Changes in 4.9.331 uas: add no-uas quirk for Hiksemi usb_disk usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS uas: ignore UAS for Thinkplus chips net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() mmc: moxart: fix 4-bit bus width and remove 8-bit bus width mm: prevent page_frag_alloc() from corrupting the memory Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" Input: melfas_mip4 - fix return value check in mip4_probe() usbnet: Fix memory leak in usbnet_disconnect() nvme: add new line after variable declatation nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices selftests: Fix the if conditions of in test_extra_filter() clk: iproc: Minor tidy up of iproc pll data structures clk: iproc: Do not rely on node name for correct PLL setup Makefile.extrawarn: Move -Wcast-function-type-strict to W=1 ARM: fix function graph tracer and unwinder dependencies fs: fix UAF/GPF bug in nilfs_mdt_destroy dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer net/ieee802154: fix uninit value bug in dgram_sendmsg um: Cleanup syscall_handler_t cast in syscalls_32.h um: Cleanup compiler warning in arch/x86/um/tls_32.c usb: mon: make mmapped memory read only USB: serial: ftdi_sio: fix 300 bps rate for SIO nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level() nilfs2: fix leak of nilfs_root in case of writer thread creation failure nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure ceph: don't truncate file in atomic_open random: clamp credited irq bits to maximum mixed ALSA: hda: Fix position reporting on Poulsbo scsi: stex: Properly zero out the passthrough command structure USB: serial: qcserial: add new usb-id for Dell branded EM7455 random: avoid reading two cache lines on irq randomness wifi: mac80211_hwsim: avoid mac80211 warning on bad rate random: restore O_NONBLOCK support Input: xpad - add supported devices as contributed on github Input: xpad - fix wireless 360 controller breaking after suspend random: use expired timer rather than wq for mixing fast pool ALSA: oss: Fix potential deadlock at unregistration ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() ALSA: usb-audio: Fix potential memory leaks ALSA: usb-audio: Fix NULL dererence at error path iio: dac: ad5593r: Fix i2c read protocol requirements fs: dlm: fix race between test_bit() and queue_work() fs: dlm: handle -EBUSY first in lock arg validation quota: Check next/prev free block number after reading from quota file regulator: qcom_rpm: Fix circular deferral regression parisc: fbdev/stifb: Align graphics memory size to 4MB UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge fbdev: smscufx: Fix use-after-free in ufx_ops_open() nilfs2: fix use-after-free bug of struct nilfs_root ext4: avoid crash when inline data creation follows DIO write ext4: fix null-ptr-deref in ext4_write_info ext4: make ext4_lazyinit_thread freezable ext4: place buffer head allocation before handle start ring-buffer: Allow splice to read previous partially read pages ring-buffer: Check pending waiters when doing wake ups as well ring-buffer: Fix race between reset page and reading page KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility selinux: use "grep -E" instead of "egrep" sh: machvec: Use char[] for section boundaries wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() wifi: mac80211: allow bw change during channel switch in mesh wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration net: fs_enet: Fix wrong check in do_pd_setup spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe mISDN: fix use-after-free bugs in l1oip timer handlers tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() bnx2x: fix potential memory leak in bnx2x_tpa_stop() drm/mipi-dsi: Detach devices when removing the host platform/x86: msi-laptop: Fix old-ec check for backlight registering mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API ALSA: dmaengine: increment buffer pointer atomically memory: of: Fix refcount leak bug in of_get_ddr_timings() soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() soc: qcom: smem_state: Add refcounting for the 'state->of_node' ARM: dts: kirkwood: lsxl: fix serial line ARM: dts: kirkwood: lsxl: remove first ethernet port ARM: Drop