1
0
Files
kernel-49/arch/x86/um/tls_32.c
Greg Kroah-Hartman 6c5ed2a7d7 Merge 4.9.331 into android-4.9-q
Changes in 4.9.331
	uas: add no-uas quirk for Hiksemi usb_disk
	usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS
	uas: ignore UAS for Thinkplus chips
	net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455
	ntfs: fix BUG_ON in ntfs_lookup_inode_by_name()
	mmc: moxart: fix 4-bit bus width and remove 8-bit bus width
	mm: prevent page_frag_alloc() from corrupting the memory
	Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time"
	Input: melfas_mip4 - fix return value check in mip4_probe()
	usbnet: Fix memory leak in usbnet_disconnect()
	nvme: add new line after variable declatation
	nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
	selftests: Fix the if conditions of in test_extra_filter()
	clk: iproc: Minor tidy up of iproc pll data structures
	clk: iproc: Do not rely on node name for correct PLL setup
	Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
	ARM: fix function graph tracer and unwinder dependencies
	fs: fix UAF/GPF bug in nilfs_mdt_destroy
	dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
	dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
	ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
	net/ieee802154: fix uninit value bug in dgram_sendmsg
	um: Cleanup syscall_handler_t cast in syscalls_32.h
	um: Cleanup compiler warning in arch/x86/um/tls_32.c
	usb: mon: make mmapped memory read only
	USB: serial: ftdi_sio: fix 300 bps rate for SIO
	nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
	nilfs2: fix leak of nilfs_root in case of writer thread creation failure
	nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
	ceph: don't truncate file in atomic_open
	random: clamp credited irq bits to maximum mixed
	ALSA: hda: Fix position reporting on Poulsbo
	scsi: stex: Properly zero out the passthrough command structure
	USB: serial: qcserial: add new usb-id for Dell branded EM7455
	random: avoid reading two cache lines on irq randomness
	wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
	random: restore O_NONBLOCK support
	Input: xpad - add supported devices as contributed on github
	Input: xpad - fix wireless 360 controller breaking after suspend
	random: use expired timer rather than wq for mixing fast pool
	ALSA: oss: Fix potential deadlock at unregistration
	ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
	ALSA: usb-audio: Fix potential memory leaks
	ALSA: usb-audio: Fix NULL dererence at error path
	iio: dac: ad5593r: Fix i2c read protocol requirements
	fs: dlm: fix race between test_bit() and queue_work()
	fs: dlm: handle -EBUSY first in lock arg validation
	quota: Check next/prev free block number after reading from quota file
	regulator: qcom_rpm: Fix circular deferral regression
	parisc: fbdev/stifb: Align graphics memory size to 4MB
	UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
	PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
	fbdev: smscufx: Fix use-after-free in ufx_ops_open()
	nilfs2: fix use-after-free bug of struct nilfs_root
	ext4: avoid crash when inline data creation follows DIO write
	ext4: fix null-ptr-deref in ext4_write_info
	ext4: make ext4_lazyinit_thread freezable
	ext4: place buffer head allocation before handle start
	ring-buffer: Allow splice to read previous partially read pages
	ring-buffer: Check pending waiters when doing wake ups as well
	ring-buffer: Fix race between reset page and reading page
	KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
	selinux: use "grep -E" instead of "egrep"
	sh: machvec: Use char[] for section boundaries
	wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
	wifi: mac80211: allow bw change during channel switch in mesh
	wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
	spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
	spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
	wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
	net: fs_enet: Fix wrong check in do_pd_setup
	spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
	mISDN: fix use-after-free bugs in l1oip timer handlers
	tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
	net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
	bnx2x: fix potential memory leak in bnx2x_tpa_stop()
	drm/mipi-dsi: Detach devices when removing the host
	platform/x86: msi-laptop: Fix old-ec check for backlight registering
	mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
	ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
	ALSA: dmaengine: increment buffer pointer atomically
	memory: of: Fix refcount leak bug in of_get_ddr_timings()
	soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
	soc: qcom: smem_state: Add refcounting for the 'state->of_node'
	ARM: dts: kirkwood: lsxl: fix serial line
	ARM: dts: kirkwood: lsxl: remove first ethernet port
	ARM: Drop CMDLINE_* dependency on ATAGS
	ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
	iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
	iio: inkern: only release the device node when done with it
	iio: ABI: Fix wrong format of differential capacitance channel ABI.
