Commit 2b15b71c authored by Helge Deller's avatar Helge Deller Committed by Cheng Yu
Browse files

parisc: Implement __get/put_kernel_nofault() 

mainline inclusion
from mainline-v5.15-rc1
commit 67102872
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GP
CVE: CVE-2024-26706

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=671028728083e856e9919221b109e3b2cd2ccc49



--------------------------------

Remove CONFIG_SET_FS from parisc, so we need to add
__get_kernel_nofault() and __put_kernel_nofault(), define
HAVE_GET_KERNEL_NOFAULT and remove set_fs(), get_fs(), load_sr2(),
thread_info->addr_limit, KERNEL_DS and USER_DS.

The nice side-effect of this patch is that we now can directly access
userspace via sr3 without the need to use a temporary sr2 which is
either copied from sr3 or set to zero (for kernel space).

Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Suggested-by: default avatarArnd Bergmann <arnd@kernel.org>
Signed-off-by: default avatarCheng Yu <serein.chengyu@huawei.com>
parent c222502b

arch/parisc/Kconfig

+0 −1
Original line number Diff line number Diff line
@@ -64,7 +64,6 @@ config PARISC 
	select HAVE_FTRACE_MCOUNT_RECORD if HAVE_DYNAMIC_FTRACE

	select HAVE_KPROBES_ON_FTRACE

	select HAVE_DYNAMIC_FTRACE_WITH_REGS

	select SET_FS



	help

	  The PA-RISC microprocessor is designed by Hewlett-Packard and used

arch/parisc/include/asm/processor.h

+0 −4
Original line number Diff line number Diff line
@@ -104,10 +104,6 @@ DECLARE_PER_CPU(struct cpuinfo_parisc, cpu_data); 


#define CPU_HVERSION ((boot_cpu_data.hversion >> 4) & 0x0FFF)



typedef struct {

	int seg;  

} mm_segment_t;



#define ARCH_MIN_TASKALIGN	8



struct thread_struct {

arch/parisc/include/asm/thread_info.h

+0 −2
Original line number Diff line number Diff line
@@ -11,7 +11,6 @@ 
struct thread_info {

	struct task_struct *task;	/* main task structure */

	unsigned long flags;		/* thread_info flags (see TIF_*) */

	mm_segment_t addr_limit;	/* user-level address space limit */

	__u32 cpu;			/* current CPU */

	int preempt_count;		/* 0=premptable, <0=BUG; will also serve as bh-counter */

};
@@ -21,7 +20,6 @@ struct thread_info { 
	.task		= &tsk,			\

	.flags		= 0,			\

	.cpu		= 0,			\

	.addr_limit	= KERNEL_DS,		\

	.preempt_count	= INIT_PREEMPT_COUNT,	\

}

arch/parisc/include/asm/uaccess.h

+61 −61
Original line number Diff line number Diff line
@@ -11,14 +11,6 @@ 
#include <linux/bug.h>

#include <linux/string.h>



#define KERNEL_DS	((mm_segment_t){0})

#define USER_DS 	((mm_segment_t){1})



#define uaccess_kernel() (get_fs().seg == KERNEL_DS.seg)



#define get_fs()	(current_thread_info()->addr_limit)

#define set_fs(x)	(current_thread_info()->addr_limit = (x))



/*

 * Note that since kernel addresses are in a separate address space on

 * parisc, we don't need to do anything for access_ok().
@@ -33,11 +25,11 @@ 
#define get_user __get_user



#if !defined(CONFIG_64BIT)

#define LDD_USER(val, ptr)	__get_user_asm64(val, ptr)

#define STD_USER(x, ptr)	__put_user_asm64(x, ptr)

#define LDD_USER(sr, val, ptr)	__get_user_asm64(sr, val, ptr)

#define STD_USER(sr, x, ptr)	__put_user_asm64(sr, x, ptr)

#else

#define LDD_USER(val, ptr)	__get_user_asm(val, "ldd", ptr)

#define STD_USER(x, ptr)	__put_user_asm("std", x, ptr)

#define LDD_USER(sr, val, ptr)	__get_user_asm(sr, val, "ldd", ptr)

#define STD_USER(sr, x, ptr)	__put_user_asm(sr, "std", x, ptr)

#endif



/*
@@ -70,28 +62,15 @@ struct exception_table_entry { 
#define ASM_EXCEPTIONTABLE_ENTRY_EFAULT( fault_addr, except_addr )\

	ASM_EXCEPTIONTABLE_ENTRY( fault_addr, except_addr + 1)



/*

 * load_sr2() preloads the space register %%sr2 - based on the value of

 * get_fs() - with either a value of 0 to access kernel space (KERNEL_DS which

 * is 0), or with the current value of %%sr3 to access user space (USER_DS)

 * memory. The following __get_user_asm() and __put_user_asm() functions have

 * %%sr2 hard-coded to access the requested memory.

 */

#define load_sr2() \

	__asm__(" or,=  %0,%%r0,%%r0\n\t"	\

		" mfsp %%sr3,%0\n\t"		\

		" mtsp %0,%%sr2\n\t"		\

		: : "r"(get_fs()) : )



#define __get_user_internal(val, ptr)			\

#define __get_user_internal(sr, val, ptr)		\

({							\

	ASM_EXCEPTIONTABLE_VAR(__gu_err);		\

							\

	switch (sizeof(*(ptr))) {			\

	case 1: __get_user_asm(val, "ldb", ptr); break;	\

	case 2: __get_user_asm(val, "ldh", ptr); break; \

	case 4: __get_user_asm(val, "ldw", ptr); break; \

	case 8: LDD_USER(val, ptr); break;		\

	case 1: __get_user_asm(sr, val, "ldb", ptr); break; \

	case 2: __get_user_asm(sr, val, "ldh", ptr); break; \

	case 4: __get_user_asm(sr, val, "ldw", ptr); break; \

	case 8: LDD_USER(sr, val, ptr); break;		\

	default: BUILD_BUG();				\

	}						\

							\
@@ -100,15 +79,14 @@ struct exception_table_entry { 


#define __get_user(val, ptr)				\

({							\

	load_sr2();					\

	__get_user_internal(val, ptr);			\

	__get_user_internal("%%sr3,", val, ptr);	\

})



#define __get_user_asm(val, ldx, ptr)			\

#define __get_user_asm(sr, val, ldx, ptr)		\

{							\

	register long __gu_val;				\

							\

	__asm__("1: " ldx " 0(%%sr2,%2),%0\n"		\

	__asm__("1: " ldx " 0(" sr "%2),%0\n"		\

		"9:\n"					\

		ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)	\

		: "=r"(__gu_val), "=r"(__gu_err)        \
@@ -117,9 +95,22 @@ struct exception_table_entry { 
	(val) = (__force __typeof__(*(ptr))) __gu_val;	\

}



#define HAVE_GET_KERNEL_NOFAULT

#define __get_kernel_nofault(dst, src, type, err_label)	\

{							\

	type __z;					\

	long __err;					\

	__err = __get_user_internal("%%sr0,", __z, (type *)(src)); \

	if (unlikely(__err))				\

		goto err_label;				\

	else						\

		*(type *)(dst) = __z;			\

}





#if !defined(CONFIG_64BIT)



#define __get_user_asm64(val, ptr)			\

#define __get_user_asm64(sr, val, ptr)			\

{							\

	union {						\

		unsigned long long	l;		\
@@ -127,8 +118,8 @@ struct exception_table_entry { 
	} __gu_tmp;					\

							\

	__asm__("   copy %%r0,%R0\n"			\

		"1: ldw 0(%%sr2,%2),%0\n"		\

		"2: ldw 4(%%sr2,%2),%R0\n"		\

		"1: ldw 0(" sr "%2),%0\n"		\

		"2: ldw 4(" sr "%2),%R0\n"		\

		"9:\n"					\

		ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)	\

		ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b)	\
@@ -141,16 +132,16 @@ struct exception_table_entry { 
#endif /* !defined(CONFIG_64BIT) */





#define __put_user_internal(x, ptr)				\

#define __put_user_internal(sr, x, ptr)				\

({								\

	ASM_EXCEPTIONTABLE_VAR(__pu_err);		      	\

        __typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x);	\

								\

	switch (sizeof(*(ptr))) {				\

	case 1: __put_user_asm("stb", __x, ptr); break;		\

	case 2: __put_user_asm("sth", __x, ptr); break;		\

	case 4: __put_user_asm("stw", __x, ptr); break;		\

	case 8: STD_USER(__x, ptr); break;			\

	case 1: __put_user_asm(sr, "stb", __x, ptr); break;	\

	case 2: __put_user_asm(sr, "sth", __x, ptr); break;	\

	case 4: __put_user_asm(sr, "stw", __x, ptr); break;	\

	case 8: STD_USER(sr, __x, ptr); break;			\

	default: BUILD_BUG();					\

	}							\

								\
@@ -159,10 +150,20 @@ struct exception_table_entry { 


#define __put_user(x, ptr)					\

({								\

	load_sr2();						\

	__put_user_internal(x, ptr);				\

	__put_user_internal("%%sr3,", x, ptr);			\

})



#define __put_kernel_nofault(dst, src, type, err_label)		\

{								\

	type __z = *(type *)(src);				\

	long __err;						\

	__err = __put_user_internal("%%sr0,", __z, (type *)(dst)); \

	if (unlikely(__err))					\

		goto err_label;					\

}









/*

 * The "__put_user/kernel_asm()" macros tell gcc they read from memory
@@ -174,9 +175,9 @@ struct exception_table_entry { 
 * is already listed as input and output register.

 */



#define __put_user_asm(stx, x, ptr)                         \

#define __put_user_asm(sr, stx, x, ptr)				\

	__asm__ __volatile__ (					\

		"1: " stx " %2,0(%%sr2,%1)\n"		    \

		"1: " stx " %2,0(" sr "%1)\n"			\

		"9:\n"						\

		ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)		\

		: "=r"(__pu_err)				\
@@ -185,10 +186,10 @@ struct exception_table_entry { 


#if !defined(CONFIG_64BIT)



#define __put_user_asm64(__val, ptr) do {	    	    \

#define __put_user_asm64(sr, __val, ptr) do {			\

	__asm__ __volatile__ (					\

		"1: stw %2,0(%%sr2,%1)\n"		    \

		"2: stw %R2,4(%%sr2,%1)\n"		    \

		"1: stw %2,0(" sr "%1)\n"			\

		"2: stw %R2,4(" sr "%1)\n"			\

		"9:\n"						\

		ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)		\

		ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b)		\
@@ -204,12 +205,11 @@ struct exception_table_entry { 
 */



extern long strncpy_from_user(char *, const char __user *, long);

extern unsigned lclear_user(void __user *, unsigned long);

extern __must_check unsigned lclear_user(void __user *, unsigned long);

extern __must_check long strnlen_user(const char __user *src, long n);

/*

 * Complex access routines -- macros

 */

#define user_addr_max() (~0UL)



#define clear_user lclear_user

#define __clear_user lclear_user

arch/parisc/kernel/asm-offsets.c

+0 −1
Original line number Diff line number Diff line
@@ -231,7 +231,6 @@ int main(void) 
	DEFINE(TI_TASK, offsetof(struct thread_info, task));

	DEFINE(TI_FLAGS, offsetof(struct thread_info, flags));

	DEFINE(TI_CPU, offsetof(struct thread_info, cpu));

	DEFINE(TI_SEGMENT, offsetof(struct thread_info, addr_limit));

	DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count));

	DEFINE(THREAD_SZ, sizeof(struct thread_info));

	/* THREAD_SZ_ALGN includes space for a stack frame. */