UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

sparc64: Fix opcode filtering in handling of no fault loads 

is_no_fault_exception() has two bugs which were discovered via random
opcode testing with stress-ng. Both are caused by improper filtering
of opcodes.

The first bug can be triggered by a floating point store with a no-fault
ASI, for instance "sta %f0, [%g0] #ASI_PNF", opcode C1A01040.

The code first tests op3[5] (0x1000000), which denotes a floating
point instruction, and then tests op3[2] (0x200000), which denotes a
store instruction. But these bits are not mutually exclusive, and the
above mentioned opcode has both bits set. The intent is to filter out
stores, so the test for stores must be done first in order to have
any effect.

The second bug can be triggered by a floating point load with one of
the invalid ASI values 0x8e or 0x8f, which pass this check in
is_no_fault_exception():
     if ((asi & 0xf2) == ASI_PNF)

An example instruction is "ldqa [%l7 + %o7] #ASI 0x8f, %f38",
opcode CF95D1EF. Asi values greater than 0x8b (ASI_SNFL) are fatal
in handle_ldf_stq(), and is_no_fault_exception() must not allow these
invalid asi values to make it that far.

In both of these cases, handle_ldf_stq() reacts by calling
sun4v_data_access_exception() or spitfire_data_access_exception(),
which call is_no_fault_exception() and results in an infinite
recursion.

Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Tested-by: Anatoly Pugachev <matorola@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Rob Gardner 2021-02-28 22:48:16 -07:00 committed by David S. Miller
parent cf64c2a905
commit e5e8b80d35
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
arch/sparc/kernel/traps_64.c
View File

@ -275,14 +275,13 @@ bool is_no_fault_exception(struct pt_regs *regs)
asi = (regs->tstate >> 24); /* saved %asi */ asi = (regs->tstate >> 24); /* saved %asi */
else else
asi = (insn >> 5); /* immediate asi */ asi = (insn >> 5); /* immediate asi */
if ((asi & 0xf2) == ASI_PNF) { if ((asi & 0xf6) == ASI_PNF) {
if (insn & 0x1000000) { /* op3[5:4]=3 */ if (insn & 0x200000) /* op3[2], stores */
handle_ldf_stq(insn, regs);
return true;
} else if (insn & 0x200000) { /* op3[2], stores */
return false; return false;
} if (insn & 0x1000000) /* op3[5:4]=3 (fp) */
handle_ld_nf(insn, regs); handle_ldf_stq(insn, regs);
else
handle_ld_nf(insn, regs);
return true; return true;
} }
} }