linux-stable.git/arch/xtensa, branch linux-4.1.y

xtensa: fix futex_atomic_cmpxchg_inatomic

2018-03-04T15:28:22+00:00

[ Upstream commit ca47480921587ae30417dd234a9f79af188e3666 ]

Return 0 if the operation was successful, not the userspace memory
value. Check that userspace value equals passed oldval, not itself.
Don't update *uval if the value wasn't read from userspace memory.

This fixes process hang due to infinite loop in futex_lock_pi.
It also fixes a bunch of glibc tests nptl/tst-mutexpi*.

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov 
Signed-off-by: Sasha Levin

mm: larger stack guard gap, between vmas

2017-06-28T22:57:15+00:00

[ Upstream commit 1be7107fbe18eed3e319a6c3e83c78254b693acb ]

Stack guard page is a useful feature to reduce a risk of stack smashing
into a different mapping. We have been using a single page gap which
is sufficient to prevent having stack adjacent to a different mapping.
But this seems to be insufficient in the light of the stack usage in
userspace. E.g. glibc uses as large as 64kB alloca() in many commonly
used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX]
which is 256kB or stack strings with MAX_ARG_STRLEN.

This will become especially dangerous for suid binaries and the default
no limit for the stack size limit because those applications can be
tricked to consume a large portion of the stack and a single glibc call
could jump over the guard page. These attacks are not theoretical,
unfortunatelly.

Make those attacks less probable by increasing the stack guard gap
to 1MB (on systems with 4k pages; but make it depend on the page size
because systems with larger base pages might cap stack allocations in
the PAGE_SIZE units) which should cover larger alloca() and VLA stack
allocations. It is obviously not a full fix because the problem is
somehow inherent, but it should reduce attack space a lot.

One could argue that the gap size should be configurable from userspace,
but that can be done later when somebody finds that the new 1MB is wrong
for some special case applications.  For now, add a kernel command line
option (stack_guard_gap) to specify the stack gap size (in page units).

Implementation wise, first delete all the old code for stack guard page:
because although we could get away with accounting one extra page in a
stack vma, accounting a larger gap can break userspace - case in point,
a program run with "ulimit -S -v 20000" failed when the 1MB gap was
counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK
and strict non-overcommit mode.

Instead of keeping gap inside the stack vma, maintain the stack guard
gap as a gap between vmas: using vm_start_gap() in place of vm_start
(or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few
places which need to respect the gap - mainly arch_get_unmapped_area(),
and and the vma tree's subtree_gap support for that.

Original-patch-by: Oleg Nesterov 
Original-patch-by: Michal Hocko 
Signed-off-by: Hugh Dickins 
Acked-by: Michal Hocko 
Tested-by: Helge Deller  # parisc
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

xtensa: don't use linux IRQ #0

2017-06-26T02:02:21+00:00

[ Upstream commit e5c86679d5e864947a52fb31e45a425dea3e7fa9 ]

Linux IRQ #0 is reserved for error reporting and may not be used.
Increase NR_IRQS for one additional slot and increase
irq_domain_add_legacy parameter first_irq value to 1, so that linux
IRQ #0 is not associated with hardware IRQ #0 in legacy IRQ domains.
Introduce macro XTENSA_PIC_LINUX_IRQ for static translation of xtensa
PIC hardware IRQ # to linux IRQ #. Use this macro in XTFPGA platform
data definitions.

This fixes inability to use hardware IRQ #0 in configurations that don't
use device tree and allows for non-identity mapping between linux IRQ #
and hardware IRQ #.

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov 
Signed-off-by: Sasha Levin

xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD

2017-05-17T19:07:00+00:00

[ Upstream commit 4ab18701c66552944188dbcd0ce0012729baab84 ]

FDT tag parsing is not related to whether BLK_DEV_INITRD is configured
or not, move it out of the corresponding #ifdef/#endif block.
This fixes passing external FDT to the kernel configured w/o
BLK_DEV_INITRD support.

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov 
Signed-off-by: Sasha Levin

xtensa: clear all DBREAKC registers on start

2016-04-18T12:50:55+00:00

[ Upstream commit 7de7ac785ae18a2cdc78d7560f48e3213d9ea0ab ]

There are XCHAL_NUM_DBREAK registers, clear them all.
This also fixes cryptic assembler error message with binutils 2.25 when
XCHAL_NUM_DBREAK is 0:

  as: out of memory allocating 18446744073709551575 bytes after a total
  of 495616 bytes

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov 
Signed-off-by: Sasha Levin

xtensa: fix preemption in {clear,copy}_user_highpage

2016-04-18T12:50:55+00:00

[ Upstream commit a67cc9aa2dfc6e66addf240bbd79e16e01565e81 ]

Disabling pagefault makes little sense there, preemption disabling is
what was meant.

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov 
Signed-off-by: Sasha Levin

xtensa: ISS: don't hang if stdin EOF is reached

2016-04-18T12:50:54+00:00

[ Upstream commit 362014c8d9d51d504c167c44ac280169457732be ]

Simulator stdin may be connected to a file, when its end is reached
kernel hangs in infinite loop inside rs_poll, because simc_poll always
signals that descriptor 0 is readable and simc_read always returns 0.
Check simc_read return value and exit loop if it's not positive. Also
don't rewind polling timer if it's zero.

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov 
Signed-off-by: Sasha Levin

xtensa: fix kernel register spilling

2015-09-21T17:05:42+00:00

commit 77d6273e79e3a86552fcf10cdd31a69b46ed2ce6 upstream.

call12 can't be safely used as the first call in the inline function,
because the compiler does not extend the stack frame of the bounding
function accordingly, which may result in corruption of local variables.

If a call needs to be done, do call8 first followed by call12.

For pure assembly code in _switch_to increase stack frame size of the
bounding function.

Signed-off-by: Max Filippov 
Signed-off-by: Greg Kroah-Hartman

xtensa: fix threadptr reload on return to userspace

2015-09-21T17:05:41+00:00

commit 4229fb12a03e5da5882b420b0aa4a02e77447b86 upstream.

Userspace return code may skip restoring THREADPTR register if there are
no registers that need to be zeroed. This leads to spurious failures in
libc NPTL tests.

Always restore THREADPTR on return to userspace.

Signed-off-by: Max Filippov 
Signed-off-by: Greg Kroah-Hartman

xtensa: Provide dummy dma_alloc_attrs() and dma_free_attrs()

2015-05-25T23:03:16+00:00

xtensa:allmodconfig fails to build with the following errors.

drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c:
	In function ‘gk20a_instobj_dtor_dma’:
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c:154:2: error:
	implicit declaration of function ‘dma_free_attrs’
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c:
	In function ‘gk20a_instobj_ctor_dma’:
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/gk20a.c:218:2: error:
	implicit declaration of function ‘dma_alloc_attrs’

Xtensa does not provide those functions at this time.
Provide dummy implementations to avoid build errors.

Acked-by: Max Filippov 
Signed-off-by: Guenter Roeck 
Signed-off-by: Chris Zankel