android_kernel_oneplus_msm8998/arch/x86/lib
Josh Poimboeuf 7ea10d0dd2 x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic()
[ Upstream commit 42fc6c6cb1662ba2fa727dd01c9473c63be4e3b6 ]

Andrey Konovalov reported the following warning while fuzzing the kernel
with syzkaller:

  WARNING: kernel stack regs at ffff8800686869f8 in a.out:4933 has bad 'bp' value c3fc855a10167ec0

The unwinder dump revealed that RBP had a bad value when an interrupt
occurred in csum_partial_copy_generic().

That function saves RBP on the stack and then overwrites it, using it as
a scratch register.  That's problematic because it breaks stack traces
if an interrupt occurs in the middle of the function.

Replace the usage of RBP with another callee-saved register (R15) so
stack traces are no longer affected.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: David S . Miller <davem@davemloft.net>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vlad Yasevich <vyasevich@gmail.com>
Cc: linux-sctp@vger.kernel.org
Cc: netdev <netdev@vger.kernel.org>
Cc: syzkaller <syzkaller@googlegroups.com>
Link: http://lkml.kernel.org/r/4b03a961efda5ec9bfe46b7b9c9ad72d1efad343.1493909486.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:01 +02:00
..
.gitignore
atomic64_32.c x86: Adjust asm constraints in atomic64 wrappers 2012-01-20 17:29:31 -08:00
atomic64_386_32.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
atomic64_cx8_32.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
cache-smp.c
checksum_32.S x86/retpoline/checksum32: Convert assembler indirect jumps 2018-01-23 19:50:13 +01:00
clear_page_64.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
cmdline.c x86/boot: Add early cmdline parsing for options with arguments 2018-01-05 15:44:23 +01:00
cmpxchg8b_emu.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
cmpxchg16b_emu.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
copy_page_64.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
copy_user_64.S x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings 2017-07-15 11:57:47 +02:00
csum-copy_64.S x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() 2018-04-13 19:50:01 +02:00
csum-partial_64.c
csum-wrappers_64.c x86-64: make csum_partial_copy_from_user() error handling consistent 2014-11-16 11:00:42 -08:00
delay.c Prevent timer value 0 for MWAITX 2018-01-31 12:06:08 +01:00
getuser.S x86/get_user: Use pointer masking to limit speculation 2018-02-25 11:03:53 +01:00
inat.c x86: Fix to decode grouped AVX with VEX pp bits 2012-02-11 15:11:35 +01:00
insn.c x86/asm/decoder: Fix and enforce max instruction size in the insn decoder 2015-02-19 00:01:24 +01:00
iomap_copy_64.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
Makefile x86/retpoline: Add initial retpoline support 2018-01-23 19:50:12 +01:00
memcpy_32.c asmlinkage, x86: Fix 32bit memcpy for LTO 2014-02-13 18:14:46 -08:00
memcpy_64.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
memmove_64.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
memset_64.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
misc.c x86/boot: Further compress CPUs bootup message 2013-10-01 10:52:30 +02:00
mmx_32.c x86/fpu: Rename i387.h to fpu/api.h 2015-05-19 15:47:30 +02:00
msr-reg-export.c x86, pvops: Remove hooks for {rd,wr}msr_safe_regs 2012-06-07 11:41:08 -07:00
msr-reg.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
msr-smp.c x86 / msr: add 64bit _on_cpu access functions 2013-10-17 00:36:06 +02:00
msr.c x86: Fix typo preventing msr_set/clear_bit from having an effect 2014-05-09 08:42:32 -07:00
putuser.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
retpoline.S x86/retpoline: Remove the esp/rsp thunk 2018-02-25 11:03:52 +01:00
rwsem.S x86/debug: Remove perpetually broken, unmaintainable dwarf annotations 2015-06-02 07:57:48 +02:00
string_32.c x86/i386: Use less assembly in strlen(), speed things up a bit 2011-12-12 18:33:42 +01:00
strstr_32.c
usercopy.c perf/x86: Fix copy_from_user_nmi() return if range is not ok 2015-07-06 14:09:27 +02:00
usercopy_32.c mm/uaccess, mm/fault: Clarify that uaccess may only sleep if pagefaults are enabled 2015-05-19 08:39:14 +02:00
usercopy_64.c x86: fix special __probe_kernel_write() tail zeroing case 2015-04-24 06:58:27 -07:00
x86-opcode-map.txt x86/decoder: Add new TEST instruction pattern 2017-11-30 08:37:19 +00:00