	clk: tegra: Fix refcount leak in tegra210_clock_init
	clk: tegra: Fix refcount leak in tegra114_clock_init
	clk: tegra20: Fix refcount leak in tegra20_clock_init
	HSI: omap_ssi: Fix refcount leak in ssi_probe
	HSI: omap_ssi_port: Fix dma_map_sg error check
	media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
	tty: xilinx_uartps: Fix the ignore_status
	media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
	RDMA/rxe: Fix "kernel NULL pointer dereference" error
	RDMA/rxe: Fix the error caused by qp->sk
	dyndbg: fix module.dyndbg handling
	dyndbg: let query-modname override actual module name
	ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
	ata: fix ata_id_has_devslp()
	ata: fix ata_id_has_ncq_autosense()
	ata: fix ata_id_has_dipm()
	drivers: serial: jsm: fix some leaks in probe
	firmware: google: Test spinlock on panic path to avoid lockups
	serial: 8250: Fix restoring termios speed after suspend
	mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
	mfd: lp8788: Fix an error handling path in lp8788_probe()
	mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
	mfd: sm501: Add check for platform_driver_register()
	dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
	clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
	clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
	powerpc/math_emu/efp: Include module.h
	powerpc/pci_dn: Add missing of_node_put()
	powerpc: Fix SPE Power ISA properties for e500v1 platforms
	iommu/omap: Fix buffer overflow in debugfs
	f2fs: fix race condition on setting FI_NO_EXTENT flag
	ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
	MIPS: BCM47XX: Cast memcmp() of function to (void *)
	powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
	thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
	openvswitch: Fix double reporting of drops in dropwatch
	openvswitch: Fix overreporting of drops in dropwatch
	tcp: annotate data-race around tcp_md5sig_pool_populated
	xfrm: Update ipcomp_scratches with NULL when freed
	Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
	Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
	can: bcm: check the result of can_send() in bcm_can_tx()
	wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
	Bluetooth: L2CAP: Fix user-after-free
	r8152: Rate limit overflow messages
	drm: Use size_t type for len variable in drm_copy_field()
	drm: Prevent drm_copy_field() to attempt copying a NULL pointer
	platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
	drm/amdgpu: fix initial connector audio value
	ARM: dts: imx7d-sdb: config the max pressure for tsc2046
	ARM: dts: imx6q: add missing properties for sram
	ARM: dts: imx6dl: add missing properties for sram
	ARM: dts: imx6qp: add missing properties for sram
	ARM: dts: imx6sl: add missing properties for sram
	media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
	scsi: 3w-9xxx: Avoid disabling device if failing to enable it
	HID: roccat: Fix use-after-free in roccat_read()
	usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
	usb: musb: Fix musb_gadget.c rxstate overflow bug
	Revert "usb: storage: Add quirk for Samsung Fit flash"
	usb: idmouse: fix an uninit-value in idmouse_open
	perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
	net: ieee802154: return -EINVAL for unknown addr type
	net/ieee802154: don't warn zero-sized raw_sendmsg()
	ext4: continue to expand file system when the target size doesn't reach
	inet: fully convert sk->sk_rx_dst to RCU rules
	thermal: intel_powerclamp: Use first online CPU as control_cpu
	gcov: support GCC 12.1 and newer compilers
	Linux 4.9.331

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I105d6215a29d200abe3330f328ce3c2009ba0df9
2022-10-26 16:33:33 +03:00

393 lines
8.8 KiB
C

/*
* Copyright (C) 2005 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
* Licensed under the GPL
*/
#include <linux/percpu.h>
#include <linux/sched.h>
#include <linux/syscalls.h>
#include <asm/uaccess.h>
#include <asm/ptrace-abi.h>
#include <os.h>
#include <skas.h>
#include <sysdep/tls.h>
/*
* If needed we can detect when it's uninitialized.
*
* These are initialized in an initcall and unchanged thereafter.
