All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/5] m68k: Disable/restore interrupts in hwreg_present()/hwreg_write()
@ 2014-09-28  9:26 ` Geert Uytterhoeven
  0 siblings, 0 replies; 18+ messages in thread
From: Geert Uytterhoeven @ 2014-09-28  9:26 UTC (permalink / raw)
  To: Finn Thain, linux-m68k; +Cc: linux-kernel, Geert Uytterhoeven, stable

hwreg_present() and hwreg_write() temporarily change the VBR register to
another vector table. This table contains a valid bus error handler
only, all other entries point to arbitrary addresses.

If an interrupt comes in while the temporary table is active, the
processor will start executing at such an arbitrary address, and the
kernel will crash.

While most callers run early, before interrupt are disabled, or
explicitly disable interrupts, Finn Thain pointed out that macsonic has
one callsite that doesn't, causing intermittent boot crashes.
There's another unsafe callsite in hilkbd.

Fix this for good by disabling and restoring interrupts inside
hwreg_present() and hwreg_write().

Explicitly disabling interrupts can be removed from the callsites later.

Reported-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: stable@vger.kernel.org
---
 arch/m68k/mm/hwtest.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/m68k/mm/hwtest.c b/arch/m68k/mm/hwtest.c
index 2c7dde3c6430fc3b..2a5259fd23ebc532 100644
--- a/arch/m68k/mm/hwtest.c
+++ b/arch/m68k/mm/hwtest.c
@@ -28,9 +28,11 @@
 int hwreg_present( volatile void *regp )
 {
     int	ret = 0;
+    unsigned long flags;
     long	save_sp, save_vbr;
     long	tmp_vectors[3];
 
+    local_irq_save(flags);
     __asm__ __volatile__
 	(	"movec	%/vbr,%2\n\t"
 		"movel	#Lberr1,%4@(8)\n\t"
@@ -46,6 +48,7 @@ int hwreg_present( volatile void *regp )
 		: "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr)
 		: "a" (regp), "a" (tmp_vectors)
                 );
+    local_irq_restore(flags);
 
     return( ret );
 }
@@ -58,9 +61,11 @@ EXPORT_SYMBOL(hwreg_present);
 int hwreg_write( volatile void *regp, unsigned short val )
 {
 	int		ret;
+	unsigned long flags;
 	long	save_sp, save_vbr;
 	long	tmp_vectors[3];
 
+	local_irq_save(flags);
 	__asm__ __volatile__
 	(	"movec	%/vbr,%2\n\t"
 		"movel	#Lberr2,%4@(8)\n\t"
@@ -78,6 +83,7 @@ int hwreg_write( volatile void *regp, unsigned short val )
 		: "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr)
 		: "a" (regp), "a" (tmp_vectors), "g" (val)
 	);
+	local_irq_restore(flags);
 
 	return( ret );
 }
-- 
1.9.1

^ permalink raw reply related	[flat|nested] 18+ messages in thread

end of thread, other threads:[~2014-10-03  8:54 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-09-28  9:26 [PATCH 1/5] m68k: Disable/restore interrupts in hwreg_present()/hwreg_write() Geert Uytterhoeven
2014-09-28  9:26 ` Geert Uytterhoeven
2014-09-28  9:26 ` [PATCH 2/5] m68k: Reformat arch/m68k/mm/hwtest.c Geert Uytterhoeven
2014-09-28  9:26   ` Geert Uytterhoeven
2014-09-28  9:26 ` [PATCH 3/5] cirrus/mac89x0: Remove superfluous interrupt disable/restore Geert Uytterhoeven
2014-09-28  9:26   ` Geert Uytterhoeven
2014-09-28  9:26 ` [PATCH 4/5] natsemi/macsonic: " Geert Uytterhoeven
2014-09-28  9:26 ` Geert Uytterhoeven
2014-09-28  9:26 ` [PATCH 5/5] nubus: " Geert Uytterhoeven
2014-09-28  9:26   ` Geert Uytterhoeven
2014-09-28  9:40 ` [PATCH 1/5] m68k: Disable/restore interrupts in hwreg_present()/hwreg_write() Andreas Schwab
2014-09-28  9:40   ` Andreas Schwab
2014-09-28  9:44   ` Geert Uytterhoeven
2014-09-28  9:44   ` Geert Uytterhoeven
2014-09-28  9:44     ` Geert Uytterhoeven
2014-10-03  8:54     ` Geert Uytterhoeven
2014-10-03  8:54       ` Geert Uytterhoeven
2014-10-03  8:54     ` Geert Uytterhoeven

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.