn7Q=; b=FrZCEsZase0c2pNOtlRiYdK/Hu/fzTGPSKpw8puyA9Wp+cMhaXukAr7xdi+4o5iamc CSxuhuEbq2MmDbSobI7HcGJTA68M3HF5xVAxr1DnXqbnsCvfmktw2MVsGyS+5pRlqmlQ 3FdDAA32hJz0tRfOMA7ezM1orfe4G76/U+OSgmwhVbmiAiyOVVIoyv9cFYpqK9Jvdfls qGlZpY6Y2tctl00FRlv3YsmqYZ8tz8kx4TW8jNYfQTpJkxN8BXqpN6cViBva5mAHf3ja dIKhiDq8Id80b2OM/s7GxIXx19rC8Y2YQVvOWXt+EEAyhvTaqV3Wlx+zZRNnU9R+ShLo dz9Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j61si23194434plb.195.2017.05.24.02.59.25; Wed, 24 May 2017 02:59:25 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1034817AbdEXJ7Y (ORCPT + 6 others); Wed, 24 May 2017 05:59:24 -0400 Received: from foss.arm.com ([217.140.101.70]:35212 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754962AbdEXJ7X (ORCPT ); Wed, 24 May 2017 05:59:23 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 756E32B; Wed, 24 May 2017 02:59:22 -0700 (PDT) Received: from leverpostej.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id F06CB3F578; Wed, 24 May 2017 02:59:21 -0700 (PDT) From: Mark Rutland To: stable@vger.kernel.org Subject: [PATCH v3.18.y] arm64: ensure extension of smp_store_release value Date: Wed, 24 May 2017 10:58:42 +0100 Message-Id: <1495619922-24866-1-git-send-email-mark.rutland@arm.com> X-Mailer: git-send-email 1.9.1 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org commit 994870bead4ab19087a79492400a5478e2906196 upstream. When an inline assembly operand's type is narrower than the register it is allocated to, the least significant bits of the register (up to the operand type's width) are valid, and any other bits are permitted to contain any arbitrary value. This aligns with the AAPCS64 parameter passing rules. Our __smp_store_release() implementation does not account for this, and implicitly assumes that operands have been zero-extended to the width of the type being stored to. Thus, we may store unknown values to memory when the value type is narrower than the pointer type (e.g. when storing a char to a long). This patch fixes the issue by casting the value operand to the same width as the pointer operand in all cases, which ensures that the value is zero-extended as we expect. We use the same union trickery as __smp_load_acquire and {READ,WRITE}_ONCE() to avoid GCC complaining that pointers are potentially cast to narrower width integers in unreachable paths. A whitespace issue at the top of __smp_store_release() is also corrected. No changes are necessary for __smp_load_acquire(). Load instructions implicitly clear any upper bits of the register, and the compiler will only consider the least significant bits of the register as valid regardless. Fixes: 47933ad41a86 ("arch: Introduce smp_load_acquire(), smp_store_release()") Fixes: 878a84d5a8a1 ("arm64: add missing data types in smp_load_acquire/smp_store_release") Cc: # 3.14.x- Acked-by: Will Deacon Signed-off-by: Mark Rutland Cc: Matthias Kaehlcke Signed-off-by: Catalin Marinas --- arch/arm64/include/asm/barrier.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) -- 1.9.1 diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h index 6389d60..d3d4953 100644 --- a/arch/arm64/include/asm/barrier.h +++ b/arch/arm64/include/asm/barrier.h @@ -60,15 +60,21 @@ do { \ #define smp_store_release(p, v) \ do { \ + union { typeof(*p) __val; char __c[1]; } __u = \ + { .__val = (__force typeof(*p)) (v) }; \ compiletime_assert_atomic_type(*p); \ switch (sizeof(*p)) { \ case 4: \ asm volatile ("stlr %w1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u32 *)__u.__c) \ + : "memory"); \ break; \ case 8: \ asm volatile ("stlr %1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u64 *)__u.__c) \ + : "memory"); \ break; \ } \ } while (0)