Ben Dooks 6ae5eaee1e riscv: evaluate put_user() arg before enabling user access ... commit 285a76bb2cf51b0c74c634f2aaccdb93e1f2a359 upstream. The <asm/uaccess.h> header has a problem with put_user(a, ptr) if the 'a' is not a simple variable, such as a function. This can lead to the compiler producing code as so: 1: enable_user_access() 2: evaluate 'a' into register 'r' 3: put 'r' to 'ptr' 4: disable_user_acess() The issue is that 'a' is now being evaluated with the user memory protections disabled. So we try and force the evaulation by assigning 'x' to __val at the start, and hoping the compiler barriers in enable_user_access() do the job of ordering step 2 before step 1. This has shown up in a bug where 'a' sleeps and thus schedules out and loses the SR_SUM flag. This isn't sufficient to fully fix, but should reduce the window of opportunity. The first instance of this we found is in scheudle_tail() where the code does: $ less -N kernel/sched/core.c 4263 if (current->set_child_tid) 4264 put_user(task_pid_vnr(current), current->set_child_tid); Here, the task_pid_vnr(current) is called within the block that has enabled the user memory access. This can be made worse with KASAN which makes task_pid_vnr() a rather large call with plenty of opportunity to sleep. Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Reported-by: syzbot+e74b94fe601ab9552d69@syzkaller.appspotmail.com Suggested-by: Arnd Bergman <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -- Changes since v1: - fixed formatting and updated the patch description with more info Changes since v2: - fixed commenting on __put_user() (schwab@linux-m68k.org) Change since v3: - fixed RFC in patch title. Should be ready to merge. Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>		2021-04-07 15:00:13 +02:00
..
boot	Revert "dts: phy: add GPIO number and active state used for phy reset"	2021-02-17 11:02:20 +01:00
configs	riscv: defconfig: enable gpio support for HiFive Unleashed	2021-01-27 11:55:01 +01:00
include	riscv: evaluate put_user() arg before enabling user access	2021-04-07 15:00:13 +02:00
kernel	riscv: Disable KSAN_SANITIZE for vDSO	2021-03-04 11:38:36 +01:00
lib	riscv: use memcpy based uaccess for nommu again	2020-10-04 10:27:07 -07:00
mm	riscv: Get rid of MAX_EARLY_MAPPING_SIZE	2021-03-07 12:34:05 +01:00
net	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
Kbuild	riscv: Allow device trees to be built into the kernel	2020-05-18 11:38:05 -07:00
Kconfig	riscv: Correct SPARSEMEM configuration	2021-03-25 09:04:09 +01:00
Kconfig.debug
Kconfig.socs	RISC-V: Remove CLINT related code from timer and arch	2020-08-20 10:58:13 -07:00
Makefile	Kbuild updates for v5.10	2020-10-22 13:13:57 -07:00