Skip to content

L
linux
Commit 9b2efe03 authored by Heiko Carstens's avatar Heiko Carstens Committed by Martin Schwidefsky
Browse files
Options

s390/vdso: fix stack corruption 

The kernel provided vdso functions do not get a stack frame from the
calling function and therefore may not change the stack contents, unless
they allocate space on their own.

This problem was exposed with 070b7be6 "s390/vdso: replace stck with
stcke" which writes 16 bytes instead of 8 bytes into the stack frame. These
additional 8 bytes however were indeed used by the caller (glibc) to save
data and therefore this data was corrupted by the vdso code.
Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 1f759bb3
Hide whitespace changes
Inline Side-by-side
Showing with 29 additions and 16 deletions
arch/s390/kernel/vdso32/clock_gettime.S
View file @ 9b2efe03
...@@ -19,6 +19,7 @@ ...@@ -19,6 +19,7 @@
.type __kernel_clock_gettime,@function .type __kernel_clock_gettime,@function
__kernel_clock_gettime: __kernel_clock_gettime:
.cfi_startproc .cfi_startproc
ahi %r15,-16
basr %r5,0 basr %r5,0
0: al %r5,21f-0b(%r5) /* get &_vdso_data */ 0: al %r5,21f-0b(%r5) /* get &_vdso_data */
chi %r2,__CLOCK_REALTIME_COARSE chi %r2,__CLOCK_REALTIME_COARSE
...@@ -34,8 +35,8 @@ __kernel_clock_gettime: ...@@ -34,8 +35,8 @@ __kernel_clock_gettime:
1: l %r4,__VDSO_UPD_COUNT+4(%r5) /* load update counter */ 1: l %r4,__VDSO_UPD_COUNT+4(%r5) /* load update counter */
tml %r4,0x0001 /* pending update ? loop */ tml %r4,0x0001 /* pending update ? loop */
jnz 1b jnz 1b
stcke 24(%r15) /* Store TOD clock */ stcke 0(%r15) /* Store TOD clock */
lm %r0,%r1,25(%r15) lm %r0,%r1,1(%r15)
s %r0,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */ s %r0,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */
sl %r1,__VDSO_XTIME_STAMP+4(%r5) sl %r1,__VDSO_XTIME_STAMP+4(%r5)
brc 3,2f brc 3,2f
...@@ -70,6 +71,7 @@ __kernel_clock_gettime: ...@@ -70,6 +71,7 @@ __kernel_clock_gettime:
8: st %r2,0(%r3) /* store tp->tv_sec */ 8: st %r2,0(%r3) /* store tp->tv_sec */
st %r1,4(%r3) /* store tp->tv_nsec */ st %r1,4(%r3) /* store tp->tv_nsec */
lhi %r2,0 lhi %r2,0
ahi %r15,16
br %r14 br %r14
/* CLOCK_MONOTONIC_COARSE */ /* CLOCK_MONOTONIC_COARSE */
...@@ -96,8 +98,8 @@ __kernel_clock_gettime: ...@@ -96,8 +98,8 @@ __kernel_clock_gettime:
11: l %r4,__VDSO_UPD_COUNT+4(%r5) /* load update counter */ 11: l %r4,__VDSO_UPD_COUNT+4(%r5) /* load update counter */
tml %r4,0x0001 /* pending update ? loop */ tml %r4,0x0001 /* pending update ? loop */
jnz 11b jnz 11b
stcke 24(%r15) /* Store TOD clock */ stcke 0(%r15) /* Store TOD clock */
lm %r0,%r1,25(%r15) lm %r0,%r1,1(%r15)
s %r0,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */ s %r0,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */
sl %r1,__VDSO_XTIME_STAMP+4(%r5) sl %r1,__VDSO_XTIME_STAMP+4(%r5)
brc 3,12f brc 3,12f
...@@ -132,11 +134,13 @@ __kernel_clock_gettime: ...@@ -132,11 +134,13 @@ __kernel_clock_gettime:
17: st %r2,0(%r3) /* store tp->tv_sec */ 17: st %r2,0(%r3) /* store tp->tv_sec */
st %r1,4(%r3) /* store tp->tv_nsec */ st %r1,4(%r3) /* store tp->tv_nsec */
lhi %r2,0 lhi %r2,0
ahi %r15,16
br %r14 br %r14
/* Fallback to system call */ /* Fallback to system call */
19: lhi %r1,__NR_clock_gettime 19: lhi %r1,__NR_clock_gettime
svc 0 svc 0
ahi %r15,16
br %r14 br %r14
20: .long 1000000000 20: .long 1000000000
......
