Loading arch/x86/ia32/ia32_signal.c +195 −170 Original line number Diff line number Diff line Loading @@ -46,78 +46,83 @@ void signal_fault(struct pt_regs *regs, void __user *frame, char *where); int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from) { int err; int err = 0; if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t))) return -EFAULT; put_user_try { /* If you change siginfo_t structure, please make sure that this code is fixed accordingly. It should never copy any pad contained in the structure to avoid security leaks, but must copy the generic 3 ints plus the relevant union member. */ err = __put_user(from->si_signo, &to->si_signo); err |= __put_user(from->si_errno, &to->si_errno); err |= __put_user((short)from->si_code, &to->si_code); put_user_ex(from->si_signo, &to->si_signo); put_user_ex(from->si_errno, &to->si_errno); put_user_ex((short)from->si_code, &to->si_code); if (from->si_code < 0) { err |= __put_user(from->si_pid, &to->si_pid); err |= __put_user(from->si_uid, &to->si_uid); err |= __put_user(ptr_to_compat(from->si_ptr), &to->si_ptr); put_user_ex(from->si_pid, &to->si_pid); put_user_ex(from->si_uid, &to->si_uid); put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr); } else { /* * First 32bits of unions are always present: * si_pid === si_band === si_tid === si_addr(LS half) */ err |= __put_user(from->_sifields._pad[0], put_user_ex(from->_sifields._pad[0], &to->_sifields._pad[0]); switch (from->si_code >> 16) { case __SI_FAULT >> 16: break; case __SI_CHLD >> 16: err |= __put_user(from->si_utime, &to->si_utime); err |= __put_user(from->si_stime, &to->si_stime); err |= __put_user(from->si_status, &to->si_status); put_user_ex(from->si_utime, &to->si_utime); put_user_ex(from->si_stime, &to->si_stime); put_user_ex(from->si_status, &to->si_status); /* FALL THROUGH */ default: case __SI_KILL >> 16: err |= __put_user(from->si_uid, &to->si_uid); put_user_ex(from->si_uid, &to->si_uid); break; case __SI_POLL >> 16: err |= __put_user(from->si_fd, &to->si_fd); put_user_ex(from->si_fd, &to->si_fd); break; case __SI_TIMER >> 16: err |= __put_user(from->si_overrun, &to->si_overrun); err |= __put_user(ptr_to_compat(from->si_ptr), put_user_ex(from->si_overrun, &to->si_overrun); put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr); break; /* This is not generated by the kernel as of now. */ case __SI_RT >> 16: case __SI_MESGQ >> 16: err |= __put_user(from->si_uid, &to->si_uid); err |= __put_user(from->si_int, &to->si_int); put_user_ex(from->si_uid, &to->si_uid); put_user_ex(from->si_int, &to->si_int); break; } } } put_user_catch(err); return err; } int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) { int err; int err = 0; u32 ptr32; if (!access_ok(VERIFY_READ, from, sizeof(compat_siginfo_t))) return -EFAULT; err = __get_user(to->si_signo, &from->si_signo); err |= __get_user(to->si_errno, &from->si_errno); err |= __get_user(to->si_code, &from->si_code); get_user_try { get_user_ex(to->si_signo, &from->si_signo); get_user_ex(to->si_errno, &from->si_errno); get_user_ex(to->si_code, &from->si_code); err |= __get_user(to->si_pid, &from->si_pid); err |= __get_user(to->si_uid, &from->si_uid); err |= __get_user(ptr32, &from->si_ptr); get_user_ex(to->si_pid, &from->si_pid); get_user_ex(to->si_uid, &from->si_uid); get_user_ex(ptr32, &from->si_ptr); to->si_ptr = compat_ptr(ptr32); } get_user_catch(err); return err; } Loading @@ -142,17 +147,23 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr, struct pt_regs *regs) { stack_t uss, uoss; int ret; int ret, err = 0; mm_segment_t seg; if (uss_ptr) { u32 ptr; memset(&uss, 0, sizeof(stack_t)); if (!access_ok(VERIFY_READ, uss_ptr, sizeof(stack_ia32_t)) || __get_user(ptr, &uss_ptr->ss_sp) || __get_user(uss.ss_flags, &uss_ptr->ss_flags) || __get_user(uss.ss_size, &uss_ptr->ss_size)) if (!access_ok(VERIFY_READ, uss_ptr, sizeof(stack_ia32_t))) return -EFAULT; get_user_try { get_user_ex(ptr, &uss_ptr->ss_sp); get_user_ex(uss.ss_flags, &uss_ptr->ss_flags); get_user_ex(uss.ss_size, &uss_ptr->ss_size); } get_user_catch(err); if (err) return -EFAULT; uss.ss_sp = compat_ptr(ptr); } Loading @@ -161,10 +172,16 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr, ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp); set_fs(seg); if (ret >= 0 && uoss_ptr) { if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)) || __put_user(ptr_to_compat(uoss.ss_sp), &uoss_ptr->ss_sp) || __put_user(uoss.ss_flags, &uoss_ptr->ss_flags) || __put_user(uoss.ss_size, &uoss_ptr->ss_size)) if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t))) return -EFAULT; put_user_try { put_user_ex(ptr_to_compat(uoss.ss_sp), &uoss_ptr->ss_sp); put_user_ex(uoss.ss_flags, &uoss_ptr->ss_flags); put_user_ex(uoss.ss_size, &uoss_ptr->ss_size); } put_user_catch(err); if (err) ret = -EFAULT; } return ret; Loading @@ -174,18 +191,18 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr, * Do a signal return; undo the signal stack. */ #define COPY(x) { \ err |= __get_user(regs->x, &sc->x); \ get_user_ex(regs->x, &sc->x); \ } #define COPY_SEG_CPL3(seg) { \ unsigned short tmp; \ err |= __get_user(tmp, &sc->seg); \ get_user_ex(tmp, &sc->seg); \ regs->seg = tmp | 3; \ } #define RELOAD_SEG(seg) { \ unsigned int cur, pre; \ err |= __get_user(pre, &sc->seg); \ get_user_ex(pre, &sc->seg); \ savesegment(seg, cur); \ pre |= 3; \ if (pre != cur) \ Loading @@ -209,13 +226,14 @@ static int ia32_restore_sigcontext(struct pt_regs *regs, sc, sc->err, sc->ip, sc->cs, sc->flags); #endif get_user_try { /* * Reload fs and gs if they have changed in the signal * handler. This does not handle long fs/gs base changes in * the handler, but does not clobber them at least in the * normal case. */ err |= __get_user(gs, &sc->gs); get_user_ex(gs, &sc->gs); gs |= 3; savesegment(gs, oldgs); if (gs != oldgs) Loading @@ -232,16 +250,18 @@ static int ia32_restore_sigcontext(struct pt_regs *regs, COPY_SEG_CPL3(cs); COPY_SEG_CPL3(ss); err |= __get_user(tmpflags, &sc->flags); get_user_ex(tmpflags, &sc->flags); regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS); /* disable syscall checks */ regs->orig_ax = -1; err |= __get_user(tmp, &sc->fpstate); get_user_ex(tmp, &sc->fpstate); buf = compat_ptr(tmp); err |= restore_i387_xstate_ia32(buf); err |= __get_user(*pax, &sc->ax); get_user_ex(*pax, &sc->ax); } get_user_catch(err); return err; } Loading Loading @@ -319,36 +339,38 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc, { int tmp, err = 0; put_user_try { savesegment(gs, tmp); err |= __put_user(tmp, (unsigned int __user *)&sc->gs); put_user_ex(tmp, (unsigned int __user *)&sc->gs); savesegment(fs, tmp); err |= __put_user(tmp, (unsigned int __user *)&sc->fs); put_user_ex(tmp, (unsigned int __user *)&sc->fs); savesegment(ds, tmp); err |= __put_user(tmp, (unsigned int __user *)&sc->ds); put_user_ex(tmp, (unsigned int __user *)&sc->ds); savesegment(es, tmp); err |= __put_user(tmp, (unsigned int __user *)&sc->es); err |= __put_user(regs->di, &sc->di); err |= __put_user(regs->si, &sc->si); err |= __put_user(regs->bp, &sc->bp); err |= __put_user(regs->sp, &sc->sp); err |= __put_user(regs->bx, &sc->bx); err |= __put_user(regs->dx, &sc->dx); err |= __put_user(regs->cx, &sc->cx); err |= __put_user(regs->ax, &sc->ax); err |= __put_user(current->thread.trap_no, &sc->trapno); err |= __put_user(current->thread.error_code, &sc->err); err |= __put_user(regs->ip, &sc->ip); err |= __put_user(regs->cs, (unsigned int __user *)&sc->cs); err |= __put_user(regs->flags, &sc->flags); err |= __put_user(regs->sp, &sc->sp_at_signal); err |= __put_user(regs->ss, (unsigned int __user *)&sc->ss); err |= __put_user(ptr_to_compat(fpstate), &sc->fpstate); put_user_ex(tmp, (unsigned int __user *)&sc->es); put_user_ex(regs->di, &sc->di); put_user_ex(regs->si, &sc->si); put_user_ex(regs->bp, &sc->bp); put_user_ex(regs->sp, &sc->sp); put_user_ex(regs->bx, &sc->bx); put_user_ex(regs->dx, &sc->dx); put_user_ex(regs->cx, &sc->cx); put_user_ex(regs->ax, &sc->ax); put_user_ex(current->thread.trap_no, &sc->trapno); put_user_ex(current->thread.error_code, &sc->err); put_user_ex(regs->ip, &sc->ip); put_user_ex(regs->cs, (unsigned int __user *)&sc->cs); put_user_ex(regs->flags, &sc->flags); put_user_ex(regs->sp, &sc->sp_at_signal); put_user_ex(regs->ss, (unsigned int __user *)&sc->ss); put_user_ex(ptr_to_compat(fpstate), &sc->fpstate); /* non-iBCS2 extensions.. */ err |= __put_user(mask, &sc->oldmask); err |= __put_user(current->thread.cr2, &sc->cr2); put_user_ex(mask, &sc->oldmask); put_user_ex(current->thread.cr2, &sc->cr2); } put_user_catch(err); return err; } Loading Loading @@ -437,13 +459,17 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka, else restorer = &frame->retcode; } err |= __put_user(ptr_to_compat(restorer), &frame->pretcode); put_user_try { put_user_ex(ptr_to_compat(restorer), &frame->pretcode); /* * These are actually not used anymore, but left because some * gdb versions depend on them as a marker. */ err |= __put_user(*((u64 *)&code), (u64 *)frame->retcode); put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); } put_user_catch(err); if (err) return -EFAULT; Loading Loading @@ -496,41 +522,40 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame))) return -EFAULT; err |= __put_user(sig, &frame->sig); err |= __put_user(ptr_to_compat(&frame->info), &frame->pinfo); err |= __put_user(ptr_to_compat(&frame->uc), &frame->puc); put_user_try { put_user_ex(sig, &frame->sig); put_user_ex(ptr_to_compat(&frame->info), &frame->pinfo); put_user_ex(ptr_to_compat(&frame->uc), &frame->puc); err |= copy_siginfo_to_user32(&frame->info, info); if (err) return -EFAULT; /* Create the ucontext. */ if (cpu_has_xsave) err |= __put_user(UC_FP_XSTATE, &frame->uc.uc_flags); put_user_ex(UC_FP_XSTATE, &frame->uc.uc_flags); else err |= __put_user(0, &frame->uc.uc_flags); err |= __put_user(0, &frame->uc.uc_link); err |= __put_user(current->sas_ss_sp, &frame->uc.uc_stack.ss_sp); err |= __put_user(sas_ss_flags(regs->sp), put_user_ex(0, &frame->uc.uc_flags); put_user_ex(0, &frame->uc.uc_link); put_user_ex(current->sas_ss_sp, &frame->uc.uc_stack.ss_sp); put_user_ex(sas_ss_flags(regs->sp), &frame->uc.uc_stack.ss_flags); err |= __put_user(current->sas_ss_size, &frame->uc.uc_stack.ss_size); put_user_ex(current->sas_ss_size, &frame->uc.uc_stack.ss_size); err |= ia32_setup_sigcontext(&frame->uc.uc_mcontext, fpstate, regs, set->sig[0]); err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); if (err) return -EFAULT; if (ka->sa.sa_flags & SA_RESTORER) restorer = ka->sa.sa_restorer; else restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn); err |= __put_user(ptr_to_compat(restorer), &frame->pretcode); put_user_ex(ptr_to_compat(restorer), &frame->pretcode); /* * Not actually used anymore, but left because some gdb * versions need it. */ err |= __put_user(*((u64 *)&code), (u64 *)frame->retcode); put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); } put_user_catch(err); if (err) return -EFAULT; Loading arch/x86/include/asm/paravirt.h +0 −2 Original line number Diff line number Diff line Loading @@ -1471,8 +1471,6 @@ u64 _paravirt_ident_64(u64); #define paravirt_nop ((void *)_paravirt_nop) void paravirt_use_bytelocks(void); #ifdef CONFIG_SMP static inline int __raw_spin_is_locked(struct raw_spinlock *lock) Loading arch/x86/include/asm/spinlock.h +2 −64 Original line number Diff line number Diff line Loading @@ -172,70 +172,8 @@ static inline int __ticket_spin_is_contended(raw_spinlock_t *lock) return (((tmp >> TICKET_SHIFT) - tmp) & ((1 << TICKET_SHIFT) - 1)) > 1; } #ifdef CONFIG_PARAVIRT /* * Define virtualization-friendly old-style lock byte lock, for use in * pv_lock_ops if desired. * * This differs from the pre-2.6.24 spinlock by always using xchgb * rather than decb to take the lock; this allows it to use a * zero-initialized lock structure. It also maintains a 1-byte * contention counter, so that we can implement * __byte_spin_is_contended. */ struct __byte_spinlock { s8 lock; s8 spinners; }; static inline int __byte_spin_is_locked(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; return bl->lock != 0; } #ifndef CONFIG_PARAVIRT static inline int __byte_spin_is_contended(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; return bl->spinners != 0; } static inline void __byte_spin_lock(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; s8 val = 1; asm("1: xchgb %1, %0\n" " test %1,%1\n" " jz 3f\n" " " LOCK_PREFIX "incb %2\n" "2: rep;nop\n" " cmpb $1, %0\n" " je 2b\n" " " LOCK_PREFIX "decb %2\n" " jmp 1b\n" "3:" : "+m" (bl->lock), "+q" (val), "+m" (bl->spinners): : "memory"); } static inline int __byte_spin_trylock(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; u8 old = 1; asm("xchgb %1,%0" : "+m" (bl->lock), "+q" (old) : : "memory"); return old == 0; } static inline void __byte_spin_unlock(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; smp_wmb(); bl->lock = 0; } #else /* !CONFIG_PARAVIRT */ static inline int __raw_spin_is_locked(raw_spinlock_t *lock) { return __ticket_spin_is_locked(lock); Loading Loading @@ -267,7 +205,7 @@ static __always_inline void __raw_spin_lock_flags(raw_spinlock_t *lock, __raw_spin_lock(lock); } #endif /* CONFIG_PARAVIRT */ #endif static inline void __raw_spin_unlock_wait(raw_spinlock_t *lock) { Loading arch/x86/include/asm/thread_info.h +1 −0 Original line number Diff line number Diff line Loading @@ -40,6 +40,7 @@ struct thread_info { */ __u8 supervisor_stack[0]; #endif int uaccess_err; }; #define INIT_THREAD_INFO(tsk) \ Loading arch/x86/include/asm/uaccess.h +130 −8 Original line number Diff line number Diff line Loading @@ -186,7 +186,7 @@ extern int __get_user_bad(void); #ifdef CONFIG_X86_32 #define __put_user_u64(x, addr, err) \ #define __put_user_asm_u64(x, addr, err, errret) \ asm volatile("1: movl %%eax,0(%2)\n" \ "2: movl %%edx,4(%2)\n" \ "3:\n" \ Loading @@ -197,14 +197,24 @@ extern int __get_user_bad(void); _ASM_EXTABLE(1b, 4b) \ _ASM_EXTABLE(2b, 4b) \ : "=r" (err) \ : "A" (x), "r" (addr), "i" (-EFAULT), "0" (err)) : "A" (x), "r" (addr), "i" (errret), "0" (err)) #define __put_user_asm_ex_u64(x, addr) \ asm