ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+
getuser() and putuser() (and there underscored variants) use two strb[t]/ldrb[t] instructions when they are asked to get/put 16-bits. This means that the read/write is not atomic even when performed to a 16-bit-aligned address. This leads to problems with vhost: vhost uses __getuser() to read the vring's 16-bit avail.index field, and if it happens to observe a partial update of the index, wrong descriptors will be used which will lead to a breakdown of the virtio communication. A similar problem exists for __putuser() which is used to write to the vring's used.index field. The reason these functions use strb[t]/ldrb[t] is because strht/ldrht instructions did not exist until ARMv6T2/ARMv7. So we should be easily able to fix this on ARMv7. Also, since all ARMv6 processors also don't actually use the unprivileged instructions anymore for uaccess (since CONFIG_CPU_USE_DOMAINS is not used) we can easily fix them too. Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com> Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
This commit is contained in:

committed by
Russell King

parent
f441882a52
commit
344eb5539a
@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1)
|
||||
|
||||
ENTRY(__get_user_2)
|
||||
check_uaccess r0, 2, r1, r2, __get_user_bad
|
||||
#if __LINUX_ARM_ARCH__ >= 6
|
||||
|
||||
2: TUSER(ldrh) r2, [r0]
|
||||
|
||||
#else
|
||||
|
||||
#ifdef CONFIG_CPU_USE_DOMAINS
|
||||
rb .req ip
|
||||
2: ldrbt r2, [r0], #1
|
||||
@@ -56,6 +62,9 @@ rb .req r0
|
||||
#else
|
||||
orr r2, rb, r2, lsl #8
|
||||
#endif
|
||||
|
||||
#endif /* __LINUX_ARM_ARCH__ >= 6 */
|
||||
|
||||
mov r0, #0
|
||||
ret lr
|
||||
ENDPROC(__get_user_2)
|
||||
@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8)
|
||||
.pushsection __ex_table, "a"
|
||||
.long 1b, __get_user_bad
|
||||
.long 2b, __get_user_bad
|
||||
#if __LINUX_ARM_ARCH__ < 6
|
||||
.long 3b, __get_user_bad
|
||||
#endif
|
||||
.long 4b, __get_user_bad
|
||||
.long 5b, __get_user_bad8
|
||||
.long 6b, __get_user_bad8
|
||||
|
Reference in New Issue
Block a user