arch/s390/kernel/vdso32/gettimeofday.S
View file @ 9b2efe03
...@@ -19,6 +19,7 @@ ...@@ -19,6 +19,7 @@
.type __kernel_gettimeofday,@function .type __kernel_gettimeofday,@function
__kernel_gettimeofday: __kernel_gettimeofday:
.cfi_startproc .cfi_startproc
ahi %r15,-16
basr %r5,0 basr %r5,0
0: al %r5,13f-0b(%r5) /* get &_vdso_data */ 0: al %r5,13f-0b(%r5) /* get &_vdso_data */
1: ltr %r3,%r3 /* check if tz is NULL */ 1: ltr %r3,%r3 /* check if tz is NULL */
...@@ -29,30 +30,30 @@ __kernel_gettimeofday: ...@@ -29,30 +30,30 @@ __kernel_gettimeofday:
l %r4,__VDSO_UPD_COUNT+4(%r5) /* load update counter */ l %r4,__VDSO_UPD_COUNT+4(%r5) /* load update counter */
tml %r4,0x0001 /* pending update ? loop */ tml %r4,0x0001 /* pending update ? loop */
jnz 1b jnz 1b
stcke 24(%r15) /* Store TOD clock */ stcke 0(%r15) /* Store TOD clock */
lm %r0,%r1,25(%r15) lm %r0,%r1,1(%r15)
s %r0,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */ s %r0,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */
sl %r1,__VDSO_XTIME_STAMP+4(%r5) sl %r1,__VDSO_XTIME_STAMP+4(%r5)
brc 3,3f brc 3,3f
ahi %r0,-1 ahi %r0,-1
3: ms %r0,__VDSO_TK_MULT(%r5) /* * tk->mult */ 3: ms %r0,__VDSO_TK_MULT(%r5) /* * tk->mult */
st %r0,24(%r15) st %r0,0(%r15)
l %r0,__VDSO_TK_MULT(%r5) l %r0,__VDSO_TK_MULT(%r5)
ltr %r1,%r1 ltr %r1,%r1
mr %r0,%r0 mr %r0,%r0
jnm 4f jnm 4f
a %r0,__VDSO_TK_MULT(%r5) a %r0,__VDSO_TK_MULT(%r5)
4: al %r0,24(%r15) 4: al %r0,0(%r15)
al %r0,__VDSO_XTIME_NSEC(%r5) /* + xtime */ al %r0,__VDSO_XTIME_NSEC(%r5) /* + xtime */
al %r1,__VDSO_XTIME_NSEC+4(%r5) al %r1,__VDSO_XTIME_NSEC+4(%r5)
brc 12,5f brc 12,5f
ahi %r0,1 ahi %r0,1
5: mvc 24(4,%r15),__VDSO_XTIME_SEC+4(%r5) 5: mvc 0(4,%r15),__VDSO_XTIME_SEC+4(%r5)
cl %r4,__VDSO_UPD_COUNT+4(%r5) /* check update counter */ cl %r4,__VDSO_UPD_COUNT+4(%r5) /* check update counter */
jne 1b jne 1b
l %r4,__VDSO_TK_SHIFT(%r5) /* Timekeeper shift */ l %r4,__VDSO_TK_SHIFT(%r5) /* Timekeeper shift */
srdl %r0,0(%r4) /* >> tk->shift */ srdl %r0,0(%r4) /* >> tk->shift */
l %r4,24(%r15) /* get tv_sec from stack */ l %r4,0(%r15) /* get tv_sec from stack */
basr %r5,0 basr %r5,0
6: ltr %r0,%r0 6: ltr %r0,%r0
jnz 7f jnz 7f
...@@ -71,6 +72,7 @@ __kernel_gettimeofday: ...@@ -71,6 +72,7 @@ __kernel_gettimeofday:
9: srl %r0,6 9: srl %r0,6
st %r0,4(%r2) /* store tv->tv_usec */ st %r0,4(%r2) /* store tv->tv_usec */
10: slr %r2,%r2 10: slr %r2,%r2
ahi %r15,16
br %r14 br %r14
11: .long 1000000000 11: .long 1000000000
12: .long 274877907 12: .long 274877907
......
