From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Masahiro Yamada <masahiroy@kernel.org>,
Ard Biesheuvel <ardb@kernel.org>,
"Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>,
John Stultz <jstultz@google.com>
Subject: [PATCH 5.10 44/59] ARM: 9324/1: fix get_user() broken with veneer
Date: Thu, 25 Jul 2024 16:37:34 +0200 [thread overview]
Message-ID: <20240725142734.926686214@linuxfoundation.org> (raw)
In-Reply-To: <20240725142733.262322603@linuxfoundation.org>
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <masahiroy@kernel.org>
commit 24d3ba0a7b44c1617c27f5045eecc4f34752ab03 upstream.
The 32-bit ARM kernel stops working if the kernel grows to the point
where veneers for __get_user_* are created.
AAPCS32 [1] states, "Register r12 (IP) may be used by a linker as a
scratch register between a routine and any subroutine it calls. It
can also be used within a routine to hold intermediate values between
subroutine calls."
However, bl instructions buried within the inline asm are unpredictable
for compilers; hence, "ip" must be added to the clobber list.
This becomes critical when veneers for __get_user_* are created because
veneers use the ip register since commit 02e541db0540 ("ARM: 8323/1:
force linker to use PIC veneers").
[1]: https://github.com/ARM-software/abi-aa/blob/2023Q1/aapcs32/aapcs32.rst
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Cc: John Stultz <jstultz@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/uaccess.h | 14 ++------------
1 file changed, 2 insertions(+), 12 deletions(-)
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -147,16 +147,6 @@ extern int __get_user_64t_1(void *);
extern int __get_user_64t_2(void *);
extern int __get_user_64t_4(void *);
-#define __GUP_CLOBBER_1 "lr", "cc"
-#ifdef CONFIG_CPU_USE_DOMAINS
-#define __GUP_CLOBBER_2 "ip", "lr", "cc"
-#else
-#define __GUP_CLOBBER_2 "lr", "cc"
-#endif
-#define __GUP_CLOBBER_4 "lr", "cc"
-#define __GUP_CLOBBER_32t_8 "lr", "cc"
-#define __GUP_CLOBBER_8 "lr", "cc"
-
#define __get_user_x(__r2, __p, __e, __l, __s) \
__asm__ __volatile__ ( \
__asmeq("%0", "r0") __asmeq("%1", "r2") \
@@ -164,7 +154,7 @@ extern int __get_user_64t_4(void *);
"bl __get_user_" #__s \
: "=&r" (__e), "=r" (__r2) \
: "0" (__p), "r" (__l) \
- : __GUP_CLOBBER_##__s)
+ : "ip", "lr", "cc")
/* narrowing a double-word get into a single 32bit word register: */
#ifdef __ARMEB__
@@ -186,7 +176,7 @@ extern int __get_user_64t_4(void *);
"bl __get_user_64t_" #__s \
: "=&r" (__e), "=r" (__r2) \
: "0" (__p), "r" (__l) \
- : __GUP_CLOBBER_##__s)
+ : "ip", "lr", "cc")
#else
#define __get_user_x_64t __get_user_x
#endif
next prev parent reply other threads:[~2024-07-25 14:49 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-25 14:36 [PATCH 5.10 00/59] 5.10.223-rc1 review Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 01/59] gcc-plugins: Rename last_stmt() for GCC 14+ Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 02/59] filelock: Remove locks reliably when fcntl/close race is detected Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 03/59] scsi: qedf: Set qed_slowpath_params to zero before use Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 04/59] ACPI: EC: Abort address space access upon error Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 05/59] ACPI: EC: Avoid returning AE_OK on errors in address space handler Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 06/59] wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 07/59] wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 08/59] selftests/openat2: Fix build warnings on ppc64 Greg Kroah-Hartman
2024-07-25 14:36 ` [PATCH 5.10 09/59] Input: silead - Always support 10 fingers Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 10/59] net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 11/59] ila: block BH in ila_output() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 12/59] arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 13/59] null_blk: fix validation of block size Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 14/59] kconfig: gconf: give a proper initial state to the Save button Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 15/59] kconfig: remove wrong expr_trans_bool() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 16/59] fs/file: fix the check in find_next_fd() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 17/59] mei: demote client disconnect warning on suspend to debug Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 18/59] wifi: cfg80211: wext: add extra SIOCSIWSCAN data check Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 19/59] KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 