*/
static int host_supports_tls = -1;
int host_gdt_entry_tls_min;
int do_set_thread_area(struct user_desc *info)
{
int ret;
u32 cpu;
cpu = get_cpu();
ret = os_set_thread_area(info, userspace_pid[cpu]);
put_cpu();
if (ret)
printk(KERN_ERR "PTRACE_SET_THREAD_AREA failed, err = %d, "
"index = %d\n", ret, info->entry_number);
return ret;
}
int do_get_thread_area(struct user_desc *info)
{
int ret;
u32 cpu;
cpu = get_cpu();
ret = os_get_thread_area(info, userspace_pid[cpu]);
put_cpu();
if (ret)
printk(KERN_ERR "PTRACE_GET_THREAD_AREA failed, err = %d, "
"index = %d\n", ret, info->entry_number);
return ret;
}
/*
* sys_get_thread_area: get a yet unused TLS descriptor index.
* XXX: Consider leaving one free slot for glibc usage at first place. This must
* be done here (and by changing GDT_ENTRY_TLS_* macros) and nowhere else.
*
* Also, this must be tested when compiling in SKAS mode with dynamic linking
* and running against NPTL.
*/
static int get_free_idx(struct task_struct* task)
{
struct thread_struct *t = &task->thread;
int idx;
for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
if (!t->arch.tls_array[idx].present)
return idx + GDT_ENTRY_TLS_MIN;
return -ESRCH;
}
static inline void clear_user_desc(struct user_desc* info)
{
/* Postcondition: LDT_empty(info) returns true. */
memset(info, 0, sizeof(*info));
/*
* Check the LDT_empty or the i386 sys_get_thread_area code - we obtain
* indeed an empty user_desc.
*/
info->read_exec_only = 1;
info->seg_not_present = 1;
}
#define O_FORCE 1
static int load_TLS(int flags, struct task_struct *to)
{
int ret = 0;
int idx;
for (idx = GDT_ENTRY_TLS_MIN; idx < GDT_ENTRY_TLS_MAX; idx++) {
struct uml_tls_struct* curr =
&to->thread.arch.tls_array[idx - GDT_ENTRY_TLS_MIN];
/*
* Actually, now if it wasn't flushed it gets cleared and
* flushed to the host, which will clear it.
*/
if (!curr->present) {
if (!curr->flushed) {
clear_user_desc(&curr->tls);
curr->tls.entry_number = idx;
} else {
WARN_ON(!LDT_empty(&curr->tls));
continue;
}
}
if (!(flags & O_FORCE) && curr->flushed)
continue;
ret = do_set_thread_area(&curr->tls);
if (ret)
goto out;
curr->flushed = 1;
}
out:
return ret;
}
/*
* Verify if we need to do a flush for the new process, i.e. if there are any
* present desc's, only if they haven't been flushed.
*/
static inline int needs_TLS_update(struct task_struct *task)
{
int i;
int ret = 0;
for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
struct uml_tls_struct* curr =
&task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
/*
* Can't test curr->present, we may need to clear a descriptor
* which had a value.
*/
if (curr->flushed)
continue;
ret = 1;
break;
}
return ret;
}
/*
* On a newly forked process, the TLS descriptors haven't yet been flushed. So
* we mark them as such and the first switch_to will do the job.
*/
void clear_flushed_tls(struct task_struct *task)
{
int i;
for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
struct uml_tls_struct* curr =
&task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
/*
* Still correct to do this, if it wasn't present on the host it
* will remain as flushed as it was.
*/
if (!curr->present)
continue;
curr->flushed = 0;
}
}
/*
* In SKAS0 mode, currently, multiple guest threads sharing the same ->mm have a
* common host process. So this is needed in SKAS0 too.
*
* However, if each thread had a different host process (and this was discussed
* for SMP support) this won't be needed.
*
* And this will not need be used when (and if) we'll add support to the host
* SKAS patch.
*/
int arch_switch_tls(struct task_struct *to)
{
if (!host_supports_tls)
return 0;
/*
* We have no need whatsoever to switch TLS for kernel threads; beyond
* that, that would also result in us calling os_set_thread_area with
* userspace_pid[cpu] == 0, which gives an error.
