Michael Neuling
08ee34d86c
powerpc/tm: Fix oops on sigreturn on systems without TM ...
commit f16d80b75a096c52354c6e0a574993f3b0dfbdfe upstream.
On systems like P9 powernv where we have no TM (or P8 booted with
ppc_tm=off), userspace can construct a signal context which still has
the MSR TS bits set. The kernel tries to restore this context which
results in the following crash:
Unexpected TM Bad Thing exception at c0000000000022fc (msr 0x8000000102a03031) tm_scratch=800000020280f033
Oops: Unrecoverable exception, sig: 6 [#1 ]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 0 PID: 1636 Comm: sigfuz Not tainted 5.2.0-11043-g0a8ad0ffa4 #69
NIP: c0000000000022fc LR: 00007fffb2d67e48 CTR: 0000000000000000
REGS: c00000003fffbd70 TRAP: 0700 Not tainted (5.2.0-11045-g7142b497d8)
MSR: 8000000102a03031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[E]> CR: 42004242 XER: 00000000
CFAR: c0000000000022e0 IRQMASK: 0
GPR00: 0000000000000072 00007fffb2b6e560 00007fffb2d87f00 0000000000000669
GPR04: 00007fffb2b6e728 0000000000000000 0000000000000000 00007fffb2b6f2a8
GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR12: 0000000000000000 00007fffb2b76900 0000000000000000 0000000000000000
GPR16: 00007fffb2370000 00007fffb2d84390 00007fffea3a15ac 000001000a250420
GPR20: 00007fffb2b6f260 0000000010001770 0000000000000000 0000000000000000
GPR24: 00007fffb2d843a0 00007fffea3a14a0 0000000000010000 0000000000800000
GPR28: 00007fffea3a14d8 00000000003d0f00 0000000000000000 00007fffb2b6e728
NIP [c0000000000022fc] rfi_flush_fallback+0x7c/0x80
LR [00007fffb2d67e48] 0x7fffb2d67e48
Call Trace:
Instruction dump:
e96a0220 e96a02a8 e96a0330 e96a03b8 394a0400 4200ffdc 7d2903a6 e92d0c00
e94d0c08 e96d0c10 e82d0c18 7db242a6 <4c000024> 7db243a6 7db142a6 f82d0c18
The problem is the signal code assumes TM is enabled when
CONFIG_PPC_TRANSACTIONAL_MEM is enabled. This may not be the case as
with P9 powernv or if `ppc_tm=off` is used on P8.
This means any local user can crash the system.
Fix the problem by returning a bad stack frame to the user if they try
to set the MSR TS bits with sigreturn() on systems where TM is not
supported.
Found with sigfuz kernel selftest on P9.
This fixes CVE-2019-13648.
Fixes: 2b0a576d15stable@vger.kernel.org # v3.9
Reported-by: Praveen Pandey <Praveen.Pandey@in.ibm.com>
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20190719050502.405-1-mikey@neuling.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-08-04 09:33:43 +02:00
powerpc/vdso: Fix build rules to rebuild vdsos correctly
2016-08-10 23:04:12 +10:00
powerpc/vdso64: Use double word compare on pointers
2016-09-29 15:17:57 +10:00
powerpc: Fix DAR reporting when alignment handler faults
2017-09-27 14:39:21 +02:00
powerpc/64s: Improve RFI L1-D cache flush fallback
2018-02-25 11:05:50 +01:00
powerpc/mm: Use a helper for finding pte bits mapping I/O area
2016-05-01 18:32:32 +10:00
powerpc: Fix missing L2 cache size in /sys/devices/system/cpu
2015-04-11 20:49:28 +10:00
powerpc: Various typo fixes
2016-06-14 13:58:26 +10:00
powerpc/cache: add cache flush operation for various e500
2016-03-04 23:44:51 -06:00
powerpc/64s: Clear PCR on boot
2018-06-06 16:44:32 +02:00
powerpc/8xx: add dedicated machine check handler
2016-09-25 02:38:55 -05:00
powerpc/crash: Rearrange loop condition to avoid out of bounds array access
2016-07-14 20:26:22 +10:00
powerpc: Remove superfluous bootmem includes
2014-11-10 09:59:26 +11:00
powerpc/powernv: Fixes for hypervisor doorbell handling
2015-03-20 14:51:53 +11:00
dma-mapping: use unsigned long for dma_attrs
2016-08-04 08:50:07 -04:00
powerpc/iommu: Support "hybrid" iommu/direct DMA ops for coherent_mask < dma_mask
2015-07-13 10:10:55 +10:00
dma-mapping: use unsigned long for dma_attrs
2016-08-04 08:50:07 -04:00
powerpc/eeh: Handle hugepages in ioremap space
2019-08-04 09:33:41 +02:00
powerpc/eeh: Fix pr_debug()s in eeh_cache.c
2016-07-08 22:09:50 +10:00
powerpc/pci: Delay populating pdn
2016-06-21 15:30:56 +10:00
powerpc/eeh: Fix use-after-release of EEH driver
2018-08-03 07:55:14 +02:00
powerpc: sparse: static-ify some things
2016-04-12 21:05:18 +10:00
powerpc/eeh: Fix enabling bridge MMIO windows
2018-04-24 09:34:17 +02:00
powerpc/eeh: Fix PE state format
2014-11-27 09:32:58 +11:00
powerpc/fsl: Sanitize the syscall table for NXP PowerPC 32 bit platforms
2019-04-17 08:36:41 +02:00
powerpc/fsl: Flush the branch predictor at each kernel entry (64bit)
2019-04-17 08:36:43 +02:00
ppc: move exports to definitions
2016-08-07 23:50:09 -04:00
powerpc/fsl: Fix the flush of branch predictor.
