linux.git/arch/s390/kernel/process.c, branch v5.10.258

arch: setup PF_IO_WORKER threads like PF_KTHREAD

2023-01-04T10:39:22+00:00

[ Upstream commit 4727dc20e0422211a0e0c72b1ace4ed6096df8a6 ]

PF_IO_WORKER are kernel threads too, but they aren't PF_KTHREAD in the
sense that we don't assign ->set_child_tid with our own structure. Just
ensure that every arch sets up the PF_IO_WORKER threads like kthreads
in the arch implementation of copy_thread().

Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

s390: fix double free of GS and RI CBs on fork() failure

2022-08-31T15:15:23+00:00

commit 13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9 upstream.

The pointers for guarded storage and runtime instrumentation control
blocks are stored in the thread_struct of the associated task. These
pointers are initially copied on fork() via arch_dup_task_struct()
and then cleared via copy_thread() before fork() returns. If fork()
happens to fail after the initial task dup and before copy_thread(),
the newly allocated task and associated thread_struct memory are
freed via free_task() -> arch_release_task_struct(). This results in
a double free of the guarded storage and runtime info structs
because the fields in the failed task still refer to memory
associated with the source task.

This problem can manifest as a BUG_ON() in set_freepointer() (with
CONFIG_SLAB_FREELIST_HARDENED enabled) or KASAN splat (if enabled)
when running trinity syscall fuzz tests on s390x. To avoid this
problem, clear the associated pointer fields in
arch_dup_task_struct() immediately after the new task is copied.
Note that the RI flag is still cleared in copy_thread() because it
resides in thread stack memory and that is where stack info is
copied.

Signed-off-by: Brian Foster 
Fixes: 8d9047f8b967c ("s390/runtime instrumentation: simplify task exit handling")
Fixes: 7b83c6297d2fc ("s390/guarded storage: simplify task exit handling")
Cc:  # 4.15
Reviewed-by: Gerald Schaefer 
Reviewed-by: Heiko Carstens 
Link: https://lore.kernel.org/r/20220816155407.537372-1-bfoster@redhat.com
Signed-off-by: Vasily Gorbik 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2020-08-09T20:33:54+00:00

Pull regset conversion fix from Al Viro:
 "Fix a regression from an unnoticed bisect hazard in the regset series.

  A bunch of old (aout, originally) primitives used by coredumps became
  dead code after fdpic conversion to regsets. Removal of that dead code
  had been the first commit in the followups to regset series;
  unfortunately, it happened to hide the bisect hazard on sh (extern for
  fpregs_get() had not been updated in the main series when it should
  have been; followup simply made fpregs_get() static). And without that
  followup commit this bisect hazard became breakage in the mainline"

Tested-by: John Paul Adrian Glaubitz 

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  kill unused dump_fpu() instances

kill unused dump_fpu() instances

2020-07-27T18:33:10+00:00

dump_fpu() is used only on the architectures that support elf
and have neither CORE_DUMP_USE_REGSET nor ELF_CORE_COPY_FPREGS
defined.

Currently that's csky, m68k, microblaze, nds32 and unicore32.  The rest
of the instances are dead code.

NB: THIS MUST GO AFTER ELF_FDPIC CONVERSION

Signed-off-by: Al Viro

arch: rename copy_thread_tls() back to copy_thread()

2020-07-04T21:41:37+00:00

Now that HAVE_COPY_THREAD_TLS has been removed, rename copy_thread_tls()
back simply copy_thread(). It's a simpler name, and doesn't imply that only
tls is copied here. This finishes an outstanding chunk of internal process
creation work since we've added clone3().

Cc: linux-arch@vger.kernel.org
Acked-by: Thomas Bogendoerfer A
Acked-by: Stafford Horne 
Acked-by: Greentime Hu 
Acked-by: Geert Uytterhoeven A
Reviewed-by: Kees Cook 
Signed-off-by: Christian Brauner

s390: prevent leaking kernel address in BEAR

2020-03-10T14:16:25+00:00

When userspace executes a syscall or gets interrupted,
BEAR contains a kernel address when returning to userspace.
This make it pretty easy to figure out where the kernel is
mapped even with KASLR enabled. To fix this, add lpswe to
lowcore and always execute it there, so userspace sees only
the lowcore address of lpswe. For this we have to extend
both critical_cleanup and the SWITCH_ASYNC macro to also check
for lpswe addresses in lowcore.

Fixes: b2d24b97b2a9 ("s390/kernel: add support for kernel address space layout randomization (KASLR)")
Cc:  # v5.2+
Reviewed-by: Gerald Schaefer 
Signed-off-by: Sven Schnelle 
Signed-off-by: Vasily Gorbik

s390/process: avoid custom stack unwinding in get_wchan

2019-10-31T16:20:53+00:00

Currently get_wchan uses custom stack unwinding implementation which
relies on back_chain presence. Replace it with more abstract stack
unwinding api usage.

Suggested-by: Ilya Leoshkevich 
Reviewed-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik

s390/kasan: avoid report in get_wchan

2019-08-21T10:58:53+00:00

Reading other running task's stack can be a dangerous endeavor. Kasan
stack memory access instrumentation includes special prologue and epilogue
to mark/remove red zones in shadow memory between stack variables. For
that reason there is always a race between a task reading value in other
task's stack and that other task returning from a function and entering
another one generating different red zones pattern.

To avoid kasan reports simply perform uninstrumented memory reads.

Acked-by: Ilya Leoshkevich 
Signed-off-by: Vasily Gorbik

s390/process: avoid potential reading of freed stack

2019-08-21T10:58:52+00:00

With THREAD_INFO_IN_TASK (which is selected on s390) task's stack usage
is refcounted and should always be protected by get/put when touching
other task's stack to avoid race conditions with task's destruction code.

Fixes: d5c352cdd022 ("s390: move thread_info into task_struct")
Cc: stable@vger.kernel.org # v4.10+
Acked-by: Ilya Leoshkevich 
Signed-off-by: Vasily Gorbik

s390/unwind: introduce stack unwind API

2019-05-02T11:54:11+00:00

Rework the dump_trace() stack unwinder interface to support different
unwinding algorithms. The new interface looks like this:

	struct unwind_state state;
	unwind_for_each_frame(&state, task, regs, start_stack)
		do_something(state.sp, state.ip, state.reliable);

The unwind_bc.c file contains the implementation for the classic
back-chain unwinder.

One positive side effect of the new code is it now handles ftraced
functions gracefully. It prints the real name of the return function
instead of 'return_to_handler'.

Signed-off-by: Martin Schwidefsky