CMDLINE_* dependency on ATAGS ARM: dts: exynos: fix polarity of VBUS GPIO of Origen iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX iio: inkern: only release the device node when done with it iio: ABI: Fix wrong format of differential capacitance channel ABI. clk: tegra: Fix refcount leak in tegra210_clock_init clk: tegra: Fix refcount leak in tegra114_clock_init clk: tegra20: Fix refcount leak in tegra20_clock_init HSI: omap_ssi: Fix refcount leak in ssi_probe HSI: omap_ssi_port: Fix dma_map_sg error check media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop tty: xilinx_uartps: Fix the ignore_status media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init RDMA/rxe: Fix "kernel NULL pointer dereference" error RDMA/rxe: Fix the error caused by qp->sk dyndbg: fix module.dyndbg handling dyndbg: let query-modname override actual module name ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() ata: fix ata_id_has_devslp() ata: fix ata_id_has_ncq_autosense() ata: fix ata_id_has_dipm() drivers: serial: jsm: fix some leaks in probe firmware: google: Test spinlock on panic path to avoid lockups serial: 8250: Fix restoring termios speed after suspend mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() mfd: lp8788: Fix an error handling path in lp8788_probe() mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() mfd: sm501: Add check for platform_driver_register() dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe powerpc/math_emu/efp: Include module.h powerpc/pci_dn: Add missing of_node_put() powerpc: Fix SPE Power ISA properties for e500v1 platforms iommu/omap: Fix buffer overflow in debugfs f2fs: fix race condition on setting FI_NO_EXTENT flag ACPI: video: Add Toshiba Satellite/Portege Z830 quirk MIPS: BCM47XX: Cast memcmp() of function to (void *) powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash openvswitch: Fix double reporting of drops in dropwatch openvswitch: Fix overreporting of drops in dropwatch tcp: annotate data-race around tcp_md5sig_pool_populated xfrm: Update ipcomp_scratches with NULL when freed Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times can: bcm: check the result of can_send() in bcm_can_tx() wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 Bluetooth: L2CAP: Fix user-after-free r8152: Rate limit overflow messages drm: Use size_t type for len variable in drm_copy_field() drm: Prevent drm_copy_field() to attempt copying a NULL pointer platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading drm/amdgpu: fix initial connector audio value ARM: dts: imx7d-sdb: config the max pressure for tsc2046 ARM: dts: imx6q: add missing properties for sram ARM: dts: imx6dl: add missing properties for sram ARM: dts: imx6qp: add missing properties for sram ARM: dts: imx6sl: add missing properties for sram media: cx88: Fix a null-ptr-deref bug in buffer_prepare() scsi: 3w-9xxx: Avoid disabling device if failing to enable it HID: roccat: Fix use-after-free in roccat_read() usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() usb: musb: Fix musb_gadget.c rxstate overflow bug Revert "usb: storage: Add quirk for Samsung Fit flash" usb: idmouse: fix an uninit-value in idmouse_open perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc net: ieee802154: return -EINVAL for unknown addr type net/ieee802154: don't warn zero-sized raw_sendmsg() ext4: continue to expand file system when the target size doesn't reach inet: fully convert sk->sk_rx_dst to RCU rules thermal: intel_powerclamp: Use first online CPU as control_cpu gcov: support GCC 12.1 and newer compilers Linux 4.9.331 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I105d6215a29d200abe3330f328ce3c2009ba0df9
393 lines
8.8 KiB
C
393 lines
8.8 KiB
C
/*
|
|
* Copyright (C) 2005 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
|
|
* Licensed under the GPL
|
|
*/
|
|
|
|
#include <linux/percpu.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/syscalls.h>
|
|
#include <asm/uaccess.h>
|
|
#include <asm/ptrace-abi.h>
|
|
#include <os.h>
|
|
#include <skas.h>
|
|
#include <sysdep/tls.h>
|
|
|
|
/*
|
|
* If needed we can detect when it's uninitialized.
|
|
*
|
|
* These are initialized in an initcall and unchanged thereafter.
