[PATCH] powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs

[PATCH] powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs

[Nicholas Piggin]

The SLB bad address handler's trap number fixup does not preserve the
low bit that indicates nonvolatile GPRs have not been saved. This
leads save_nvgprs to skip saving them, and subsequent functions and
return from interrupt will think they are saved.

This causes kernel branch-to-garbage debugging to not have correct
registers, can also cause userspace to have its registers clobbered
after a segfault.

Fixes: f0f558b131 ("powerpc/mm: Preserve CFAR value on SLB miss caused by access to bogus address")
Cc: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
 arch/powerpc/kernel/exceptions-64s.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 3ac87e53b3da..1ecfd8ffb098 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -706,7 +706,7 @@ EXC_COMMON_BEGIN(bad_addr_slb)
 	ld	r3, PACA_EXSLB+EX_DAR(r13)
 	std	r3, _DAR(r1)
 	beq	cr6, 2f
-	li	r10, 0x480		/* fix trap number for I-SLB miss */
+	li	r10, 0x481		/* fix trap number for I-SLB miss */
 	std	r10, _TRAP(r1)
 2:	bl	save_nvgprs
 	addi	r3, r1, STACK_FRAME_OVERHEAD
-- 
2.16.1

Re: powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs

[Michael Ellerman]

On Fri, 2018-03-23 at 05:53:38 UTC, Nicholas Piggin wrote:
> The SLB bad address handler's trap number fixup does not preserve the
> low bit that indicates nonvolatile GPRs have not been saved. This
> leads save_nvgprs to skip saving them, and subsequent functions and
> return from interrupt will think they are saved.
> 
> This causes kernel branch-to-garbage debugging to not have correct
> registers, can also cause userspace to have its registers clobbered
> after a segfault.
> 
> Fixes: f0f558b131 ("powerpc/mm: Preserve CFAR value on SLB miss caused by access to bogus address")
> Cc: Paul Mackerras <paulus@ozlabs.org>
> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>

I added:
  Cc: stable@vger.kernel.org # v4.9+

Applied to powerpc fixes, thanks.

https://git.kernel.org/powerpc/c/52396500f97c53860164debc7d4f75

cheers