*/
if (likely(to->mm))
return load_TLS(O_FORCE, to);
return 0;
}
static int set_tls_entry(struct task_struct* task, struct user_desc *info,
int idx, int flushed)
{
struct thread_struct *t = &task->thread;
if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
return -EINVAL;
t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls = *info;
t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present = 1;
t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed = flushed;
return 0;
}
int arch_copy_tls(struct task_struct *new)
{
struct user_desc info;
int idx, ret = -EFAULT;
if (copy_from_user(&info,
(void __user *) UPT_SI(&new->thread.regs.regs),
sizeof(info)))
goto out;
ret = -EINVAL;
if (LDT_empty(&info))
goto out;
idx = info.entry_number;
ret = set_tls_entry(new, &info, idx, 0);
out:
return ret;
}
/* XXX: use do_get_thread_area to read the host value? I'm not at all sure! */
static int get_tls_entry(struct task_struct *task, struct user_desc *info,
int idx)
{
struct thread_struct *t = &task->thread;
if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
return -EINVAL;
if (!t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present)
goto clear;
*info = t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls;
out:
/*
* Temporary debugging check, to make sure that things have been
* flushed. This could be triggered if load_TLS() failed.
*/
if (unlikely(task == current &&
!t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed)) {
printk(KERN_ERR "get_tls_entry: task with pid %d got here "
"without flushed TLS.", current->pid);
}
return 0;
clear:
/*
* When the TLS entry has not been set, the values read to user in the
* tls_array are 0 (because it's cleared at boot, see
* arch/i386/kernel/head.S:cpu_gdt_table). Emulate that.
*/
clear_user_desc(info);
info->entry_number = idx;
goto out;
}
SYSCALL_DEFINE1(set_thread_area, struct user_desc __user *, user_desc)
{
struct user_desc info;
int idx, ret;
if (!host_supports_tls)
return -ENOSYS;
if (copy_from_user(&info, user_desc, sizeof(info)))
return -EFAULT;
idx = info.entry_number;
if (idx == -1) {
idx = get_free_idx(current);
if (idx < 0)
return idx;
info.entry_number = idx;
/* Tell the user which slot we chose for him.*/
if (put_user(idx, &user_desc->entry_number))
return -EFAULT;
}
ret = do_set_thread_area(&info);
if (ret)
return ret;
return set_tls_entry(current, &info, idx, 1);
}
/*
* Perform set_thread_area on behalf of the traced child.
* Note: error handling is not done on the deferred load, and this differ from
* i386. However the only possible error are caused by bugs.
*/
int ptrace_set_thread_area(struct task_struct *child, int idx,
struct user_desc __user *user_desc)
{
struct user_desc info;
if (!host_supports_tls)
return -EIO;
if (copy_from_user(&info, user_desc, sizeof(info)))
return -EFAULT;
return set_tls_entry(child, &info, idx, 0);
}
SYSCALL_DEFINE1(get_thread_area, struct user_desc __user *, user_desc)
{
struct user_desc info;
int idx, ret;
if (!host_supports_tls)
return -ENOSYS;
if (get_user(idx, &user_desc->entry_number))
return -EFAULT;
ret = get_tls_entry(current, &info, idx);
if (ret < 0)
goto out;
if (copy_to_user(user_desc, &info, sizeof(info)))
ret = -EFAULT;
out:
return ret;
}
/*
* Perform get_thread_area on behalf of the traced child.
*/
int ptrace_get_thread_area(struct task_struct *child, int idx,
struct user_desc __user *user_desc)
{
struct user_desc info;
int ret;
if (!host_supports_tls)
return -EIO;
ret = get_tls_entry(child, &info, idx);
if (ret < 0)
goto out;
if (copy_to_user(user_desc, &info, sizeof(info)))
ret = -EFAULT;
out:
return ret;
}
/*
* This code is really i386-only, but it detects and logs x86_64 GDT indexes
* if a 32-bit UML is running on a 64-bit host.
*/
static int __init __setup_host_supports_tls(void)
{
check_host_supports_tls(&host_supports_tls, &host_gdt_entry_tls_min);
if (host_supports_tls) {
printk(KERN_INFO "Host TLS support detected\n");
printk(KERN_INFO "Detected host type: ");
switch (host_gdt_entry_tls_min) {
case GDT_ENTRY_TLS_MIN_I386:
printk(KERN_CONT "i386");
break;
case GDT_ENTRY_TLS_MIN_X86_64:
printk(KERN_CONT "x86_64");
break;
}
printk(KERN_CONT " (GDT indexes %d to %d)\n",
host_gdt_entry_tls_min,
host_gdt_entry_tls_min + GDT_ENTRY_TLS_ENTRIES);
} else
printk(KERN_ERR " Host TLS support NOT detected! "
"TLS support inside UML will not work\n");
return 0;
}
__initcall(__setup_host_supports_tls);