[PATCH 4.19] powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM

[PATCH 4.19] powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM

[Michael Neuling]

From: Breno Leitao <leitao@debian.org>

commit 897bc3df8c5aebb54c32d831f917592e873d0559 upstream.

Commit e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
moved a code block around and this block uses a 'msr' variable outside of
the CONFIG_PPC_TRANSACTIONAL_MEM, however the 'msr' variable is declared
inside a CONFIG_PPC_TRANSACTIONAL_MEM block, causing a possible error when
CONFIG_PPC_TRANSACTION_MEM is not defined.

	error: 'msr' undeclared (first use in this function)

This is not causing a compilation error in the mainline kernel, because
'msr' is being used as an argument of MSR_TM_ACTIVE(), which is defined as
the following when CONFIG_PPC_TRANSACTIONAL_MEM is *not* set:

	#define MSR_TM_ACTIVE(x) 0

This patch just fixes this issue avoiding the 'msr' variable usage outside
the CONFIG_PPC_TRANSACTIONAL_MEM block, avoiding trusting in the
MSR_TM_ACTIVE() definition.

Cc: stable@vger.kernel.org
Reported-by: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
Fixes: e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Michael Neuling <mikey@neuling.org>
---
Greg: I think the original patch got rejected with a conflict.
This correctly applies to v4.19.34.
---
 arch/powerpc/kernel/signal_64.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index bbd1c73243..14b0f5b6a3 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -755,12 +755,25 @@ SYSCALL_DEFINE0(rt_sigreturn)
 		if (restore_tm_sigcontexts(current, &uc->uc_mcontext,
 					   &uc_transact->uc_mcontext))
 			goto badframe;
-	}
-	else
-	/* Fall through, for non-TM restore */
+	} else
 #endif
-	if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
-		goto badframe;
+	{
+		/*
+		 * Fall through, for non-TM restore
+		 *
+		 * Unset MSR[TS] on the thread regs since MSR from user
+		 * context does not have MSR active, and recheckpoint was
+		 * not called since restore_tm_sigcontexts() was not called
+		 * also.
+		 *
+		 * If not unsetting it, the code can RFID to userspace with
+		 * MSR[TS] set, but without CPU in the proper state,
+		 * causing a TM bad thing.
+		 */
+		current->thread.regs->msr &= ~MSR_TS_MASK;
+		if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
+			goto badframe;
+	}
 
 	if (restore_altstack(&uc->uc_stack))
 		goto badframe;
-- 
2.20.1

Re: [PATCH 4.19] powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM

[Sasha Levin]

On Mon, Apr 08, 2019 at 04:32:38PM +1000, Michael Neuling wrote:
>From: Breno Leitao <leitao@debian.org>
>
>commit 897bc3df8c5aebb54c32d831f917592e873d0559 upstream.
>
>Commit e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
>moved a code block around and this block uses a 'msr' variable outside of
>the CONFIG_PPC_TRANSACTIONAL_MEM, however the 'msr' variable is declared
>inside a CONFIG_PPC_TRANSACTIONAL_MEM block, causing a possible error when
>CONFIG_PPC_TRANSACTION_MEM is not defined.
>
>	error: 'msr' undeclared (first use in this function)
>
>This is not causing a compilation error in the mainline kernel, because
>'msr' is being used as an argument of MSR_TM_ACTIVE(), which is defined as
>the following when CONFIG_PPC_TRANSACTIONAL_MEM is *not* set:
>
>	#define MSR_TM_ACTIVE(x) 0
>
>This patch just fixes this issue avoiding the 'msr' variable usage outside
>the CONFIG_PPC_TRANSACTIONAL_MEM block, avoiding trusting in the
>MSR_TM_ACTIVE() definition.
>
>Cc: stable@vger.kernel.org
>Reported-by: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
>Fixes: e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
>Signed-off-by: Breno Leitao <leitao@debian.org>
>Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
>Signed-off-by: Michael Neuling <mikey@neuling.org>
>---
>Greg: I think the original patch got rejected with a conflict.
>This correctly applies to v4.19.34.

Thanks for the backport, I've queued it for 4.9-4.19 since the patch it
fixes is included in all of those.

--
Thanks,
Sasha

Re: [PATCH 4.19] powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM

[Greg KH]

On Mon, Apr 08, 2019 at 10:45:52AM -0400, Sasha Levin wrote:
> On Mon, Apr 08, 2019 at 04:32:38PM +1000, Michael Neuling wrote:
> > From: Breno Leitao <leitao@debian.org>
> > 
> > commit 897bc3df8c5aebb54c32d831f917592e873d0559 upstream.
> > 
> > Commit e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
> > moved a code block around and this block uses a 'msr' variable outside of
> > the CONFIG_PPC_TRANSACTIONAL_MEM, however the 'msr' variable is declared
> > inside a CONFIG_PPC_TRANSACTIONAL_MEM block, causing a possible error when
> > CONFIG_PPC_TRANSACTION_MEM is not defined.
> > 
> > 	error: 'msr' undeclared (first use in this function)
> > 
> > This is not causing a compilation error in the mainline kernel, because
> > 'msr' is being used as an argument of MSR_TM_ACTIVE(), which is defined as
> > the following when CONFIG_PPC_TRANSACTIONAL_MEM is *not* set:
> > 
> > 	#define MSR_TM_ACTIVE(x) 0
> > 
> > This patch just fixes this issue avoiding the 'msr' variable usage outside
> > the CONFIG_PPC_TRANSACTIONAL_MEM block, avoiding trusting in the
> > MSR_TM_ACTIVE() definition.
> > 
> > Cc: stable@vger.kernel.org
> > Reported-by: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
> > Fixes: e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint")
> > Signed-off-by: Breno Leitao <leitao@debian.org>
> > Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
> > Signed-off-by: Michael Neuling <mikey@neuling.org>
> > ---
> > Greg: I think the original patch got rejected with a conflict.
> > This correctly applies to v4.19.34.
> 
> Thanks for the backport, I've queued it for 4.9-4.19 since the patch it
> fixes is included in all of those.

Thaks for queueing up all of these while I was away for a week, much
appreciated.

greg k-h