From: James Morse <james.morse@arm.com>
To: linux-arm-kernel@lists.infradead.org
Cc: Catalin Marinas <catalin.marinas@arm.com>,
James Morse <james.morse@arm.com>, Will Deacon <will@kernel.org>,
Christoph Hellwig <hch@lst.de>, Hanjun Guo <guohanjun@huawei.com>
Subject: [PATCH 3/3] firmware: arm_sdei: Document the motivation behind these set_fs() calls
Date: Tue, 19 May 2020 19:21:08 +0100 [thread overview]
Message-ID: <20200519182108.13693-4-james.morse@arm.com> (raw)
In-Reply-To: <20200519182108.13693-1-james.morse@arm.com>
The SDEI handler save/restores the addr_limit using set_fs(). It isn't
very clear why. The reason is to mirror the arch code's entry assembly.
The arch code does this because perf may access user-space, and
inheriting the addr_limit may be a problem.
Add a comment explaining why this is here.
Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=822
Suggested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Morse <james.morse@arm.com>
---
drivers/firmware/arm_sdei.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
index b12b99a19f66..e7e36aab2386 100644
--- a/drivers/firmware/arm_sdei.c
+++ b/drivers/firmware/arm_sdei.c
@@ -1128,6 +1128,14 @@ int sdei_event_handler(struct pt_regs *regs,
mm_segment_t orig_addr_limit;
u32 event_num = arg->event_num;
+ /*
+ * Save restore 'fs'.
+ * The architecture's entry code save/restores 'fs' when taking an
+ * exception from the kernel. This ensures addr_limit isn't inherited
+ * if you interrupted something that allowed the uaccess routines to
+ * access kernel memory.
+ * Do the same here because this doesn't come via the same entry code.
+ */
orig_addr_limit = get_fs();
set_fs(USER_DS);
--
2.19.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-05-19 18:22 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-19 18:21 [PATCH 0/3] firmare: arm_sdei: Extras for v5.8 James Morse
2020-05-19 18:21 ` [PATCH 1/3] firmware: arm_sdei: Put the SDEI table after using it James Morse
2020-05-19 18:21 ` [PATCH 2/3] firmware: arm_sdei: remove unused interfaces James Morse
2020-05-19 18:21 ` James Morse [this message]
2020-05-20 11:00 ` [PATCH 0/3] firmare: arm_sdei: Extras for v5.8 Will Deacon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200519182108.13693-4-james.morse@arm.com \
--to=james.morse@arm.com \
--cc=catalin.marinas@arm.com \
--cc=guohanjun@huawei.com \
--cc=hch@lst.de \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox