c76f39bddb
Michel Lespinasse cleaned up the futex calling conventions in commit
37a9d912b2 ("futex: Sanitize cmpxchg_futex_value_locked API").
But the ia64 implementation was subtly broken. Gcc does not know that
register "r8" will be updated by the fault handler if the cmpxchg
instruction takes an exception. So it feels safe in letting the
initialization of r8 slide to after the cmpxchg. Result: we always
return 0 whether the user address faulted or not.
Fix by moving the initialization of r8 into the __asm__ code so gcc
won't move it.
Reported-by: <emeric.maschino@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42757
Tested-by: <emeric.maschino@gmail.com>
Acked-by: Michel Lespinasse <walken@google.com>
Cc: stable@vger.kernel.org # v2.6.39+
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
127 lines
3.2 KiB
C
127 lines
3.2 KiB
C
#ifndef _ASM_FUTEX_H
|
|
#define _ASM_FUTEX_H
|
|
|
|
#include <linux/futex.h>
|
|
#include <linux/uaccess.h>
|
|
#include <asm/errno.h>
|
|
|
|
#define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
|
|
do { \
|
|
register unsigned long r8 __asm ("r8") = 0; \
|
|
__asm__ __volatile__( \
|
|
" mf;; \n" \
|
|
"[1:] " insn ";; \n" \
|
|
" .xdata4 \"__ex_table\", 1b-., 2f-. \n" \
|
|
"[2:]" \
|
|
: "+r" (r8), "=r" (oldval) \
|
|
: "r" (uaddr), "r" (oparg) \
|
|
: "memory"); \
|
|
ret = r8; \
|
|
} while (0)
|
|
|
|
#define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
|
|
do { \
|
|
register unsigned long r8 __asm ("r8") = 0; \
|
|
int val, newval; \
|
|
do { \
|
|
__asm__ __volatile__( \
|
|
" mf;; \n" \
|
|
"[1:] ld4 %3=[%4];; \n" \
|
|
" mov %2=%3 \n" \
|
|
insn ";; \n" \
|
|
" mov ar.ccv=%2;; \n" \
|
|
"[2:] cmpxchg4.acq %1=[%4],%3,ar.ccv;; \n" \
|
|
" .xdata4 \"__ex_table\", 1b-., 3f-.\n" \
|
|
" .xdata4 \"__ex_table\", 2b-., 3f-.\n" \
|
|
"[3:]" \
|
|
: "+r" (r8), "=r" (val), "=&r" (oldval), \
|
|
"=&r" (newval) \
|
|
: "r" (uaddr), "r" (oparg) \
|
|
: "memory"); \
|
|
if (unlikely (r8)) \
|
|
break; \
|
|
} while (unlikely (val != oldval)); \
|
|
ret = r8; \
|
|
} while (0)
|
|
|
|
static inline int
|
|
futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
|
|
{
|
|
int op = (encoded_op >> 28) & 7;
|
|
int cmp = (encoded_op >> 24) & 15;
|
|
int oparg = (encoded_op << 8) >> 20;
|
|
int cmparg = (encoded_op << 20) >> 20;
|
|
int oldval = 0, ret;
|
|
if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
|
|
oparg = 1 << oparg;
|
|
|
|
if (! access_ok (VERIFY_WRITE, uaddr, sizeof(u32)))
|
|
return -EFAULT;
|
|
|
|
pagefault_disable();
|
|
|
|
switch (op) {
|
|
case FUTEX_OP_SET:
|
|
__futex_atomic_op1("xchg4 %1=[%2],%3", ret, oldval, uaddr,
|
|
oparg);
|
|
break;
|
|
case FUTEX_OP_ADD:
|
|
__futex_atomic_op2("add %3=%3,%5", ret, oldval, uaddr, oparg);
|
|
break;
|
|
case FUTEX_OP_OR:
|
|
__futex_atomic_op2("or %3=%3,%5", ret, oldval, uaddr, oparg);
|
|
break;
|
|
case FUTEX_OP_ANDN:
|
|
__futex_atomic_op2("and %3=%3,%5", ret, oldval, uaddr,
|
|
~oparg);
|
|
break;
|
|
case FUTEX_OP_XOR:
|
|
__futex_atomic_op2("xor %3=%3,%5", ret, oldval, uaddr, oparg);
|
|
break;
|
|
default:
|
|
ret = -ENOSYS;
|
|
}
|
|
|
|
pagefault_enable();
|
|
|
|
if (!ret) {
|
|
switch (cmp) {
|
|
case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
|
|
case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
|
|
case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
|
|
case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
|
|
case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
|
|
case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
|
|
default: ret = -ENOSYS;
|
|
}
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
static inline int
|
|
futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
|
|
u32 oldval, u32 newval)
|
|
{
|
|
if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
|
|
return -EFAULT;
|
|
|
|
{
|
|
register unsigned long r8 __asm ("r8");
|
|
unsigned long prev;
|
|
__asm__ __volatile__(
|
|
" mf;; \n"
|
|
" mov %0=r0 \n"
|
|
" mov ar.ccv=%4;; \n"
|
|
"[1:] cmpxchg4.acq %1=[%2],%3,ar.ccv \n"
|
|
" .xdata4 \"__ex_table\", 1b-., 2f-. \n"
|
|
"[2:]"
|
|
: "=r" (r8), "=r" (prev)
|
|
: "r" (uaddr), "r" (newval),
|
|
"rO" ((long) (unsigned) oldval)
|
|
: "memory");
|
|
*uval = prev;
|
|
return r8;
|
|
}
|
|
}
|
|
|
|
#endif /* _ASM_FUTEX_H */
|