mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 02:30:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MIPS: memset.S: EVA & fault support for small_memset

Browse source 
The MIPS kernel memset / bzero implementation includes a small_memset
branch which is used when the region to be set is smaller than a long (4
bytes on 32bit, 8 bytes on 64bit). The current small_memset
implementation uses a simple store byte loop to write the destination.
There are 2 issues with this implementation:

1. When EVA mode is active, user and kernel address spaces may overlap.
Currently the use of the sb instruction means kernel mode addressing is
always used and an intended write to userspace may actually overwrite
some critical kernel data.

2. If the write triggers a page fault, for example by calling
__clear_user(NULL, 2), instead of gracefully handling the fault, an OOPS
is triggered.

Fix these issues by replacing the sb instruction with the EX() macro,
which will emit EVA compatible instuctions as required. Additionally
implement a fault fixup for small_memset which sets a2 to the number of
bytes that could not be cleared (as defined by __clear_user).

Reported-by: Chuanhua Lei <chuanhua.lei@intel.com>
Signed-off-by: Matt Redfearn <matt.redfearn@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/18975/
Signed-off-by: James Hogan <jhogan@kernel.org>
This commit is contained in:
Matt Redfearn 2018-03-29 10:28:23 +01:00 committed by James Hogan
parent 2c2bf522ed
commit 8a8158c85e
No known key found for this signature in database
GPG key ID: 6C0B6993DE38767A
1 changed files with 6 additions and 1 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

7
arch/mips/lib/memset.S
View file

@ -219,7 +219,7 @@
1: PTR_ADDIU a0, 1 /* fill bytewise */ 1: PTR_ADDIU a0, 1 /* fill bytewise */
R10KCBARRIER(0(ra)) R10KCBARRIER(0(ra))
bne t1, a0, 1b bne t1, a0, 1b
sb a1, -1(a0) EX(sb, a1, -1(a0), .Lsmall_fixup\@)
2: jr ra /* done */ 2: jr ra /* done */
move a2, zero move a2, zero
@ -260,6 +260,11 @@
jr ra jr ra
andi v1, a2, STORMASK andi v1, a2, STORMASK
.Lsmall_fixup\@:
PTR_SUBU a2, t1, a0
jr ra
PTR_ADDIU a2, 1
.endm .endm
/* /*