volatile("1: movl %%eax,0(%1)\n" \ "2: movl %%edx,4(%1)\n" \ "3:\n" \ _ASM_EXTABLE(1b, 2b - 1b) \ _ASM_EXTABLE(2b, 3b - 2b) \ : : "A" (x), "r" (addr)) #define __put_user_x8(x, ptr, __ret_pu) \ asm volatile("call __put_user_8" : "=a" (__ret_pu) \ : "A" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx") #else #define __put_user_u64(x, ptr, retval) \ __put_user_asm(x, ptr, retval, "q", "", "Zr", -EFAULT) #define __put_user_asm_u64(x, ptr, retval, errret) \ __put_user_asm(x, ptr, retval, "q", "", "Zr", errret) #define __put_user_asm_ex_u64(x, addr) \ __put_user_asm_ex(x, addr, "q", "", "Zr") #define __put_user_x8(x, ptr, __ret_pu) __put_user_x(8, x, ptr, __ret_pu) #endif Loading Loading @@ -279,7 +289,29 @@ do { \ __put_user_asm(x, ptr, retval, "l", "k", "ir", errret); \ break; \ case 8: \ __put_user_u64((__typeof__(*ptr))(x), ptr, retval); \ __put_user_asm_u64((__typeof__(*ptr))(x), ptr, retval, \ errret); \ break; \ default: \ __put_user_bad(); \ } \ } while (0) #define __put_user_size_ex(x, ptr, size) \ do { \ __chk_user_ptr(ptr); \ switch (size) { \ case 1: \ __put_user_asm_ex(x, ptr, "b", "b", "iq"); \ break; \ case 2: \ __put_user_asm_ex(x, ptr, "w", "w", "ir"); \ break; \ case 4: \ __put_user_asm_ex(x, ptr, "l", "k", "ir"); \ break; \ case 8: \ __put_user_asm_ex_u64((__typeof__(*ptr))(x), ptr); \ break; \ default: \ __put_user_bad(); \ Loading Loading @@ -311,9 +343,12 @@ do { \ #ifdef CONFIG_X86_32 #define __get_user_asm_u64(x, ptr, retval, errret) (x) = __get_user_bad() #define __get_user_asm_ex_u64(x, ptr) (x) = __get_user_bad() #else #define __get_user_asm_u64(x, ptr, retval, errret) \ __get_user_asm(x, ptr, retval, "q", "", "=r", errret) #define __get_user_asm_ex_u64(x, ptr) \ __get_user_asm_ex(x, ptr, "q", "", "=r") #endif #define __get_user_size(x, ptr, size, retval, errret) \ Loading Loading @@ -350,6 +385,33 @@ do { \ : "=r" (err), ltype(x) \ : "m" (__m(addr)), "i" (errret), "0" (err)) #define __get_user_size_ex(x, ptr, size) \ do { \ __chk_user_ptr(ptr); \ switch (size) { \ case 1: \ __get_user_asm_ex(x, ptr, "b", "b", "=q"); \ break; \ case 2: \ __get_user_asm_ex(x, ptr, "w", "w", "=r"); \ break; \ case 4: \ __get_user_asm_ex(x, ptr, "l", "k", "=r"); \ break; \ case 8: \ __get_user_asm_ex_u64(x, ptr); \ break; \ default: \ (x) = __get_user_bad(); \ } \ } while (0) #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \ asm volatile("1: mov"itype" %1,%"rtype"0\n" \ "2:\n" \ _ASM_EXTABLE(1b, 2b - 1b) \ : ltype(x) : "m" (__m(addr))) #define __put_user_nocheck(x, ptr, size) \ ({ \ int __pu_err; \ Loading Loading @@ -385,6 +447,26 @@ struct __large_struct { unsigned long buf[100]; }; _ASM_EXTABLE(1b, 3b) \ : "=r"(err) \ : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err)) #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \ asm volatile("1: mov"itype" %"rtype"0,%1\n" \ "2:\n" \ _ASM_EXTABLE(1b, 2b - 1b) \ : : ltype(x), "m" (__m(addr))) /* * uaccess_try and catch */ #define uaccess_try do { \ int prev_err = current_thread_info()->uaccess_err; \ current_thread_info()->uaccess_err = 0; \ barrier(); #define uaccess_catch(err) \ (err) |= current_thread_info()->uaccess_err; \ current_thread_info()->uaccess_err = prev_err; \ } while (0) /** * __get_user: - Get a simple variable from user space, with less checking. * @x: Variable to store result. Loading @@ -408,6 +490,7 @@ struct __large_struct { unsigned long buf[100]; }; #define __get_user(x, ptr) \ __get_user_nocheck((x), (ptr), sizeof(*(ptr))) /** * __put_user: - Write a simple value into user space, with less checking. * @x: Value to copy to user space. Loading @@ -434,6 +517,45 @@ struct __large_struct { unsigned long buf[100]; }; #define __get_user_unaligned __get_user #define __put_user_unaligned __put_user /* * {get|put}_user_try and catch * * get_user_try { * get_user_ex(...); * } get_user_catch(err) */ #define get_user_try uaccess_try #define get_user_catch(err) uaccess_catch(err) #define get_user_ex(x, ptr) do { \ unsigned long __gue_val; \ __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \ (x) = (__force __typeof__(*(ptr)))__gue_val; \ } while (0) #ifdef CONFIG_X86_WP_WORKS_OK #define put_user_try uaccess_try #define put_user_catch(err) uaccess_catch(err) #define put_user_ex(x, ptr) \ __put_user_size_ex((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr))) #else /* !CONFIG_X86_WP_WORKS_OK */ #define put_user_try do { \ int __uaccess_err = 0; #define put_user_catch(err) \ (err) |= __uaccess_err; \ } while (0) #define put_user_ex(x, ptr) do { \ __uaccess_err |= __put_user(x, ptr); \ } while (0) #endif /* CONFIG_X86_WP_WORKS_OK */ /* * movsl can be slow when source and dest are not both 8-byte aligned */ Loading Loading
arch/x86/ia32/ia32_signal.c +195 −170 Original line number Diff line number Diff line Loading @@ -46,78 +46,83 @@ void signal_fault(struct pt_regs *regs, void __user *frame, char *where); int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from) { int err; int err = 0; if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t))) return -EFAULT; put_user_try { /* If you change siginfo_t structure, please make sure that this code is fixed accordingly. It should never copy any pad contained in the structure to avoid security leaks, but must copy the generic 3 ints plus the relevant union member. */ err = __put_user(from->si_signo, &to->si_signo); err |= __put_user(from->si_errno, &to->si_errno); err |= __put_user((short)from->si_code, &to->si_code); put_user_ex(from->si_signo, &to->si_signo); put_user_ex(from->si_errno, &to->si_errno); put_user_ex((short)from->si_code, &to->si_code); if (from->si_code < 0) { err |= __put_user(from->si_pid, &to->si_pid); err |= __put_user(from->si_uid, &to->si_uid); err |= __put_user(ptr_to_compat(from->si_ptr), &to->si_ptr); put_user_ex(from->si_pid, &to->si_pid); put_user_ex(from->si_uid, &to->si_uid); put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr); } else { /* * First 32bits of unions are always present: * si_pid === si_band === si_tid === si_addr(LS half) */ err |= __put_user(from->_sifields._pad[0], put_user_ex(from->_sifields._pad[0], &to->_sifields._pad[0]); switch (from->si_code >> 16) { case __SI_FAULT >> 16: break; case __SI_CHLD >> 16: err |= __put_user(from->si_utime, &to->si_utime); err |= __put_user(from->si_stime, &to->si_stime); err |= __put_user(from->si_status, &to->si_status); put_user_ex(from->si_utime, &to->si_utime); put_user_ex(from->si_stime, &to->si_stime); put_user_ex(from->si_status, &to->si_status); /* FALL THROUGH */ default: case __SI_KILL >> 16: err |= __put_user(from->si_uid, &to->si_uid); put_user_ex(from->si_uid, &to->si_uid); break; case __SI_POLL >> 16: err |= __put_user(from->si_fd, &to->si_fd); put_user_ex(from->si_fd, &to->si_fd); break; case __SI_TIMER >> 16: err |= __put_user(from->si_overrun, &to->si_overrun); err |= __put_user(ptr_to_compat(from->si_ptr), put_user_ex(from->si_overrun, &to->si_overrun); put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr); break; /* This is not generated by the kernel as of now. */ case __SI_RT >> 16: case __SI_MESGQ >> 16: err |= __put_user(from->si_uid, &to->si_uid); err |= __put_user(from->si_int, &to->si_int); put_user_ex(from->si_uid, &to->si_uid); put_user_ex(from->si_int, &to->si_int); break; } } } put_user_catch(err); return err; } int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) { int err; int err = 0; u32 ptr32; if (!access_ok(VERIFY_READ, from, sizeof(compat_siginfo_t))) return -EFAULT; err = __get_user(to->si_signo, &from->si_signo); err |= __get_user(to->si_errno, &from->si_errno); err |= __get_user(to->si_code, &from->si_code); get_user_try { get_user_ex(to->si_signo, &from->si_signo); get_user_ex(to->si_errno, &from->si_errno); get_user_ex(to->si_code, &from->si_code); err |= __get_user(to->si_pid, &from->si_pid); err |= __get_user(to->si_uid, &from->si_uid); err |= __get_user(ptr32, &from->si_ptr); get_user_ex(to->si_pid, &from->si_pid); get_user_ex(to->si_uid, &from->si_uid); get_user_ex(ptr32, &from->si_ptr); to->si_ptr = compat_ptr(ptr32); } get_user_catch(err); return err; } Loading @@ -142,17 +147,23 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr, struct pt_regs *regs) { stack_t uss, uoss; int ret; int ret, err = 0; mm_segment_t seg; if (uss_ptr) { u32 ptr; memset(&uss, 0, sizeof(stack_t)); if (!access_ok(VERIFY_READ, uss_ptr, sizeof(stack_ia32_t)) || __get_user(ptr, &uss_ptr->ss_sp) || __get_user(uss.ss_flags, &uss_ptr->ss_flags) || __get_user(uss.ss_size, &uss_ptr->ss_size)) if (!access_ok(VERIFY_READ, uss_ptr, sizeof(stack_ia32_t))) return -EFAULT; get_user_try { get_user_ex(ptr, &uss_ptr->ss_sp); get_user_ex(uss.ss_flags, &uss_ptr->ss_flags); get_user_ex(uss.ss_size, &uss_ptr->ss_size); } get_user_catch(err); if (err) return -EFAULT; uss.ss_sp = compat_ptr(ptr); } Loading @@ -161,10 +172,16 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr, ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp); set_fs(seg); if (ret >= 0 && uoss_ptr) { if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)) || __put_user(ptr_to_compat(uoss.ss_sp), &uoss_ptr->ss_sp) || __put_user(uoss.ss_flags, &uoss_ptr->ss_flags) || __put_user(uoss.ss_size, &uoss_ptr->ss_size)) if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t))) return -EFAULT; put_user_try { put_user_ex(ptr_to_compat(uoss.ss_sp), &uoss_ptr->ss_sp); put_user_ex(uoss.ss_flags, &uoss_ptr->ss_flags); put_user_ex(uoss.ss_size, &uoss_ptr->ss_size); } put_user_catch(err); if (err) ret = -EFAULT; } return ret; Loading @@ -174,18 +191,18 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr, * Do a signal return; undo the signal stack. */ #define COPY(x) { \ err |= __get_user(regs->x, &sc->x); \ get_user_ex(regs->x, &sc->x); \ } #define COPY_SEG_CPL3(seg) { \ unsigned short tmp; \ err |= __get_user(tmp, &sc->seg); \ get_user_ex(tmp, &sc->seg); \ regs->seg = tmp | 3; \ } #define RELOAD_SEG(seg) { \ unsigned int cur, pre; \ err |= __get_user(pre, &sc->seg); \ get_user_ex(pre, &sc->seg); \ savesegment(seg, cur); \ pre |= 3; \ if (pre != cur) \ Loading @@ -209,13 +226,14 @@ static int ia32_restore_sigcontext(struct pt_regs *regs, sc, sc->err, sc->ip, sc->cs, sc->flags); #endif get_user_try { /* * Reload fs and gs if they have changed in the signal * handler. This does not handle long fs/gs base changes in * the handler, but does not clobber them at least in the * normal case. */ err |= __get_user(gs, &sc->gs); get_user_ex(gs, &sc->gs); gs |= 3; savesegment(gs, oldgs); if (gs != oldgs) Loading @@ -232,16 +250,18 @@ static int ia32_restore_sigcontext(struct pt_regs *regs, COPY_SEG_CPL3(cs); COPY_SEG_CPL3(ss); err |= __get_user(tmpflags, &sc->flags); get_user_ex(tmpflags, &sc->flags); regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS); /* disable syscall checks */ regs->orig_ax = -1; err |= __get_user(tmp, &sc->fpstate); get_user_ex(tmp, &sc->fpstate); buf = compat_ptr(tmp); err |= restore_i387_xstate_ia32(buf); err |= __get_user(*pax, &sc->ax); get_user_ex(*pax, &sc->ax); } get_user_catch(err); return err; } Loading Loading @@ -319,36 +339,38 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc, { int tmp, err = 0; put_user_try { savesegment(gs, tmp); err |= __put_user(tmp, (unsigned int __user *)&sc->gs); put_user_ex(tmp, (unsigned int __user *)&sc->gs); savesegment(fs, tmp); err |= __put_user(tmp, (unsigned int __user *)&sc->fs); put_user_ex(tmp, (unsigned int __user *)&sc->fs); savesegment(ds, tmp); err |= __put_user(tmp, (unsigned int __user *)&sc->ds); put_user_ex(tmp, (unsigned int __user *)&sc->ds); savesegment(es, tmp); err |= __put_user(tmp, (unsigned int __user *)&sc->es); err |= __put_user(regs->di, &sc->di); err |= __put_user(regs->si, &sc->si); err |= __put_user(regs->bp, &sc->bp); err |= __put_user(regs->sp, &sc->sp); err |= __put_user(regs->bx, &sc->bx); err |= __put_user(regs->dx, &sc->dx); err |= __put_user(regs->cx, &sc->cx); err |= __put_user(regs->ax, &sc->ax); err |= __put_user(current->thread.trap_no, &sc->trapno); err |= __put_user(current->thread.error_code, &sc->err); err |= __put_user(regs->ip, &sc->ip); err |= __put_user(regs->cs, (unsigned int __user *)&sc->cs); err |= __put_user(regs->flags, &sc->flags); err |= __put_user(regs->sp, &sc->sp_at_signal); err |= __put_user(regs->ss, (unsigned int __user *)&sc->ss); err |= __put_user(ptr_to_compat(fpstate), &sc->fpstate); put_user_ex(tmp, (unsigned int __user *)&sc->es); put_user_ex(regs->di, &sc->di); put_user_ex(regs->si, &sc->si); put_user_ex(regs->bp, &sc->bp); put_user_ex(regs->sp, &sc->sp); put_user_ex(regs->bx, &sc->bx); put_user_ex(regs->dx, &sc->dx); put_user_ex(regs->cx, &sc->cx); put_user_ex(regs->ax, &sc->ax); put_user_ex(current->thread.trap_no, &sc->trapno); put_user_ex(current->thread.error_code, &sc->err); put_user_ex(regs->ip, &sc->ip); put_user_ex(regs->cs, (unsigned int __user *)&sc->cs); put_user_ex(regs->flags, &sc->flags); put_user_ex(regs->sp, &sc->sp_at_signal); put_user_ex(regs->ss, (unsigned int __user *)&sc->ss); put_user_ex(ptr_to_compat(fpstate), &sc->fpstate); /* non-iBCS2 extensions.. */ err |= __put_user(mask, &sc->oldmask); err |= __put_user(current->thread.cr2, &sc->cr2); put_user_ex(mask, &sc->oldmask); put_user_ex(current->thread.cr2, &sc->cr2); } put_user_catch(err); return err; } Loading Loading @@ -437,13 +459,17 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka, else restorer = &frame->retcode; } err |= __put_user(ptr_to_compat(restorer), &frame->pretcode); put_user_try { put_user_ex(ptr_to_compat(restorer), &frame->pretcode); /* * These are actually not used anymore, but left because some * gdb versions depend on them as a marker. */ err |= __put_user(*((u64 *)&code), (u64 *)frame->retcode); put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); } put_user_catch(err); if (err) return -EFAULT; Loading Loading @@ -496,41 +522,40 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame))) return -EFAULT; err |= __put_user(sig, &frame->sig); err |= __put_user(ptr_to_compat(&frame->info), &frame->pinfo); err |= __put_user(ptr_to_compat(&frame->uc), &frame->puc); put_user_try { put_user_ex(sig, &frame->sig); put_user_ex(ptr_to_compat(&frame->info), &frame->pinfo); put_user_ex(ptr_to_compat(&frame->uc), &frame->puc); err |= copy_siginfo_to_user32(&frame->info, info); if (err) return -EFAULT; /* Create the ucontext. */ if (cpu_has_xsave) err |= __put_user(UC_FP_XSTATE, &frame->uc.uc_flags); put_user_ex(UC_FP_XSTATE, &frame->uc.uc_flags); else err |= __put_user(0, &frame->uc.uc_flags); err |= __put_user(0, &frame->uc.uc_link); err |= __put_user(current->sas_ss_sp, &frame->uc.uc_stack.ss_sp); err |= __put_user(sas_ss_flags(regs->sp), put_user_ex(0, &frame->uc.uc_flags); put_user_ex(0, &frame->uc.uc_link); put_user_ex(current->sas_ss_sp, &frame->uc.uc_stack.ss_sp); put_user_ex(sas_ss_flags(regs->sp), &frame->uc.uc_stack.ss_flags); err |= __put_user(current->sas_ss_size, &frame->uc.uc_stack.ss_size); put_user_ex(current->sas_ss_size, &frame->uc.uc_stack.ss_size); err |= ia32_setup_sigcontext(&frame->uc.uc_mcontext, fpstate, regs, set->sig[0]); err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); if (err) return -EFAULT; if (ka->sa.sa_flags & SA_RESTORER) restorer = ka->sa.sa_restorer; else restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn); err |= __put_user(ptr_to_compat(restorer), &frame->pretcode); put_user_ex(ptr_to_compat(restorer), &frame->pretcode); /* * Not actually used anymore, but left because some gdb * versions need it. */ err |= __put_user(*((u64 *)&code), (u64 *)frame->retcode); put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); } put_user_catch(err); if (err) return -EFAULT; Loading
arch/x86/include/asm/paravirt.h +0 −2 Original line number Diff line number Diff line Loading @@ -1471,8 +1471,6 @@ u64 _paravirt_ident_64(u64); #define paravirt_nop ((void *)_paravirt_nop) void paravirt_use_bytelocks(void); #ifdef CONFIG_SMP static inline int __raw_spin_is_locked(struct raw_spinlock *lock) Loading
arch/x86/include/asm/spinlock.h +2 −64 Original line number Diff line number Diff line Loading @@ -172,70 +172,8 @@ static inline int __ticket_spin_is_contended(raw_spinlock_t *lock) return (((tmp >> TICKET_SHIFT) - tmp) & ((1 << TICKET_SHIFT) - 1)) > 1; } #ifdef CONFIG_PARAVIRT /* * Define virtualization-friendly old-style lock byte lock, for use in * pv_lock_ops if desired. * * This differs from the pre-2.6.24 spinlock by always using xchgb * rather than decb to take the lock; this allows it to use a * zero-initialized lock structure. It also maintains a 1-byte * contention counter, so that we can implement * __byte_spin_is_contended. */ struct __byte_spinlock { s8 lock; s8 spinners; }; static inline int __byte_spin_is_locked(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; return bl->lock != 0; } #ifndef CONFIG_PARAVIRT static inline int __byte_spin_is_contended(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; return bl->spinners != 0; } static inline void __byte_spin_lock(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; s8 val = 1; asm("1: xchgb %1, %0\n" " test %1,%1\n" " jz 3f\n" " " LOCK_PREFIX "incb %2\n" "2: rep;nop\n" " cmpb $1, %0\n" " je 2b\n" " " LOCK_PREFIX "decb %2\n" " jmp 1b\n" "3:" : "+m" (bl->lock), "+q" (val), "+m" (bl->spinners): : "memory"); } static inline int __byte_spin_trylock(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; u8 old = 1; asm("xchgb %1,%0" : "+m" (bl->lock), "+q" (old) : : "memory"); return old == 0; } static inline void __byte_spin_unlock(raw_spinlock_t *lock) { struct __byte_spinlock *bl = (struct __byte_spinlock *)lock; smp_wmb(); bl->lock = 0; } #else /* !CONFIG_PARAVIRT */ static inline int __raw_spin_is_locked(raw_spinlock_t *lock) { return __ticket_spin_is_locked(lock); Loading Loading @@ -267,7 +205,7 @@ static __always_inline void __raw_spin_lock_flags(raw_spinlock_t *lock, __raw_spin_lock(lock); } #endif /* CONFIG_PARAVIRT */ #endif static inline void __raw_spin_unlock_wait(raw_spinlock_t *lock) { Loading
arch/x86/include/asm/thread_info.h +1 −0 Original line number Diff line number Diff line Loading @@ -40,6 +40,7 @@ struct thread_info { */ __u8 supervisor_stack[0]; #endif int uaccess_err; }; #define INIT_THREAD_INFO(tsk) \ Loading