|
|
*/
|
|
static int host_supports_tls = -1;
|
|
int host_gdt_entry_tls_min;
|
|
|
|
int do_set_thread_area(struct user_desc *info)
|
|
{
|
|
int ret;
|
|
u32 cpu;
|
|
|
|
cpu = get_cpu();
|
|
ret = os_set_thread_area(info, userspace_pid[cpu]);
|
|
put_cpu();
|
|
|
|
if (ret)
|
|
printk(KERN_ERR "PTRACE_SET_THREAD_AREA failed, err = %d, "
|
|
"index = %d\n", ret, info->entry_number);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int do_get_thread_area(struct user_desc *info)
|
|
{
|
|
int ret;
|
|
u32 cpu;
|
|
|
|
cpu = get_cpu();
|
|
ret = os_get_thread_area(info, userspace_pid[cpu]);
|
|
put_cpu();
|
|
|
|
if (ret)
|
|
printk(KERN_ERR "PTRACE_GET_THREAD_AREA failed, err = %d, "
|
|
"index = %d\n", ret, info->entry_number);
|
|
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* sys_get_thread_area: get a yet unused TLS descriptor index.
|
|
* XXX: Consider leaving one free slot for glibc usage at first place. This must
|
|
* be done here (and by changing GDT_ENTRY_TLS_* macros) and nowhere else.
|
|
*
|
|
* Also, this must be tested when compiling in SKAS mode with dynamic linking
|
|
* and running against NPTL.
|
|
*/
|
|
static int get_free_idx(struct task_struct* task)
|
|
{
|
|
struct thread_struct *t = &task->thread;
|
|
int idx;
|
|
|
|
for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
|
|
if (!t->arch.tls_array[idx].present)
|
|
return idx + GDT_ENTRY_TLS_MIN;
|
|
return -ESRCH;
|
|
}
|
|
|
|
static inline void clear_user_desc(struct user_desc* info)
|
|
{
|
|
/* Postcondition: LDT_empty(info) returns true. */
|
|
memset(info, 0, sizeof(*info));
|
|
|
|
/*
|
|
* Check the LDT_empty or the i386 sys_get_thread_area code - we obtain
|
|
* indeed an empty user_desc.
|
|
*/
|
|
info->read_exec_only = 1;
|
|
info->seg_not_present = 1;
|
|
}
|
|
|
|
#define O_FORCE 1
|
|
|
|
static int load_TLS(int flags, struct task_struct *to)
|
|
{
|
|
int ret = 0;
|
|
int idx;
|
|
|
|
for (idx = GDT_ENTRY_TLS_MIN; idx < GDT_ENTRY_TLS_MAX; idx++) {
|
|
struct uml_tls_struct* curr =
|
|
&to->thread.arch.tls_array[idx - GDT_ENTRY_TLS_MIN];
|
|
|
|
/*
|
|
* Actually, now if it wasn't flushed it gets cleared and
|
|
* flushed to the host, which will clear it.
|
|
*/
|
|
if (!curr->present) {
|
|
if (!curr->flushed) {
|
|
clear_user_desc(&curr->tls);
|
|
curr->tls.entry_number = idx;
|
|
} else {
|
|
WARN_ON(!LDT_empty(&curr->tls));
|
|
continue;
|
|
}
|
|
}
|
|
|
|
if (!(flags & O_FORCE) && curr->flushed)
|
|
continue;
|
|
|
|
ret = do_set_thread_area(&curr->tls);
|
|
if (ret)
|
|
goto out;
|
|
|
|
curr->flushed = 1;
|
|
}
|
|
out:
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* Verify if we need to do a flush for the new process, i.e. if there are any
|
|
* present desc's, only if they haven't been flushed.
|
|
*/
|
|
static inline int needs_TLS_update(struct task_struct *task)
|
|
{
|
|
int i;
|
|
int ret = 0;
|
|
|
|
for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
|
|
struct uml_tls_struct* curr =
|
|
&task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
|
|
|
|
/*
|
|
* Can't test curr->present, we may need to clear a descriptor
|
|
* which had a value.