arch/s390/kernel/vdso64/clock_gettime.S
View file @ 9b2efe03
...@@ -19,6 +19,7 @@ ...@@ -19,6 +19,7 @@
.type __kernel_clock_gettime,@function .type __kernel_clock_gettime,@function
__kernel_clock_gettime: __kernel_clock_gettime:
.cfi_startproc .cfi_startproc
aghi %r15,-16
larl %r5,_vdso_data larl %r5,_vdso_data
cghi %r2,__CLOCK_REALTIME_COARSE cghi %r2,__CLOCK_REALTIME_COARSE
je 4f je 4f
...@@ -37,10 +38,10 @@ __kernel_clock_gettime: ...@@ -37,10 +38,10 @@ __kernel_clock_gettime:
0: lg %r4,__VDSO_UPD_COUNT(%r5) /* load update counter */ 0: lg %r4,__VDSO_UPD_COUNT(%r5) /* load update counter */
tmll %r4,0x0001 /* pending update ? loop */ tmll %r4,0x0001 /* pending update ? loop */
jnz 0b jnz 0b
stcke 48(%r15) /* Store TOD clock */ stcke 0(%r15) /* Store TOD clock */
lgf %r2,__VDSO_TK_SHIFT(%r5) /* Timekeeper shift */ lgf %r2,__VDSO_TK_SHIFT(%r5) /* Timekeeper shift */
lg %r0,__VDSO_WTOM_SEC(%r5) lg %r0,__VDSO_WTOM_SEC(%r5)
lg %r1,49(%r15) lg %r1,1(%r15)
sg %r1,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */ sg %r1,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */
msgf %r1,__VDSO_TK_MULT(%r5) /* * tk->mult */ msgf %r1,__VDSO_TK_MULT(%r5) /* * tk->mult */
alg %r1,__VDSO_WTOM_NSEC(%r5) alg %r1,__VDSO_WTOM_NSEC(%r5)
...@@ -56,6 +57,7 @@ __kernel_clock_gettime: ...@@ -56,6 +57,7 @@ __kernel_clock_gettime:
2: stg %r0,0(%r3) /* store tp->tv_sec */ 2: stg %r0,0(%r3) /* store tp->tv_sec */
stg %r1,8(%r3) /* store tp->tv_nsec */ stg %r1,8(%r3) /* store tp->tv_nsec */
lghi %r2,0 lghi %r2,0
aghi %r15,16
br %r14 br %r14
/* CLOCK_MONOTONIC_COARSE */ /* CLOCK_MONOTONIC_COARSE */
...@@ -82,9 +84,9 @@ __kernel_clock_gettime: ...@@ -82,9 +84,9 @@ __kernel_clock_gettime:
5: lg %r4,__VDSO_UPD_COUNT(%r5) /* load update counter */ 5: lg %r4,__VDSO_UPD_COUNT(%r5) /* load update counter */
tmll %r4,0x0001 /* pending update ? loop */ tmll %r4,0x0001 /* pending update ? loop */
jnz 5b jnz 5b
stcke 48(%r15) /* Store TOD clock */ stcke 0(%r15) /* Store TOD clock */
lgf %r2,__VDSO_TK_SHIFT(%r5) /* Timekeeper shift */ lgf %r2,__VDSO_TK_SHIFT(%r5) /* Timekeeper shift */
lg %r1,49(%r15) lg %r1,1(%r15)
sg %r1,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */ sg %r1,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */
msgf %r1,__VDSO_TK_MULT(%r5) /* * tk->mult */ msgf %r1,__VDSO_TK_MULT(%r5) /* * tk->mult */
alg %r1,__VDSO_XTIME_NSEC(%r5) /* + tk->xtime_nsec */ alg %r1,__VDSO_XTIME_NSEC(%r5) /* + tk->xtime_nsec */