arch/x86/include/asm/uaccess.h +130 −8 Original line number Diff line number Diff line Loading @@ -186,7 +186,7 @@ extern int __get_user_bad(void); #ifdef CONFIG_X86_32 #define __put_user_u64(x, addr, err) \ #define __put_user_asm_u64(x, addr, err, errret) \ asm volatile("1: movl %%eax,0(%2)\n" \ "2: movl %%edx,4(%2)\n" \ "3:\n" \ Loading @@ -197,14 +197,24 @@ extern int __get_user_bad(void); _ASM_EXTABLE(1b, 4b) \ _ASM_EXTABLE(2b, 4b) \ : "=r" (err) \ : "A" (x), "r" (addr), "i" (-EFAULT), "0" (err)) : "A" (x), "r" (addr), "i" (errret), "0" (err)) #define __put_user_asm_ex_u64(x, addr) \ asm volatile("1: movl %%eax,0(%1)\n" \ "2: movl %%edx,4(%1)\n" \ "3:\n" \ _ASM_EXTABLE(1b, 2b - 1b) \ _ASM_EXTABLE(2b, 3b - 2b) \ : : "A" (x), "r" (addr)) #define __put_user_x8(x, ptr, __ret_pu) \ asm volatile("call __put_user_8" : "=a" (__ret_pu) \ : "A" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx") #else #define __put_user_u64(x, ptr, retval) \ __put_user_asm(x, ptr, retval, "q", "", "Zr", -EFAULT) #define __put_user_asm_u64(x, ptr, retval, errret) \ __put_user_asm(x, ptr, retval, "q", "", "Zr", errret) #define __put_user_asm_ex_u64(x, addr) \ __put_user_asm_ex(x, addr, "q", "", "Zr") #define __put_user_x8(x, ptr, __ret_pu) __put_user_x(8, x, ptr, __ret_pu) #endif Loading Loading @@ -279,7 +289,29 @@ do { \ __put_user_asm(x, ptr, retval, "l", "k", "ir", errret); \ break; \ case 8: \ __put_user_u64((__typeof__(*ptr))(x), ptr, retval); \ __put_user_asm_u64((__typeof__(*ptr))(x), ptr, retval, \ errret); \ break; \ default: \ __put_user_bad(); \ } \ } while (0) #define __put_user_size_ex(x, ptr, size) \ do { \ __chk_user_ptr(ptr); \ switch (size) { \ case 1: \ __put_user_asm_ex(x, ptr, "b", "b", "iq"); \ break; \ case 2: \ __put_user_asm_ex(x, ptr, "w", "w", "ir"); \ break; \ case 4: \ __put_user_asm_ex(x, ptr, "l", "k", "ir"); \ break; \ case 8: \ __put_user_asm_ex_u64((__typeof__(*ptr))(x), ptr); \ break; \ default: \ __put_user_bad(); \ Loading Loading @@ -311,9 +343,12 @@ do { \ #ifdef CONFIG_X86_32 #define __get_user_asm_u64(x, ptr, retval, errret) (x) = __get_user_bad() #define __get_user_asm_ex_u64(x, ptr) (x) = __get_user_bad() #else #define __get_user_asm_u64(x, ptr, retval, errret) \ __get_user_asm(x, ptr, retval, "q", "", "=r", errret) #define __get_user_asm_ex_u64(x, ptr) \ __get_user_asm_ex(x, ptr, "q", "", "=r") #endif #define __get_user_size(x, ptr, size, retval, errret) \ Loading Loading @@ -350,6 +385,33 @@ do { \ : "=r" (err), ltype(x) \ : "m" (__m(addr)), "i" (errret), "0" (err)) #define __get_user_size_ex(x, ptr, size) \ do { \ __chk_user_ptr(ptr); \ switch (size) { \ case 1: \ __get_user_asm_ex(x, ptr, "b", "b", "=q"); \ break; \ case 2: \ __get_user_asm_ex(x, ptr, "w", "w", "=r"); \ break; \ case 4: \ __get_user_asm_ex(x, ptr, "l", "k", "=r"); \ break; \ case 8: \ __get_user_asm_ex_u64(x, ptr); \ break; \ default: \ (x) = __get_user_bad(); \ } \ } while (0) #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \ asm volatile("1: mov"itype" %1,%"rtype"0\n" \ "2:\n" \ _ASM_EXTABLE(1b, 2b - 1b) \ : ltype(x) : "m" (__m(addr))) #define __put_user_nocheck(x, ptr, size) \ ({ \ int __pu_err; \ Loading Loading @@ -385,6 +447,26 @@ struct __large_struct { unsigned long buf[100]; }; _ASM_EXTABLE(1b, 3b) \ : "=r"(err) \ : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err)) #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \ asm volatile("1: mov"itype" %"rtype"0,%1\n" \ "2:\n" \ _ASM_EXTABLE(1b, 2b - 1b) \ : : ltype(x), "m" (__m(addr))) /* * uaccess_try and catch */ #define uaccess_try do { \ int prev_err = current_thread_info()->uaccess_err; \ current_thread_info()->uaccess_err = 0; \ barrier(); #define uaccess_catch(err) \ (err) |= current_thread_info()->uaccess_err; \ current_thread_info()->uaccess_err = prev_err; \ } while (0) /** * __get_user: - Get a simple variable from user space, with less checking. * @x: Variable to store result. Loading @@ -408,6 +490,7 @@ struct __large_struct { unsigned long buf[100]; }; #define __get_user(x, ptr) \ __get_user_nocheck((x), (ptr), sizeof(*(ptr))) /** * __put_user: - Write a simple value into user space, with less checking. * @x: Value to copy to user space. Loading @@ -434,6 +517,45 @@ struct __large_struct { unsigned long buf[100]; }; #define __get_user_unaligned __get_user #define __put_user_unaligned __put_user /* * {get|put}_user_try and catch * * get_user_try { * get_user_ex(...); * } get_user_catch(err) */ #define get_user_try uaccess_try #define get_user_catch(err) uaccess_catch(err) #define get_user_ex(x, ptr) do { \ unsigned long __gue_val; \ __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \ (x) = (__force __typeof__(*(ptr)))__gue_val; \ } while (0) #ifdef CONFIG_X86_WP_WORKS_OK #define put_user_try uaccess_try #define put_user_catch(err) uaccess_catch(err) #define put_user_ex(x, ptr) \ __put_user_size_ex((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr))) #else /* !CONFIG_X86_WP_WORKS_OK */ #define put_user_try do { \ int __uaccess_err = 0; #define put_user_catch(err) \ (err) |= __uaccess_err; \ } while (0) #define put_user_ex(x, ptr) do { \ __uaccess_err |= __put_user(x, ptr); \ } while (0) #endif /* CONFIG_X86_WP_WORKS_OK */ /* * movsl can be slow when source and dest are not both 8-byte aligned */ Loading