Ben Dooks 6ae5eaee1e riscv: evaluate put_user() arg before enabling user access ... commit 285a76bb2cf51b0c74c634f2aaccdb93e1f2a359 upstream. The <asm/uaccess.h> header has a problem with put_user(a, ptr) if the 'a' is not a simple variable, such as a function. This can lead to the compiler producing code as so: 1: enable_user_access() 2: evaluate 'a' into register 'r' 3: put 'r' to 'ptr' 4: disable_user_acess() The issue is that 'a' is now being evaluated with the user memory protections disabled. So we try and force the evaulation by assigning 'x' to __val at the start, and hoping the compiler barriers in enable_user_access() do the job of ordering step 2 before step 1. This has shown up in a bug where 'a' sleeps and thus schedules out and loses the SR_SUM flag. This isn't sufficient to fully fix, but should reduce the window of opportunity. The first instance of this we found is in scheudle_tail() where the code does: $ less -N kernel/sched/core.c 4263 if (current->set_child_tid) 4264 put_user(task_pid_vnr(current), current->set_child_tid); Here, the task_pid_vnr(current) is called within the block that has enabled the user memory access. This can be made worse with KASAN which makes task_pid_vnr() a rather large call with plenty of opportunity to sleep. Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Reported-by: syzbot+e74b94fe601ab9552d69@syzkaller.appspotmail.com Suggested-by: Arnd Bergman <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -- Changes since v1: - fixed formatting and updated the patch description with more info Changes since v2: - fixed commenting on __put_user() (schwab@linux-m68k.org) Change since v3: - fixed RFC in patch title. Should be ready to merge. Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>		2021-04-07 15:00:13 +02:00
..
vdso	RISC-V: fix barrier() use in <vdso/processor.h>	2020-11-25 09:44:27 -08:00
asm-offsets.h
asm-prototypes.h
asm.h
atomic.h
barrier.h
bitops.h
bug.h
cache.h
cacheflush.h
cacheinfo.h	riscv: Add cache information in AUX vector	2020-09-15 18:46:08 -07:00
clint.h	RISC-V: Resurrect the MMIO timer implementation for M-mode systems	2020-09-19 13:21:11 -07:00
clocksource.h
cmpxchg.h
cpu_ops.h
csr.h
current.h
delay.h
efi.h	RISC-V: Add EFI runtime services	2020-10-02 14:31:28 -07:00
elf.h	riscv: Add cache information in AUX vector	2020-09-15 18:46:08 -07:00
fence.h
fixmap.h	RISC-V: Add early ioremap support	2020-10-02 14:31:03 -07:00
ftrace.h	RISC-V: Take text_mutex in ftrace_init_nop()	2020-09-11 12:15:21 -07:00
futex.h
gdb_xml.h
hugetlb.h
hwcap.h
image.h
io.h	RISC-V: Add early ioremap support	2020-10-02 14:31:03 -07:00
irq_work.h
irq.h
irqflags.h
jump_label.h
kasan.h
Kbuild	local64.h: make <asm/local64.h> mandatory	2021-01-12 20:18:16 +01:00
kdebug.h
kgdb.h
kprobes.h
linkage.h
mmio.h
mmiowb.h
mmu_context.h
mmu.h	RISC-V: Add EFI runtime services	2020-10-02 14:31:28 -07:00
module.h
module.lds.h	kbuild: preprocess module linker script	2020-09-25 00:36:41 +09:00
page.h	riscv: virt_addr_valid must check the address belongs to linear mapping	2021-02-17 11:02:23 +01:00
parse_asm.h
patch.h
pci.h
perf_event.h
pgalloc.h
pgtable-32.h	arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed	2020-11-16 16:57:18 +01:00
pgtable-64.h
pgtable-bits.h
pgtable.h	riscv: Drop a duplicated PAGE_KERNEL_EXEC	2021-01-19 18:27:20 +01:00
processor.h
ptdump.h
ptrace.h
sbi.h	RISC-V: correct enum sbi_ext_rfence_fid	2021-03-25 09:04:09 +01:00
seccomp.h
sections.h	RISC-V: Add PE/COFF header for EFI stub	2020-10-02 14:31:16 -07:00
set_memory.h
smp.h
soc.h	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
sparsemem.h
spinlock_types.h
spinlock.h
stackprotector.h	RISC-V: Check clint_time_val before use	2020-09-30 11:05:14 -07:00
string.h
switch_to.h
syscall.h
thread_info.h	riscv: remove address space overrides using set_fs()	2020-10-04 10:27:10 -07:00
timex.h	RISC-V: Define get_cycles64() regardless of M-mode	2020-12-10 17:39:43 -08:00
tlb.h
tlbflush.h
uaccess.h	riscv: evaluate put_user() arg before enabling user access	2021-04-07 15:00:13 +02:00
unistd.h
vdso.h	riscv: Fixup CONFIG_GENERIC_TIME_VSYSCALL	2021-01-19 18:27:20 +01:00
vermagic.h
vmalloc.h
word-at-a-time.h