From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932747AbbFTVr0 (ORCPT ); Sat, 20 Jun 2015 17:47:26 -0400 Received: from mail-wg0-f51.google.com ([74.125.82.51]:34558 "EHLO mail-wg0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752848AbbFTVrT (ORCPT ); Sat, 20 Jun 2015 17:47:19 -0400 Date: Sun, 21 Jun 2015 00:47:15 +0300 From: Alexey Dobriyan To: hpa@zytor.com, mingo@kernel.org Cc: x86@kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/2] x86: fix incomplete clear by clear_user() Message-ID: <20150620214715.GB14099@p183.telecom.by> References: <20150620214536.GA14099@p183.telecom.by> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150620214536.GA14099@p183.telecom.by> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org clear_user() used MOVQ+MOVB and if MOVQ faults, code simply exits and honestly returns remaining length. In case of unaligned area, unaligned remainder would count towards return value (correctly) but not cleared (lazy code at least): clear_user(p + 4096 - 4, 8) = 8 No one would have noticed but REP MOVSB addition to clear_user() repertoire creates a problem: REP MOVSB does everything correctly, clears and counts to the last possible byte, but REP STOSQ and MOVQ variants DO NOT: MOVQ clear_user(p + 4096 - 4, 8) = 8 REP STOSQ clear_user(p + 4096 - 4, 8) = 8 REP STOSB clear_user(p + 4096 - 4, 8) = 4 Patch fixes incomplete clear on 32-bit and 64-bit REP STOSQ, MOVQ. Signed-off-by: Alexey Dobriyan --- arch/x86/lib/clear_user_64.S | 9 ++++++--- arch/x86/lib/usercopy_32.c | 3 ++- 2 files changed, 8 insertions(+), 4 deletions(-) --- a/arch/x86/lib/clear_user_64.S +++ b/arch/x86/lib/clear_user_64.S @@ -26,7 +26,8 @@ ENTRY(__clear_user) .section .fixup,"ax" 4: lea (%rsi,%rcx,8),%rcx - jmp 3b + # Fill as much as possible with byte stores. + jmp 2b .previous _ASM_EXTABLE(1b,4b) @@ -57,7 +58,8 @@ ENTRY(__clear_user_movq) 3: movb $0, (%rdi) add $1, %rdi - sub $1, %ecx + # Unaligned area and 4GB+ tail after recovery require RCX here. + sub $1, %rcx jnz 3b 4: mov %rcx, %rax @@ -66,7 +68,8 @@ ENTRY(__clear_user_movq) .section .fixup,"ax" 5: lea (%rsi,%rcx,8),%rcx - jmp 4b + # Fill as much as possible with byte stores. + jmp 3b .previous _ASM_EXTABLE(1b,5b) --- a/arch/x86/lib/usercopy_32.c +++ b/arch/x86/lib/usercopy_32.c @@ -49,7 +49,8 @@ do { \ "2: " ASM_CLAC "\n" \ ".section .fixup,\"ax\"\n" \ "3: lea 0(%2,%0,4),%0\n" \ - " jmp 2b\n" \ + /* Fill as much as possible with byte stores. */ \ + " jmp 1b\n" \ ".previous\n" \ _ASM_EXTABLE(0b,3b) \ _ASM_EXTABLE(1b,2b) \ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in Please read the FAQ at http://www.tux.org/lkml/