Commit 68a84271 authored by Vineet Gupta's avatar Vineet Gupta Committed by Khalid Elmously

ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE

BugLink: https://bugs.launchpad.net/bugs/1888690

commit 00fdec98 upstream.

Trap handler for syscall tracing reads EFA (Exception Fault Address),
in case strace wants PC of trap instruction (EFA is not part of pt_regs
as of current code).

However this EFA read is racy as it happens after dropping to pure
kernel mode (re-enabling interrupts). A taken interrupt could
context-switch, trigger a different task's trap, clobbering EFA for this
execution context.

Fix this by reading EFA early, before re-enabling interrupts. A slight
side benefit is de-duplication of FAKE_RET_FROM_EXCPN in trap handler.
The trap handler is common to both ARCompact and ARCv2 builds too.

This just came out of code rework/review and no real problem was reported
but is clearly a potential problem specially for strace.

Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarVineet Gupta <vgupta@synopsys.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
Signed-off-by: default avatarKhalid Elmously <khalid.elmously@canonical.com>
parent 3dc9ed81
...@@ -168,7 +168,6 @@ END(EV_Extension) ...@@ -168,7 +168,6 @@ END(EV_Extension)
tracesys: tracesys:
; save EFA in case tracer wants the PC of traced task ; save EFA in case tracer wants the PC of traced task
; using ERET won't work since next-PC has already committed ; using ERET won't work since next-PC has already committed
lr r12, [efa]
GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11 GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11
st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address
...@@ -211,15 +210,9 @@ tracesys_exit: ...@@ -211,15 +210,9 @@ tracesys_exit:
; Breakpoint TRAP ; Breakpoint TRAP
; --------------------------------------------- ; ---------------------------------------------
trap_with_param: trap_with_param:
mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc
; stop_pc info by gdb needs this info
lr r0, [efa]
mov r1, sp mov r1, sp
; Now that we have read EFA, it is safe to do "fake" rtie
; and get out of CPU exception mode
FAKE_RET_FROM_EXCPN
; Save callee regs in case gdb wants to have a look ; Save callee regs in case gdb wants to have a look
; SP will grow up by size of CALLEE Reg-File ; SP will grow up by size of CALLEE Reg-File
; NOTE: clobbers r12 ; NOTE: clobbers r12
...@@ -246,6 +239,10 @@ ENTRY(EV_Trap) ...@@ -246,6 +239,10 @@ ENTRY(EV_Trap)
EXCEPTION_PROLOGUE EXCEPTION_PROLOGUE
lr r12, [efa]
FAKE_RET_FROM_EXCPN
;============ TRAP 1 :breakpoints ;============ TRAP 1 :breakpoints
; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR) ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR)
bmsk.f 0, r9, 7 bmsk.f 0, r9, 7
...@@ -253,9 +250,6 @@ ENTRY(EV_Trap) ...@@ -253,9 +250,6 @@ ENTRY(EV_Trap)
;============ TRAP (no param): syscall top level ;============ TRAP (no param): syscall top level
; First return from Exception to pure K mode (Exception/IRQs renabled)
FAKE_RET_FROM_EXCPN
; If syscall tracing ongoing, invoke pre-post-hooks ; If syscall tracing ongoing, invoke pre-post-hooks
GET_CURR_THR_INFO_FLAGS r10 GET_CURR_THR_INFO_FLAGS r10
btst r10, TIF_SYSCALL_TRACE btst r10, TIF_SYSCALL_TRACE
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment