linux.git/arch/arm/kernel/entry-common.S, branch v4.14.154

ARM: 8781/1: Fix Thumb-2 syscall return for binutils 2.29+

2019-03-13T21:03:23+00:00

[ Upstream commit afc9f65e01cd114cb2cedf544d22239116ce0cc6 ]

When building the kernel as Thumb-2 with binutils 2.29 or newer, if the
assembler has seen the .type directive (via ENDPROC()) for a symbol, it
automatically handles the setting of the lowest bit when the symbol is
used with ADR.  The badr macro on the other hand handles this lowest bit
manually.  This leads to a jump to a wrong address in the wrong state
in the syscall return path:

 Internal error: Oops - undefined instruction: 0 [#2] SMP THUMB2
 Modules linked in:
 CPU: 0 PID: 652 Comm: modprobe Tainted: G      D           4.18.0-rc3+ #8
 PC is at ret_fast_syscall+0x4/0x62
 LR is at sys_brk+0x109/0x128
 pc : [<80101004>]    lr : [<801c8a35>]    psr: 60000013
 Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
 Control: 50c5387d  Table: 9e82006a  DAC: 00000051
 Process modprobe (pid: 652, stack limit = 0x(ptrval))

 80101000 :
 80101000:       b672            cpsid   i
 80101002:       f8d9 2008       ldr.w   r2, [r9, #8]
 80101006:       f1b2 4ffe       cmp.w   r2, #2130706432 ; 0x7f000000

 80101184 :
 80101184:       f8d9 a000       ldr.w   sl, [r9]
 80101188:       e92d 0030       stmdb   sp!, {r4, r5}
 8010118c:       f01a 0ff0       tst.w   sl, #240        ; 0xf0
 80101190:       d117            bne.n   801011c2 <__sys_trace>
 80101192:       46ba            mov     sl, r7
 80101194:       f5ba 7fc8       cmp.w   sl, #400        ; 0x190
 80101198:       bf28            it      cs
 8010119a:       f04f 0a00       movcs.w sl, #0
 8010119e:       f3af 8014       nop.w   {20}
 801011a2:       f2af 1ea2       subw    lr, pc, #418    ; 0x1a2

To fix this, add a new symbol name which doesn't have ENDPROC used on it
and use that with badr.  We can't remove the badr usage since that would
would cause breakage with older binutils.

Signed-off-by: Vincent Whitchurch 
Signed-off-by: Russell King 
Signed-off-by: Sasha Levin

ARM: spectre-v1: fix syscall entry

2018-10-18T07:16:27+00:00

Commit 10573ae547c85b2c61417ff1a106cffbfceada35 upstream.

Prevent speculation at the syscall table decoding by clamping the index
used to zero on invalid system call numbers, and using the csdb
speculative barrier.

Signed-off-by: Russell King 
Acked-by: Mark Rutland 
Boot-tested-by: Tony Lindgren 
Reviewed-by: Tony Lindgren 
Signed-off-by: David A. Long 
Signed-off-by: Greg Kroah-Hartman

arm/syscalls: Optimize address limit check

2017-09-17T17:45:33+00:00

Disable the generic address limit check in favor of an architecture
specific optimized implementation. The generic implementation using
pending work flags did not work well with ARM and alignment faults.

The address limit is checked on each syscall return path to user-mode
path as well as the irq user-mode return function. If the address limit
was changed, a function is called to report data corruption (stopping
the kernel or process based on configuration).

The address limit check has to be done before any pending work because
they can reset the address limit and the process is killed using a
SIGKILL signal. For example the lkdtm address limit check does not work
because the signal to kill the process will reset the user-mode address
limit.

Signed-off-by: Thomas Garnier 
Signed-off-by: Kees Cook 
Tested-by: Kees Cook 
Tested-by: Leonard Crestez 
Reviewed-by: Kees Cook 
Signed-off-by: Thomas Gleixner 
Cc: Pratyush Anand 
Cc: Dave Martin 
Cc: Will Drewry 
Cc: Arnd Bergmann 
Cc: Catalin Marinas 
Cc: Will Deacon 
Cc: Russell King 
Cc: Andy Lutomirski 
Cc: David Howells 
Cc: Dave Hansen 
Cc: Al Viro 
Cc: linux-api@vger.kernel.org
Cc: Yonghong Song 
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/1504798247-48833-4-git-send-email-keescook@chromium.org

Revert "arm/syscalls: Check address limit on user-mode return"

2017-09-17T17:45:33+00:00

This reverts commit 73ac5d6a2b6ac3ae8d1e1818f3e9946f97489bc9.

