Commit 55c723e1 authored by James Hogan's avatar James Hogan Committed by Ralf Baechle

MIPS: do_mcheck: Fix kernel code dump with EVA

If a machine check exception is raised in kernel mode, user context,
with EVA enabled, then the do_mcheck handler will attempt to read the
code around the EPC using EVA load instructions, i.e. as if the reads
were from user mode. This will either read random user data if the
process has anything mapped at the same address, or it will cause an
exception which is handled by __get_user, resulting in this output:

 Code: (Bad address in epc)

Fix by setting the current user access mode to kernel if the saved
register context indicates the exception was taken in kernel mode. This
causes __get_user to use normal loads to read the kernel code.
Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: <stable@vger.kernel.org> # 3.15+
Patchwork: https://patchwork.linux-mips.org/patch/10777/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
parent 4ace6139
...@@ -1519,6 +1519,7 @@ asmlinkage void do_mcheck(struct pt_regs *regs) ...@@ -1519,6 +1519,7 @@ asmlinkage void do_mcheck(struct pt_regs *regs)
const int field = 2 * sizeof(unsigned long); const int field = 2 * sizeof(unsigned long);
int multi_match = regs->cp0_status & ST0_TS; int multi_match = regs->cp0_status & ST0_TS;
enum ctx_state prev_state; enum ctx_state prev_state;
mm_segment_t old_fs = get_fs();
prev_state = exception_enter(); prev_state = exception_enter();
show_regs(regs); show_regs(regs);
...@@ -1540,8 +1541,13 @@ asmlinkage void do_mcheck(struct pt_regs *regs) ...@@ -1540,8 +1541,13 @@ asmlinkage void do_mcheck(struct pt_regs *regs)
dump_tlb_all(); dump_tlb_all();
} }
if (!user_mode(regs))
set_fs(KERNEL_DS);
show_code((unsigned int __user *) regs->cp0_epc); show_code((unsigned int __user *) regs->cp0_epc);
set_fs(old_fs);
/* /*
* Some chips may have other causes of machine check (e.g. SB1 * Some chips may have other causes of machine check (e.g. SB1
* graduation timer) * graduation timer)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment