From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752225AbcEMJXm (ORCPT ); Fri, 13 May 2016 05:23:42 -0400 Received: from terminus.zytor.com ([198.137.202.10]:37552 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751536AbcEMJXk (ORCPT ); Fri, 13 May 2016 05:23:40 -0400 Date: Fri, 13 May 2016 02:21:33 -0700 From: tip-bot for Borislav Petkov Message-ID: Cc: luto@amacapital.net, alexander.shishkin@linux.intel.com, linux-kernel@vger.kernel.org, paulmck@linux.vnet.ibm.com, torvalds@linux-foundation.org, bp@suse.de, eranian@google.com, akpm@linux-foundation.org, brgerst@gmail.com, bp@alien8.de, mingo@kernel.org, jolsa@redhat.com, linux@roeck-us.net, hpa@zytor.com, acme@redhat.com, peterz@infradead.org, tglx@linutronix.de, vincent.weaver@maine.edu, dvlasenk@redhat.com Reply-To: dvlasenk@redhat.com, vincent.weaver@maine.edu, tglx@linutronix.de, acme@redhat.com, peterz@infradead.org, mingo@kernel.org, linux@roeck-us.net, jolsa@redhat.com, brgerst@gmail.com, bp@alien8.de, hpa@zytor.com, alexander.shishkin@linux.intel.com, linux-kernel@vger.kernel.org, paulmck@linux.vnet.ibm.com, torvalds@linux-foundation.org, bp@suse.de, luto@amacapital.net, akpm@linux-foundation.org, eranian@google.com In-Reply-To: <20160512172938.GB14245@pd.tnic> References: <20160512172938.GB14245@pd.tnic> To: linux-tip-commits@vger.kernel.org Subject: [tip:locking/rwsem] x86/rwsem: Save and restore all callee-clobbered regs in 32-bit ____down_write() Git-Commit-ID: 9da6e1cf7f044569a7e8a607ecdea6f5192c6bce X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 9da6e1cf7f044569a7e8a607ecdea6f5192c6bce Gitweb: http://git.kernel.org/tip/9da6e1cf7f044569a7e8a607ecdea6f5192c6bce Author: Borislav Petkov AuthorDate: Thu, 12 May 2016 19:29:38 +0200 Committer: Ingo Molnar CommitDate: Fri, 13 May 2016 11:15:19 +0200 x86/rwsem: Save and restore all callee-clobbered regs in 32-bit ____down_write() ____down_write() calls a function to handle the slow path when the lock is contended. But in order to be able to call a C function, one has to stash all callee-clobbered registers. The 32-bit path saves only %ecx for a reason unknown to me. However, after 71c01930b42e ("locking/rwsem, x86: Clean up ____down_write()") the useless dependency on edx was removed and this caused the following splat: BUG: unable to handle kernel NULL pointer dereference at 00000015 IP: [] down_write+0x24/0x30 *pde = 00000000 Oops: 0002 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Tainted: G S W 4.6.0-rc7-next-20160511-yocto-standard #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 task: f4d00000 ti: f4d08000 task.ti: f4d08000 EIP: 0060:[] EFLAGS: 00210282 CPU: 0 EIP is at down_write+0x24/0x30 EAX: f4d00000 EBX: f4f6d600 ECX: ffff0001 EDX: 00000001 ESI: 00000168 EDI: c1c2eb68 EBP: f4d09ef4 ESP: f4d09eec DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 CR0: 80050033 CR2: 00000015 CR3: 01ccb000 CR4: 000406d0 This happens because gcc decided to stash the pointer to @sem in edx (it is not used in the inline asm anymore, thus free): movl %eax, %edx # sem, sem lock; xadd %ecx,(%eax) # tmp91, sem test ... call call_rwsem_down_write_failed mov %eax,0x14(%edx) *before* the slow path happens and if we hit it on 32-bit, it can clobber edx and we're staring at garbage value at deref time. The simple fix is to save/restore edx too, around the slow path. We don't need to stash eax because it is used in the slow path as the @sem arg. Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Borislav Petkov Cc: Alexander Shishkin Cc: Andrew Morton Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Jiri Olsa Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: linux-next@vger.kernel.org Link: http://lkml.kernel.org/r/20160512172938.GB14245@pd.tnic Signed-off-by: Ingo Molnar --- arch/x86/lib/rwsem.S | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/x86/lib/rwsem.S b/arch/x86/lib/rwsem.S index a37462a..0224080 100644 --- a/arch/x86/lib/rwsem.S +++ b/arch/x86/lib/rwsem.S @@ -33,10 +33,12 @@ * value or just clobbered.. */ -#define save_common_regs \ - pushl %ecx +#define save_common_regs \ + pushl %ecx; \ + pushl %edx -#define restore_common_regs \ +#define restore_common_regs \ + popl %edx; \ popl %ecx /* Avoid uglifying the argument copying x86-64 needs to do. */