1. 01 Apr, 2020 2 commits
    • Nicholas Piggin's avatar
      powerpc/64: mark emergency stacks valid to unwind · a2e36683
      Nicholas Piggin authored
      Before:
      
        WARNING: CPU: 0 PID: 494 at arch/powerpc/kernel/irq.c:343
        CPU: 0 PID: 494 Comm: a Tainted: G        W
        NIP:  c00000000001ed2c LR: c000000000d13190 CTR: c00000000003f910
        REGS: c0000001fffd3870 TRAP: 0700   Tainted: G        W
        MSR:  8000000000021003 <SF,ME,RI,LE>  CR: 28000488  XER: 00000000
        CFAR: c00000000001ec90 IRQMASK: 0
        GPR00: c000000000aeb12c c0000001fffd3b00 c0000000012ba300 0000000000000000
        GPR04: 0000000000000000 0000000000000000 000000010bd207c8 6b00696e74657272
        GPR08: 0000000000000000 0000000000000000 0000000000000000 efbeadde00000000
        GPR12: 0000000000000000 c0000000014a0000 0000000000000000 0000000000000000
        GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
        GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
        GPR24: 0000000000000000 0000000000000000 0000000000000000 000000010bd207bc
        GPR28: 0000000000000000 c00000000148a898 0000000000000000 c0000001ffff3f50
        NIP [c00000000001ed2c] arch_local_irq_restore.part.0+0xac/0x100
        LR [c000000000d13190] _raw_spin_unlock_irqrestore+0x50/0xc0
        Call Trace:
        Instruction dump:
        60000000 7d2000a6 71298000 41820068 39200002 7d210164 4bffff9c 60000000
        60000000 7d2000a6 71298000 4c820020 <0fe00000> 4e800020 60000000 60000000
      
      After:
      
        WARNING: CPU: 0 PID: 499 at arch/powerpc/kernel/irq.c:343
        CPU: 0 PID: 499 Comm: a Not tainted
        NIP:  c00000000001ed2c LR: c000000000d13210 CTR: c00000000003f980
        REGS: c0000001fffd3870 TRAP: 0700   Not tainted
        MSR:  8000000000021003 <SF,ME,RI,LE>  CR: 28000488  XER: 00000000
        CFAR: c00000000001ec90 IRQMASK: 0
        GPR00: c000000000aeb1ac c0000001fffd3b00 c0000000012ba300 0000000000000000
        GPR04: 0000000000000000 0000000000000000 00000001347607c8 6b00696e74657272
        GPR08: 0000000000000000 0000000000000000 0000000000000000 efbeadde00000000
        GPR12: 0000000000000000 c0000000014a0000 0000000000000000 0000000000000000
        GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
        GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
        GPR24: 0000000000000000 0000000000000000 0000000000000000 00000001347607bc
        GPR28: 0000000000000000 c00000000148a898 0000000000000000 c0000001ffff3f50
        NIP [c00000000001ed2c] arch_local_irq_restore.part.0+0xac/0x100
        LR [c000000000d13210] _raw_spin_unlock_irqrestore+0x50/0xc0
        Call Trace:
        [c0000001fffd3b20] [c000000000aeb1ac] of_find_property+0x6c/0x90
        [c0000001fffd3b70] [c000000000aeb1f0] of_get_property+0x20/0x40
        [c0000001fffd3b90] [c000000000042cdc] rtas_token+0x3c/0x70
        [c0000001fffd3bb0] [c0000000000dc318] fwnmi_release_errinfo+0x28/0x70
        [c0000001fffd3c10] [c0000000000dcd8c] pseries_machine_check_realmode+0x1dc/0x540
        [c0000001fffd3cd0] [c00000000003fe04] machine_check_early+0x54/0x70
        [c0000001fffd3d00] [c000000000008384] machine_check_early_common+0x134/0x1f0
        --- interrupt: 200 at 0x1347607c8
            LR = 0x7fffafbd8328
        Instruction dump:
        60000000 7d2000a6 71298000 41820068 39200002 7d210164 4bffff9c 60000000
        60000000 7d2000a6 71298000 4c820020 <0fe00000> 4e800020 60000000 60000000
      Signed-off-by: default avatarNicholas Piggin <npiggin@gmail.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/20200325104144.158362-1-npiggin@gmail.com
      a2e36683
    • Michael Ellerman's avatar
      powerpc/64/tm: Don't let userspace set regs->trap via sigreturn · c7def7fb
      Michael Ellerman authored
      In restore_tm_sigcontexts() we take the trap value directly from the
      user sigcontext with no checking:
      
      	err |= __get_user(regs->trap, &sc->gp_regs[PT_TRAP]);
      
      This means we can be in the kernel with an arbitrary regs->trap value.
      
      Although that's not immediately problematic, there is a risk we could
      trigger one of the uses of CHECK_FULL_REGS():
      
      	#define CHECK_FULL_REGS(regs)	BUG_ON(regs->trap & 1)
      
      It can also cause us to unnecessarily save non-volatile GPRs again in
      save_nvgprs(), which shouldn't be problematic but is still wrong.
      
      It's also possible it could trick the syscall restart machinery, which
      relies on regs->trap not being == 0xc00 (see 9a81c16b ("powerpc:
      fix double syscall restarts")), though I haven't been able to make
      that happen.
      
      Finally it doesn't match the behaviour of the non-TM case, in
      restore_sigcontext() which zeroes regs->trap.
      
      So change restore_tm_sigcontexts() to zero regs->trap.
      
      This was discovered while testing Nick's upcoming rewrite of the
      syscall entry path. In that series the call to save_nvgprs() prior to
      signal handling (do_notify_resume()) is removed, which leaves the
      low-bit of regs->trap uncleared which can then trigger the FULL_REGS()
      WARNs in setup_tm_sigcontexts().
      
      Fixes: 2b0a576d ("powerpc: Add new transactional memory state to the signal context")
      Cc: stable@vger.kernel.org # v3.9+
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/20200401023836.3286664-1-mpe@ellerman.id.au
      c7def7fb
  2. 27 Mar, 2020 3 commits
  3. 26 Mar, 2020 17 commits
  4. 25 Mar, 2020 18 commits