From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:51402 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752031AbdLFNbJ (ORCPT ); Wed, 6 Dec 2017 08:31:09 -0500 Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id vB6DTB7Z083929 for ; Wed, 6 Dec 2017 08:31:09 -0500 Received: from e06smtp11.uk.ibm.com (e06smtp11.uk.ibm.com [195.75.94.107]) by mx0a-001b2d01.pphosted.com with ESMTP id 2epfukx9y6-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Wed, 06 Dec 2017 08:31:08 -0500 Received: from localhost by e06smtp11.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 6 Dec 2017 13:31:03 -0000 Date: Wed, 6 Dec 2017 14:30:58 +0100 From: Heiko Carstens To: Greg Kroah-Hartman Cc: Ben Hutchings , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Christian Borntraeger , Martin Schwidefsky Subject: Re: [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption References: <20171128100503.067621614@linuxfoundation.org> <20171128100503.204142514@linuxfoundation.org> <1512493352.18523.180.camel@codethink.co.uk> <20171205170847.GA22747@kroah.com> <20171205181534.GA3092@osiris> <20171206074453.GB31086@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20171206074453.GB31086@kroah.com> Message-Id: <20171206133058.GB6933@osiris> Sender: stable-owner@vger.kernel.org List-ID: On Wed, Dec 06, 2017 at 08:44:53AM +0100, Greg Kroah-Hartman wrote: > On Tue, Dec 05, 2017 at 07:15:34PM +0100, Heiko Carstens wrote: > > On Tue, Dec 05, 2017 at 06:08:47PM +0100, Greg Kroah-Hartman wrote: > > > On Tue, Dec 05, 2017 at 05:02:32PM +0000, Ben Hutchings wrote: > > > > On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote: > > > > > 4.4-stable review patch.��If anyone has any objections, please let me know. > > > > > > > > > > ------------------ > > > > > > > > > > From: Heiko Carstens > > > > > > > > > > commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream. > > > > [...] > > > > > --- a/arch/s390/kernel/runtime_instr.c > > > > > +++ b/arch/s390/kernel/runtime_instr.c > > > > > @@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void) > > > > > �{ > > > > > � struct task_struct *task = current; > > > > > � > > > > > + preempt_disable(); > > > > > � if (!task->thread.ri_cb) > > > > > � return; > > > > > > > > This return path now leaves preemption disabled. This seems to have > > > > been fixed upstream by commit 8d9047f8b967 "s390/runtime > > > > instrumentation: simplify task exit handling". > > > > > > "simplify" doesn't seem to imply "fixes a bug" :) > > > > Indeed ;) That where two subsequent patches, but incorrectly split by me... > > > > > Heiko, should I also queue this patch up? > > > > Yes, please. > > It doesn't apply to 4.9-stable or 4.4-stable, can you provide a working > backport? Below is the patch against 4.4-stable: >>From e3cd188d023506d4a0045b9a2918b9fa73d4d007 Mon Sep 17 00:00:00 2001 From: Heiko Carstens Date: Mon, 11 Sep 2017 11:24:22 +0200 Subject: [PATCH] s390/runtime instrumentation: simplify task exit handling commit 8d9047f8b967ce6181fd824ae922978e1b055cc0 upstream. Free data structures required for runtime instrumentation from arch_release_task_struct(). This allows to simplify the code a bit, and also makes the semantics a bit easier: arch_release_task_struct() is never called from the task that is being removed. In addition this allows to get rid of exit_thread() in a later patch. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky --- arch/s390/include/asm/runtime_instr.h | 4 +++- arch/s390/kernel/process.c | 2 +- arch/s390/kernel/runtime_instr.c | 30 +++++++++++++++--------------- 3 files changed, 19 insertions(+), 17 deletions(-) diff --git a/arch/s390/include/asm/runtime_instr.h b/arch/s390/include/asm/runtime_instr.h index 402ad6df4897..c54a9310d814 100644 --- a/arch/s390/include/asm/runtime_instr.h +++ b/arch/s390/include/asm/runtime_instr.h @@ -85,6 +85,8 @@ static inline void restore_ri_cb(struct runtime_instr_cb *cb_next, load_runtime_instr_cb(&runtime_instr_empty_cb); } -void exit_thread_runtime_instr(void); +struct task_struct; + +void runtime_instr_release(struct task_struct *tsk); #endif /* _RUNTIME_INSTR_H */ diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c index efa035a31b98..7bc4e4c5d5b8 100644 --- a/arch/s390/kernel/process.c +++ b/arch/s390/kernel/process.c @@ -72,7 +72,6 @@ extern void kernel_thread_starter(void); */ void exit_thread(void) { - exit_thread_runtime_instr(); } void flush_thread(void) @@ -87,6 +86,7 @@ void arch_release_task_struct(struct task_struct *tsk) { /* Free either the floating-point or the vector register save area */ kfree(tsk->thread.fpu.regs); + runtime_instr_release(tsk); } int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c index 70cdb03d4acd..fd03a7569e10 100644 --- a/arch/s390/kernel/runtime_instr.c +++ b/arch/s390/kernel/runtime_instr.c @@ -18,11 +18,24 @@ /* empty control block to disable RI by loading it */ struct runtime_instr_cb runtime_instr_empty_cb; +void runtime_instr_release(struct task_struct *tsk) +{ + kfree(tsk->thread.ri_cb); +} + static void disable_runtime_instr(void) { - struct pt_regs *regs = task_pt_regs(current); + struct task_struct *task = current; + struct pt_regs *regs; + if (!task->thread.ri_cb) + return; + regs = task_pt_regs(task); + preempt_disable(); load_runtime_instr_cb(&runtime_instr_empty_cb); + kfree(task->thread.ri_cb); + task->thread.ri_cb = NULL; + preempt_enable(); /* * Make sure the RI bit is deleted from the PSW. If the user did not @@ -43,19 +56,6 @@ static void init_runtime_instr_cb(struct runtime_instr_cb *cb) cb->valid = 1; } -void exit_thread_runtime_instr(void) -{ - struct task_struct *task = current; - - preempt_disable(); - if (!task->thread.ri_cb) - return; - disable_runtime_instr(); - kfree(task->thread.ri_cb); - task->thread.ri_cb = NULL; - preempt_enable(); -} - SYSCALL_DEFINE1(s390_runtime_instr, int, command) { struct runtime_instr_cb *cb; @@ -64,7 +64,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int, command) return -EOPNOTSUPP; if (command == S390_RUNTIME_INSTR_STOP) { - exit_thread_runtime_instr(); + disable_runtime_instr(); return 0; } -- 2.13.5