From patchwork Thu Apr 12 11:11:06 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133205 Delivered-To: patch@linaro.org Received: by 10.46.84.29 with SMTP id i29csp1571511ljb; Thu, 12 Apr 2018 04:12:29 -0700 (PDT) X-Google-Smtp-Source: AIpwx49XRjMmpJZPdeHek2VaQGrTWQY+RdoBwqjOPoeV3tll50+07oPbWlFO7VSiVBRBnkJsOYjB X-Received: by 10.99.95.84 with SMTP id t81mr353936pgb.400.1523531548975; Thu, 12 Apr 2018 04:12:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523531548; cv=none; d=google.com; s=arc-20160816; b=REU/801+BDA13KvrO42CgYuCYqdDUz5T7U60+ekf1mWy+1c+uRhKDyZaRddzDdjVwn /mpC5wqp5MQXkH2DaRapYe3WK3zhRsSCZUNOoIGp0m2gSm7jBOn1Wz5iwSS2iDE4K8ox mlxhRuPoRjnwj8oYV6sHLckmQ8Cp9L56Z00NUvll4U06MpRjHCviCwJRjqlUwmcZQtDf 1Orz0frdzbrLIrbR1KjXva8MELTau3/po2bQxm8YXmzIwZxIVOI0bW9hMOlzmWjbCUIs 2sbNZhz5qSAqI1MFzE0q/9ym9v7N9Op8GSU7U95dpDyTOhHNpFgjWvxxBcMkXw8XEtYV vDnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=fKqbiQE1qiEV3TLBqX2nrkwJIYFH7YlobTS3rwVHfjI=; b=lsNHZKeDfDEzYsHFJ9kgri8g4+tBeP1FvOBlTNzlgZwPdgtk0KQzFILodIGncsSv29 tzm5FFBgUE2Qo3YsAUt0LeuRYSV7OlfgEnukHjNfmqCJyZiReXpGEimXv1jSFPvlBzTS mgL5AWk6qAcU6iSqypDu1AP9M9XfhEVTM10Xd7o4d7OYnO+3YKts8uF7iTWpKt/V2Ej2 uO6x+oj5YlOGuIArS5JFoTfjAIqa4M/YN+qZFaacPTkkBRR7G9enFsrIc3VQJ3uaVeD3 etuI1sBhEW+StuKYneRy21v70TMZPe9ymEikvKKhMnmELrclmq9ZPx3ZewAu4o9bWNgu hM6Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id bg3-v6si3001807plb.118.2018.04.12.04.12.28; Thu, 12 Apr 2018 04:12:28 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752752AbeDLLM2 (ORCPT + 11 others); Thu, 12 Apr 2018 07:12:28 -0400 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:59386 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752428AbeDLLM1 (ORCPT ); Thu, 12 Apr 2018 07:12:27 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 8D16D80D; Thu, 12 Apr 2018 04:12:27 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id E307E3F24A; Thu, 12 Apr 2018 04:12:25 -0700 (PDT) From: Mark Rutland To: stable@vger.kernel.org Cc: mark.brown@linaro.org, ard.biesheuvel@linaro.org, marc.zyngier@arm.com, will.deacon@arm.com, catalin.marinas@arm.com, ghackmann@google.com, shankerd@codeaurora.org Subject: [PATCH v4.9.y 10/42] arm64: futex: Mask __user pointers prior to dereference Date: Thu, 12 Apr 2018 12:11:06 +0100 Message-Id: <20180412111138.40990-11-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180412111138.40990-1-mark.rutland@arm.com> References: <20180412111138.40990-1-mark.rutland@arm.com> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Will Deacon commit 91b2d3442f6a44dce875670d702af22737ad5eff upstream. The arm64 futex code has some explicit dereferencing of user pointers where performing atomic operations in response to a futex command. This patch uses masking to limit any speculative futex operations to within the user address space. Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas Signed-off-by: Mark Rutland [v4.9 backport] --- arch/arm64/include/asm/futex.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) -- 2.11.0 Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas Signed-off-by: Mark Rutland [v4.9 backport] diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h index f2585cdd32c2..1d123dd01ee0 100644 --- a/arch/arm64/include/asm/futex.h +++ b/arch/arm64/include/asm/futex.h @@ -51,13 +51,14 @@ : "memory") static inline int -futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr) +futex_atomic_op_inuser (int encoded_op, u32 __user *_uaddr) { int op = (encoded_op >> 28) & 7; int cmp = (encoded_op >> 24) & 15; int oparg = (encoded_op << 8) >> 20; int cmparg = (encoded_op << 20) >> 20; int oldval = 0, ret, tmp; + u32 __user *uaddr = __uaccess_mask_ptr(_uaddr); if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) oparg = 1 << oparg; @@ -109,15 +110,17 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr) } static inline int -futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, +futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr, u32 oldval, u32 newval) { int ret = 0; u32 val, tmp; + u32 __user *uaddr; - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))) + if (!access_ok(VERIFY_WRITE, _uaddr, sizeof(u32))) return -EFAULT; + uaddr = __uaccess_mask_ptr(_uaddr); asm volatile("// futex_atomic_cmpxchg_inatomic\n" ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, CONFIG_ARM64_PAN) " prfm pstl1strm, %2\n"