...@@ -101,6 +103,7 @@ __kernel_clock_gettime: ...@@ -101,6 +103,7 @@ __kernel_clock_gettime:
7: stg %r0,0(%r3) /* store tp->tv_sec */ 7: stg %r0,0(%r3) /* store tp->tv_sec */
stg %r1,8(%r3) /* store tp->tv_nsec */ stg %r1,8(%r3) /* store tp->tv_nsec */
lghi %r2,0 lghi %r2,0
aghi %r15,16
br %r14 br %r14
/* CLOCK_THREAD_CPUTIME_ID for this thread */ /* CLOCK_THREAD_CPUTIME_ID for this thread */
...@@ -134,11 +137,13 @@ __kernel_clock_gettime: ...@@ -134,11 +137,13 @@ __kernel_clock_gettime:
slgr %r4,%r0 /* r4 = tv_nsec */ slgr %r4,%r0 /* r4 = tv_nsec */
stg %r4,8(%r3) stg %r4,8(%r3)
lghi %r2,0 lghi %r2,0
aghi %r15,16
br %r14 br %r14
/* Fallback to system call */ /* Fallback to system call */
12: lghi %r1,__NR_clock_gettime 12: lghi %r1,__NR_clock_gettime
svc 0 svc 0
aghi %r15,16
br %r14 br %r14
13: .quad 1000000000 13: .quad 1000000000
......
arch/s390/kernel/vdso64/gettimeofday.S
View file @ 9b2efe03
...@@ -19,6 +19,7 @@ ...@@ -19,6 +19,7 @@
.type __kernel_gettimeofday,@function .type __kernel_gettimeofday,@function
__kernel_gettimeofday: __kernel_gettimeofday:
.cfi_startproc .cfi_startproc
aghi %r15,-16
larl %r5,_vdso_data larl %r5,_vdso_data
0: ltgr %r3,%r3 /* check if tz is NULL */ 0: ltgr %r3,%r3 /* check if tz is NULL */
je 1f je 1f
...@@ -28,8 +29,8 @@ __kernel_gettimeofday: ...@@ -28,8 +29,8 @@ __kernel_gettimeofday:
lg %r4,__VDSO_UPD_COUNT(%r5) /* load update counter */ lg %r4,__VDSO_UPD_COUNT(%r5) /* load update counter */
tmll %r4,0x0001 /* pending update ? loop */ tmll %r4,0x0001 /* pending update ? loop */
jnz 0b jnz 0b
stcke 48(%r15) /* Store TOD clock */ stcke 0(%r15) /* Store TOD clock */
lg %r1,49(%r15) lg %r1,1(%r15)
sg %r1,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */ sg %r1,__VDSO_XTIME_STAMP(%r5) /* TOD - cycle_last */
msgf %r1,__VDSO_TK_MULT(%r5) /* * tk->mult */ msgf %r1,__VDSO_TK_MULT(%r5) /* * tk->mult */
alg %r1,__VDSO_XTIME_NSEC(%r5) /* + tk->xtime_nsec */ alg %r1,__VDSO_XTIME_NSEC(%r5) /* + tk->xtime_nsec */
...@@ -50,6 +51,7 @@ __kernel_gettimeofday: ...@@ -50,6 +51,7 @@ __kernel_gettimeofday:
srlg %r0,%r0,6 srlg %r0,%r0,6
stg %r0,8(%r2) /* store tv->tv_usec */ stg %r0,8(%r2) /* store tv->tv_usec */
4: lghi %r2,0 4: lghi %r2,0
aghi %r15,16
br %r14 br %r14
5: .quad 1000000000 5: .quad 1000000000
.long 274877907 .long 274877907
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7