20/59] ALSA: hda/realtek: Add more codec ID to no shutup pins list Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 21/59] mips: fix compat_sys_lseek syscall Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 22/59] Input: elantech - fix touchpad state on resume for Lenovo N24 Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 23/59] Input: i8042 - add Ayaneo Kun to i8042 quirk table Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 24/59] bytcr_rt5640 : inverse jack detect for Archos 101 cesium Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 25/59] ALSA: dmaengine: Synchronize dma channel after drop() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 26/59] ASoC: ti: davinci-mcasp: Set min period size using FIFO config Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 27/59] ASoC: ti: omap-hdmi: Fix too long driver name Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 28/59] can: kvaser_usb: fix return value for hif_usb_send_regout Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 29/59] s390/sclp: Fix sclp_init() cleanup on failure Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 30/59] btrfs: qgroup: fix quota root leak after quota disable failure Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 31/59] ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 32/59] ALSA: dmaengine_pcm: terminate dmaengine before synchronize Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 33/59] net: usb: qmi_wwan: add Telit FN912 compositions Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 34/59] net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 35/59] powerpc/pseries: Whitelist dtl slub object for copying to userspace Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 36/59] powerpc/eeh: avoid possible crash when edev->pdev changes Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 37/59] scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 38/59] Bluetooth: hci_core: cancel all works upon hci_unregister_dev() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 39/59] fs: better handle deep ancestor chains in is_subdir() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 40/59] spi: imx: Dont expect DMA for i.MX{25,35,50,51,53} cspi devices Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 41/59] selftests/vDSO: fix clang build errors and warnings Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 42/59] hfsplus: fix uninit-value in copy_name Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 43/59] spi: mux: set ctlr->bits_per_word_mask Greg Kroah-Hartman
2024-07-25 14:37 ` Greg Kroah-Hartman [this message]
2024-07-25 14:37 ` [PATCH 5.10 45/59] ACPI: processor_idle: Fix invalid comparison with insertion sort for latency Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 46/59] bpf: Fix overrunning reservations in ringbuf Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 47/59] bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 48/59] scsi: core: Fix a use-after-free Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 49/59] ext4: fix error code saved on super block during file system abort Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 50/59] ext4: Send notifications on error Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 51/59] drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 52/59] net: relax socket state check at accept time Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 53/59] ocfs2: add bounds checking to ocfs2_check_dir_entry() Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 54/59] jfs: dont walk off the end of ealist Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 55/59] ALSA: hda/realtek: Enable headset mic on Positivo SU C1400 Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 56/59] ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 57/59] arm64: dts: qcom: msm8996: Disable SS instance in Parkmode for USB Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 58/59] ALSA: pcm_dmaengine: Dont synchronize DMA channel when DMA is paused Greg Kroah-Hartman
2024-07-25 14:37 ` [PATCH 5.10 59/59] filelock: Fix fcntl/close race recovery compat path Greg Kroah-Hartman
2024-07-26 4:19 ` [PATCH 5.10 00/59] 5.10.223-rc1 review Dominique Martinet
2024-07-26 8:10 ` Pavel Machek
2024-07-26 11:35 ` Mark Brown
2024-07-26 17:12 ` Jon Hunter
2024-07-26 17:27 ` Florian Fainelli
2024-07-26 17:33 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240725142734.926686214@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ardb@kernel.org \
--cc=jstultz@google.com \
--cc=masahiroy@kernel.org \
--cc=patches@lists.linux.dev \
--cc=rmk+kernel@armlinux.org.uk \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).