|
|
*/
|
|
if (curr->flushed)
|
|
continue;
|
|
ret = 1;
|
|
break;
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* On a newly forked process, the TLS descriptors haven't yet been flushed. So
|
|
* we mark them as such and the first switch_to will do the job.
|
|
*/
|
|
void clear_flushed_tls(struct task_struct *task)
|
|
{
|
|
int i;
|
|
|
|
for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
|
|
struct uml_tls_struct* curr =
|
|
&task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
|
|
|
|
/*
|
|
* Still correct to do this, if it wasn't present on the host it
|
|
* will remain as flushed as it was.
|
|
*/
|
|
if (!curr->present)
|
|
continue;
|
|
|
|
curr->flushed = 0;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* In SKAS0 mode, currently, multiple guest threads sharing the same ->mm have a
|
|
* common host process. So this is needed in SKAS0 too.
|
|
*
|
|
* However, if each thread had a different host process (and this was discussed
|
|
* for SMP support) this won't be needed.
|
|
*
|
|
* And this will not need be used when (and if) we'll add support to the host
|
|
* SKAS patch.
|
|
*/
|
|
|
|
int arch_switch_tls(struct task_struct *to)
|
|
{
|
|
if (!host_supports_tls)
|
|
return 0;
|
|
|
|
/*
|
|
* We have no need whatsoever to switch TLS for kernel threads; beyond
|
|
* that, that would also result in us calling os_set_thread_area with
|
|
* userspace_pid[cpu] == 0, which gives an error.
|
|
*/
|
|
if (likely(to->mm))
|
|
return load_TLS(O_FORCE, to);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int set_tls_entry(struct task_struct* task, struct user_desc *info,
|
|
int idx, int flushed)
|
|
{
|
|
struct thread_struct *t = &task->thread;
|
|
|
|
if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
|
|
return -EINVAL;
|
|
|
|
t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls = *info;
|
|
t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present = 1;
|
|
t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed = flushed;
|
|
|
|
return 0;
|
|
}
|
|
|
|
int arch_copy_tls(struct task_struct *new)
|
|
{
|
|
struct user_desc info;
|
|
int idx, ret = -EFAULT;
|
|
|
|
if (copy_from_user(&info,
|
|
(void __user *) UPT_SI(&new->thread.regs.regs),
|
|
sizeof(info)))
|
|
goto out;
|
|
|
|
ret = -EINVAL;
|
|
if (LDT_empty(&info))
|
|
goto out;
|
|
|
|
idx = info.entry_number;
|
|
|
|
ret = set_tls_entry(new, &info, idx, 0);
|
|
out:
|
|
return ret;
|
|
}
|
|
|
|
/* XXX: use do_get_thread_area to read the host value? I'm not at all sure! */
|
|
static int get_tls_entry(struct task_struct *task, struct user_desc *info,
|
|
int idx)
|
|
{
|
|
struct thread_struct *t = &task->thread;
|
|
|
|
if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
|
|
return -EINVAL;
|
|
|
|
if (!t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present)
|
|
goto clear;
|
|
|
|
*info = t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls;
|
|
|
|
out:
|
|
/*
|
|
* Temporary debugging check, to make sure that things have been
|
|
* flushed. This could be triggered if load_TLS() failed.
|
|
*/
|
|
if (unlikely(task == current &&
|
|
!t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed)) {
|
|
printk(KERN_ERR "get_tls_entry: task with pid %d got here "
|
|
"without flushed TLS.", current->pid);
|
|
}
|
|
|
|
return 0;
|
|
clear:
|
|
/*
|
|
* When the TLS entry has not been set, the values read to user in the
|
|
* tls_array are 0 (because it's cleared at boot, see
|
|
* arch/i386/kernel/head.S:cpu_gdt_table). Emulate that.