The work pending loop can call set_fs after addr_limit_user_check
removed the _TIF_FSCHECK flag. This may happen at anytime based on how
ARM handles alignment exceptions. It leads to an infinite loop condition.

After discussion, it has been agreed that the generic approach is not
tailored to the ARM architecture and any fix might not be complete. This
patch will be replaced by an architecture specific implementation. The
work flag approach will be kept for other architectures.

Reported-by: Leonard Crestez 
Signed-off-by: Thomas Garnier 
Signed-off-by: Kees Cook 
Signed-off-by: Thomas Gleixner 
Cc: Pratyush Anand 
Cc: Dave Martin 
Cc: Will Drewry 
Cc: Arnd Bergmann 
Cc: Catalin Marinas 
Cc: Will Deacon 
Cc: Russell King 
Cc: Andy Lutomirski 
Cc: David Howells 
Cc: Dave Hansen 
Cc: Al Viro 
Cc: linux-api@vger.kernel.org
Cc: Yonghong Song 
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/1504798247-48833-3-git-send-email-keescook@chromium.org

Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm

2017-09-12T13:10:44+00:00

Pull ARM updates from Russell King:
 "Low priority fixes and updates for ARM:

   - add some missing includes

   - efficiency improvements in system call entry code when tracing is
     enabled

   - ensure ARMv6+ is always built as EABI

   - export save_stack_trace_tsk()

   - fix fatal signal handling during mm fault

   - build translation table base address register from scratch

   - appropriately align the .data section to a word boundary where we
     rely on that data being word aligned"

* 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm:
  ARM: 8691/1: Export save_stack_trace_tsk()
  ARM: 8692/1: mm: abort uaccess retries upon fatal signal
  ARM: 8690/1: lpae: build TTB control register value from scratch in v7_ttb_setup
  ARM: align .data section
  ARM: always enable AEABI for ARMv6+
  ARM: avoid saving and restoring registers unnecessarily
  ARM: move PC value into r9
  ARM: obtain thread info structure later
  ARM: use aliases for registers in entry-common
  ARM: 8689/1: scu: add missing errno include
  ARM: 8688/1: pm: add missing types include

ARM: avoid saving and restoring registers unnecessarily

2017-08-02T13:15:04+00:00

Avoid repeatedly saving and restoring registers around the calls to
trace_hardirqs_on() and context_tracking_user_exit().  With the
previous changes, we no longer need to preserve "lr" across these
calls, and if we re-load r0-r3 later, we can avoid preserving these
regsiters too.

Signed-off-by: Russell King

ARM: move PC value into r9

2017-08-02T13:15:04+00:00

Move the saved PC value into r9, thereby moving it into a caller-saved
register for functions that we may call during the entry to a syscall.

Signed-off-by: Russell King

ARM: obtain thread info structure later

2017-08-02T13:15:04+00:00

Obtain the thread info structure later in the syscall processing, so
that we free up a register for earlier code.

Signed-off-by: Russell King

ARM: use aliases for registers in entry-common

2017-08-02T13:15:04+00:00

Use aliases for the saved (and preserved) PSR and PC values so that we
can control which registers are used.

Signed-off-by: Russell King

arm/syscalls: Check address limit on user-mode return

2017-07-08T12:05:33+00:00

Ensure the address limit is a user-mode segment before returning to
user-mode. Otherwise a process can corrupt kernel-mode memory and
elevate privileges [1].

The set_fs function sets the TIF_SETFS flag to force a slow path on
return. In the slow path, the address limit is checked to be USER_DS if
needed.

The TIF_SETFS flag is added to _TIF_WORK_MASK shifting _TIF_SYSCALL_WORK
for arm instruction immediate support. The global work mask is too big
to used on a single instruction so adapt ret_fast_syscall.

[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=990

Signed-off-by: Thomas Garnier 
Signed-off-by: Thomas Gleixner 
Cc: Mark Rutland 
Cc: kernel-hardening@lists.openwall.com
Cc: Catalin Marinas 
Cc: Will Deacon 
Cc: David Howells 
Cc: Dave Hansen 
Cc: Miroslav Benes 
Cc: Chris Metcalf 
Cc: Pratyush Anand 
Cc: Russell King 
Cc: Petr Mladek 
Cc: Rik van Riel 
Cc: Kees Cook 
Cc: Arnd Bergmann 
Cc: Al Viro 
Cc: Andy Lutomirski 
Cc: Josh Poimboeuf 
Cc: linux-arm-kernel@lists.infradead.org
Cc: Will Drewry 
Cc: linux-api@vger.kernel.org
Cc: Oleg Nesterov 
Cc: Andy Lutomirski 
Cc: Paolo Bonzini 
Link: http://lkml.kernel.org/r/20170615011203.144108-2-thgarnie@google.com