2019-04-17 08:36:43 +02:00
powerpc/watchpoint: Restore NV GPRs while returning from exception
2019-08-04 09:33:31 +02:00
powerpc/fadump: Return error when fadump registration fails
2018-10-13 09:18:57 +02:00
Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
2016-10-14 14:26:58 -07:00
powerpc/fsl: Force coherent memory on e500mc derivatives
2015-08-07 23:00:01 -05:00
ftrace: Add return address pointer to ftrace_ret_stack
2016-08-24 12:15:14 +02:00
powerpc/8xx: fix invalid register expression in head_8xx.S
2018-08-03 07:55:19 +02:00
Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
2016-10-14 14:26:58 -07:00
ppc: move exports to definitions
2016-08-07 23:50:09 -04:00
ppc: move exports to definitions
2016-08-07 23:50:09 -04:00
powerpc/64e: Convert cmpi to cmpwi in head_64.S
2017-01-09 08:32:25 +01:00
powerpc/fsl: Fixed warning: orphan section `__btb_flush_fixup'
2019-04-17 08:36:43 +02:00
powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit)
2019-04-17 08:36:43 +02:00
powerpc/ptrace: Fix enforcement of DAWR constraints
2018-07-03 11:23:08 +02:00
powerpc/ibmebus: Fix device reference leaks in sysfs interface
2017-01-19 20:18:08 +01:00
powerpc/64s: Simple RFI macro conversions
2018-02-25 11:05:50 +01:00
powerpc/e500mc: Remove dead L2 flushing code in idle_e500.S
2015-06-02 21:37:19 -05:00
powerpc/mm: Differentiate between hugetlb and THP during page walk
2015-10-12 15:30:09 +11:00
powerpc: add io{read,write}64 accessors
2016-05-31 16:41:52 +08:00
powerpc: implement the DMA_ATTR_NO_WARN attribute
2016-10-11 15:06:32 -07:00
powerpc/64s: Fix lost pending interrupt due to race causing lost update to irq_happened
2018-04-08 12:12:42 +02:00
powerpc/mm: Use a helper for finding pte bits mapping I/O area
2016-05-01 18:32:32 +10:00
jump_label: Rename JUMP_LABEL_{EN,DIS}ABLE to JUMP_LABEL_{JMP,NOP}
2015-08-03 11:34:12 +02:00
powerpc: Fix kgdb on little endian ppc64le
2016-02-18 00:03:26 +11:00
powerpc/kprobes: Pause function_graph tracing during jprobes handling
2017-06-29 13:00:29 +02:00
powerpc: Remove redundant breaks
2015-08-06 15:10:20 +10:00
powerpc: Remove all usages of NO_IRQ
2016-09-20 20:57:12 +10:00
powerpc/kdump: Handle crashkernel memory reservation failure
2018-10-03 17:01:44 -07:00
powerpc/64/kexec: Remove BookE special default_machine_kexec_prepare()
2016-09-23 07:54:18 +10:00
powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC
2019-04-17 08:36:41 +02:00
powerpc/book3s/mce: Move add_taint() later in virtual mode
2017-05-25 15:44:43 +02:00
powerpc/mm/radix: Fix CONFIG_PPC_MMU_STD_64 typo
2016-05-11 21:53:59 +10:00
ppc: move exports to definitions
2016-08-07 23:50:09 -04:00
powerpc: Fix build warning on 32-bit PPC
2017-01-15 13:42:56 +01:00
powerpc/64: Fix flush_(d|i)cache_range() called from modules
2017-04-12 12:41:13 +02:00
powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC
2019-04-17 08:36:41 +02:00
powerpc/module: Only try to generate the ftrace_caller() stub once
2016-03-07 14:53:53 +11:00
powerpc/modules: Don't try to restore r2 after a sibling call
2018-03-22 09:17:57 +01:00
powerpc/msi: Fix NULL pointer access in teardown code
2018-12-21 14:11:32 +01:00
pstore: Fix flags to enable dumps on powerpc
2017-05-20 14:28:42 +02:00
powerpc/eeh: Do probe on pci_dn
2015-03-24 13:15:52 +11:00
powerpc/mm: Convert early cpu/mmu feature check to use the new helpers
2016-08-01 11:15:01 +10:00
Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
2016-10-14 14:26:58 -07:00
powerpc/pci: Don't scan empty slot
2016-05-11 21:54:26 +10:00