|
|
*/
|
|
clear_user_desc(info);
|
|
info->entry_number = idx;
|
|
goto out;
|
|
}
|
|
|
|
SYSCALL_DEFINE1(set_thread_area, struct user_desc __user *, user_desc)
|
|
{
|
|
struct user_desc info;
|
|
int idx, ret;
|
|
|
|
if (!host_supports_tls)
|
|
return -ENOSYS;
|
|
|
|
if (copy_from_user(&info, user_desc, sizeof(info)))
|
|
return -EFAULT;
|
|
|
|
idx = info.entry_number;
|
|
|
|
if (idx == -1) {
|
|
idx = get_free_idx(current);
|
|
if (idx < 0)
|
|
return idx;
|
|
info.entry_number = idx;
|
|
/* Tell the user which slot we chose for him.*/
|
|
if (put_user(idx, &user_desc->entry_number))
|
|
return -EFAULT;
|
|
}
|
|
|
|
ret = do_set_thread_area(&info);
|
|
if (ret)
|
|
return ret;
|
|
return set_tls_entry(current, &info, idx, 1);
|
|
}
|
|
|
|
/*
|
|
* Perform set_thread_area on behalf of the traced child.
|
|
* Note: error handling is not done on the deferred load, and this differ from
|
|
* i386. However the only possible error are caused by bugs.
|
|
*/
|
|
int ptrace_set_thread_area(struct task_struct *child, int idx,
|
|
struct user_desc __user *user_desc)
|
|
{
|
|
struct user_desc info;
|
|
|
|
if (!host_supports_tls)
|
|
return -EIO;
|
|
|
|
if (copy_from_user(&info, user_desc, sizeof(info)))
|
|
return -EFAULT;
|
|
|
|
return set_tls_entry(child, &info, idx, 0);
|
|
}
|
|
|
|
SYSCALL_DEFINE1(get_thread_area, struct user_desc __user *, user_desc)
|
|
{
|
|
struct user_desc info;
|
|
int idx, ret;
|
|
|
|
if (!host_supports_tls)
|
|
return -ENOSYS;
|
|
|
|
if (get_user(idx, &user_desc->entry_number))
|
|
return -EFAULT;
|
|
|
|
ret = get_tls_entry(current, &info, idx);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
if (copy_to_user(user_desc, &info, sizeof(info)))
|
|
ret = -EFAULT;
|
|
|
|
out:
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* Perform get_thread_area on behalf of the traced child.
|
|
*/
|
|
int ptrace_get_thread_area(struct task_struct *child, int idx,
|
|
struct user_desc __user *user_desc)
|
|
{
|
|
struct user_desc info;
|
|
int ret;
|
|
|
|
if (!host_supports_tls)
|
|
return -EIO;
|
|
|
|
ret = get_tls_entry(child, &info, idx);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
if (copy_to_user(user_desc, &info, sizeof(info)))
|
|
ret = -EFAULT;
|
|
out:
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* This code is really i386-only, but it detects and logs x86_64 GDT indexes
|
|
* if a 32-bit UML is running on a 64-bit host.
|
|
*/
|
|
static int __init __setup_host_supports_tls(void)
|
|
{
|
|
check_host_supports_tls(&host_supports_tls, &host_gdt_entry_tls_min);
|
|
if (host_supports_tls) {
|
|
printk(KERN_INFO "Host TLS support detected\n");
|
|
printk(KERN_INFO "Detected host type: ");
|
|
switch (host_gdt_entry_tls_min) {
|
|
case GDT_ENTRY_TLS_MIN_I386:
|
|
printk(KERN_CONT "i386");
|
|
break;
|
|
case GDT_ENTRY_TLS_MIN_X86_64:
|
|
printk(KERN_CONT "x86_64");
|
|
break;
|
|
}
|
|
printk(KERN_CONT " (GDT indexes %d to %d)\n",
|
|
host_gdt_entry_tls_min,
|
|
host_gdt_entry_tls_min + GDT_ENTRY_TLS_ENTRIES);
|
|
} else
|
|
printk(KERN_ERR " Host TLS support NOT detected! "
|
|
"TLS support inside UML will not work\n");
|
|
return 0;
|
|
}
|
|
|
|
__initcall(__setup_host_supports_tls);
|