| From: Matt Redfearn <matt.redfearn@mips.com> |
| Date: Tue, 17 Apr 2018 16:40:00 +0100 |
| Subject: MIPS: memset.S: Fix clobber of v1 in last_fixup |
| |
| commit c96eebf07692e53bf4dd5987510d8b550e793598 upstream. |
| |
| The label .Llast_fixup\@ is jumped to on page fault within the final |
| byte set loop of memset (on < MIPSR6 architectures). For some reason, in |
| this fault handler, the v1 register is randomly set to a2 & STORMASK. |
| This clobbers v1 for the calling function. This can be observed with the |
| following test code: |
| |
| static int __init __attribute__((optimize("O0"))) test_clear_user(void) |
| { |
| register int t asm("v1"); |
| char *test; |
| int j, k; |
| |
| pr_info("\n\n\nTesting clear_user\n"); |
| test = vmalloc(PAGE_SIZE); |
| |
| for (j = 256; j < 512; j++) { |
| t = 0xa5a5a5a5; |
| if ((k = clear_user(test + PAGE_SIZE - 256, j)) != j - 256) { |
| pr_err("clear_user (%px %d) returned %d\n", test + PAGE_SIZE - 256, j, k); |
| } |
| if (t != 0xa5a5a5a5) { |
| pr_err("v1 was clobbered to 0x%x!\n", t); |
| } |
| } |
| |
| return 0; |
| } |
| late_initcall(test_clear_user); |
| |
| Which demonstrates that v1 is indeed clobbered (MIPS64): |
| |
| Testing clear_user |
| v1 was clobbered to 0x1! |
| v1 was clobbered to 0x2! |
| v1 was clobbered to 0x3! |
| v1 was clobbered to 0x4! |
| v1 was clobbered to 0x5! |
| v1 was clobbered to 0x6! |
| v1 was clobbered to 0x7! |
| |
| Since the number of bytes that could not be set is already contained in |
| a2, the andi placing a value in v1 is not necessary and actively |
| harmful in clobbering v1. |
| |
| Reported-by: James Hogan <jhogan@kernel.org> |
| Signed-off-by: Matt Redfearn <matt.redfearn@mips.com> |
| Cc: Ralf Baechle <ralf@linux-mips.org> |
| Cc: linux-mips@linux-mips.org |
| Patchwork: https://patchwork.linux-mips.org/patch/19109/ |
| Signed-off-by: James Hogan <jhogan@kernel.org> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| arch/mips/lib/memset.S | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/arch/mips/lib/memset.S |
| +++ b/arch/mips/lib/memset.S |
| @@ -210,7 +210,7 @@ |
| |
| .Llast_fixup\@: |
| jr ra |
| - andi v1, a2, STORMASK |
| + nop |
| |
| .Lsmall_fixup\@: |
| PTR_SUBU a2, t1, a0 |