powerpc/32: Add a missing include header
2018-08-03 07:55:18 +02:00
powerpc fixes for 4.7 #5
2016-07-15 14:57:47 +10:00
powerpc/pci: Fix build with PCI_IOV=y and EEH=n
2016-07-07 16:33:27 +10:00
powerpc/pci/of: Fix OF flags parsing for 64bit BARs
2019-08-04 09:33:38 +02:00
powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
2019-03-23 13:19:52 +01:00
powerpc/mm: Make MMU_FTR_RADIX a MMU family feature
2016-08-01 11:14:57 +10:00
powerpc: Add missing error check to prom_find_boot_cpu()
2017-02-09 08:08:27 +01:00
powerpc: Simplify symbol check in prom_init_check.sh
2014-09-25 23:14:46 +10:00
powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
2019-03-23 13:19:52 +01:00
ptrace: Don't allow accessing an undumpable mm
2017-01-06 10:40:13 +01:00
powerpc: Various typo fixes
2016-06-14 13:58:26 +10:00
powerpc: Make ppc_md.{halt, restart} __noreturn
2016-07-14 21:12:06 +10:00
powerpc: move find_and_init_phbs() to pSeries specific code
2015-04-11 20:49:09 +10:00
powerpc/pseries: start rtasd before PCI probing
2016-07-08 19:22:15 +10:00
powerpc/64s: Include cpu header
2019-05-16 19:43:45 +02:00
powerpc/fsl: Enable runtime patching if nospectre_v2 boot arg is used
2019-04-17 08:36:43 +02:00
powerpc: Merge 32-bit and 64-bit setup_arch()
2016-07-21 19:17:46 +10:00
Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
2016-10-14 14:26:58 -07:00
powerpc/64s: Fix section mismatch warnings from setup_rfi_flush()
2018-06-06 16:44:37 +02:00
powerpc/signal: Properly handle return value from uprobe_deny_signal()
2017-11-30 08:39:08 +00:00
powerpc: tm: Rename transct_(*) to ck(\1)_state
2016-10-04 20:33:16 +11:00
powerpc/tm: Fix oops on sigreturn on systems without TM
2019-08-04 09:33:43 +02:00
powerpc/tm: Fix oops on sigreturn on systems without TM
2019-08-04 09:33:43 +02:00
powerpc, hotplug: Avoid to touch non-existent cpumasks.
2016-08-22 11:09:33 +10:00
powerpc: Implement save_stack_trace_regs() to enable kprobe stack tracing
2016-01-11 14:27:28 +11:00
nosave: consolidate __nosave_{begin,end} in <asm/sections.h>
2014-10-09 22:26:04 -04:00
powerpc/mm: Abstraction for switch_mmu_context()
2016-05-01 18:33:04 +10:00
powerpc/32s: fix suspend/resume when IBATs 4-7 are used
2019-08-04 09:33:31 +02:00
powerpc: Fix invalid use of register expressions
2019-04-17 08:36:39 +02:00
powerpc/sparse: Add more assembler prototypes
2016-09-13 17:36:58 +10:00
powerpc/sparse: make some things static
2016-06-16 22:23:11 +10:00
powerpc: Add a proper syscall for switching endianness
2015-03-28 22:03:40 +11:00
powerpc: Standardise on NR_syscalls rather than __NR_syscalls.
2015-11-26 22:11:17 +11:00
powerpc: Standardise on NR_syscalls rather than __NR_syscalls.
2015-11-26 22:11:17 +11:00
powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
2018-04-13 19:48:12 +02:00
powerpc/tm: Avoid possible userspace r1 corruption on reclaim
2018-10-20 09:51:31 +02:00
powerpc/ftrace: add powerpc timebase as a trace clock source
2015-08-06 16:36:23 +10:00
powerpc/book3s/mce: Move add_taint() later in virtual mode
2017-05-25 15:44:43 +02:00
powerpc: Remove the celleb support
2015-04-07 17:15:13 +10:00
powerpc: Fix bad NULL pointer check in udbg_uart_getc_poll()
2014-11-12 13:47:20 +11:00
powerpc/vdso: Add missing include file
2016-08-09 16:52:00 +10:00
Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
2016-10-14 14:26:58 -07:00
dma-mapping: use unsigned long for dma_attrs
2016-08-04 08:50:07 -04:00
powerpc/fsl: Add infrastructure to fixup branch predictor flush
2019-04-17 08:36:42 +02:00
08ee34d86c