Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp1702627ybi; Wed, 17 Jul 2019 20:24:58 -0700 (PDT) X-Google-Smtp-Source: APXvYqy2ehTFds5OmjaYaKbLg3lhy1BELHhzBBiZM2G2tk/CcwFftsFvlI6mkIaIGh+S1WzQzhOP X-Received: by 2002:a17:902:a5c7:: with SMTP id t7mr48080122plq.288.1563420298871; Wed, 17 Jul 2019 20:24:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563420298; cv=none; d=google.com; s=arc-20160816; b=m9ggaqkPAXbhfkWhAbmpHzMbgKsVnL1ld99FuzoZ5F813p77jN+FaixZJrIxepuF4N cecaSGJELDYEIsjz6nIUmoZZe+fJy4Qcth4dU1cvDxsHnR3rrwq68bfcEszfDceUE7ui uzaZX7ogv2ULLYzZRa6SjeDYJEKYSA9StoIeVDXWilUnYsry43O7v/VN/pMp9fzhQdDs pxBleyxVokMVbmYPw9L5g9DCstglqdgo1ZAGWIairxK0xr5tGro6K4bKCSQcvXn9aL20 fYAe8Kfrv0i8V/eowgF5rmoycX2qM654Cy+vG790gw3YrNYjNLCiBMUktygMABNYtPHr 4JuA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=dbfSsTuC8VbpqbTHt48vB6cxb1uwyyUFlmQ1sXzFj3c=; b=BM2qeOPOvc/uymUxsrEb+Sqj9ipWVOVOg74Drb//orOKm0fQPbp22/VjFHBTdBwdAs C2igXf8EMzdqDqh8yeGi1/CGBez8gqM5U37jmCYnQIb9szd/QzzjbuWWp0bWqv4d0a92 47xvHeuVohesc1a5c2VIog3m72XEvG8JBVXNWJAdF8bIztI+UvFz2/z/PS5Y0m0BKzNn yKxaF1DP/P4iO10epKeDB2Wwd91YldaR3zY7P0ugwoA+AEMLlbICqva484cPqtSBbEvo bHKYMp0+xVyt+wwpVMnrCK0OunkqDC7kEgLpGV6x1amduun/YueyYgnBQkVU6BQncgPM 2rhw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=FKAorxiG; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l63si25274265pge.264.2019.07.17.20.24.43; Wed, 17 Jul 2019 20:24:58 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=FKAorxiG; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389485AbfGRDHw (ORCPT + 99 others); Wed, 17 Jul 2019 23:07:52 -0400 Received: from mail.kernel.org ([198.145.29.99]:39500 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389707AbfGRDHo (ORCPT ); Wed, 17 Jul 2019 23:07:44 -0400 Received: from localhost (115.42.148.210.bf.2iij.net [210.148.42.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E88DD2053B; Thu, 18 Jul 2019 03:07:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1563419263; bh=Ynu8yvodwMQx0uHwqI/HZYYLMvXKfqE7ZdfD2W0l3r0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FKAorxiG/MDLofclpP7mDtyuTdlhOtz2nIniBQ4F7HV7H6i507D5acedLNs1iEijJ m4hufzAAcAUoBzSmekZtUQg1NRbUgfCpBaaStCaigKZN7y91pteZxhIECgIHNUcm9b NlwhmHGWhQJ92u8fHAbp1M++w1T7CZ9EzVcxzl80= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vasily Gorbik , Heiko Carstens Subject: [PATCH 4.19 37/47] s390: fix stfle zero padding Date: Thu, 18 Jul 2019 12:01:51 +0900 Message-Id: <20190718030051.901813536@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190718030045.780672747@linuxfoundation.org> References: <20190718030045.780672747@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Heiko Carstens commit 4f18d869ffd056c7858f3d617c71345cf19be008 upstream. The stfle inline assembly returns the number of double words written (condition code 0) or the double words it would have written (condition code 3), if the memory array it got as parameter would have been large enough. The current stfle implementation assumes that the array is always large enough and clears those parts of the array that have not been written to with a subsequent memset call. If however the array is not large enough memset will get a negative length parameter, which means that memset clears memory until it gets an exception and the kernel crashes. To fix this simply limit the maximum length. Move also the inline assembly to an extra function to avoid clobbering of register 0, which might happen because of the added min_t invocation together with code instrumentation. The bug was introduced with commit 14375bc4eb8d ("[S390] cleanup facility list handling") but was rather harmless, since it would only write to a rather large array. It became a potential problem with commit 3ab121ab1866 ("[S390] kernel: Add z/VM LGR detection"). Since then it writes to an array with only four double words, while some machines already deliver three double words. As soon as machines have a facility bit within the fifth double a crash on IPL would happen. Fixes: 14375bc4eb8d ("[S390] cleanup facility list handling") Cc: # v2.6.37+ Reviewed-by: Vasily Gorbik Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Greg Kroah-Hartman --- arch/s390/include/asm/facility.h | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) --- a/arch/s390/include/asm/facility.h +++ b/arch/s390/include/asm/facility.h @@ -59,6 +59,18 @@ static inline int test_facility(unsigned return __test_facility(nr, &S390_lowcore.stfle_fac_list); } +static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size) +{ + register unsigned long reg0 asm("0") = size - 1; + + asm volatile( + ".insn s,0xb2b00000,0(%1)" /* stfle */ + : "+d" (reg0) + : "a" (stfle_fac_list) + : "memory", "cc"); + return reg0; +} + /** * stfle - Store facility list extended * @stfle_fac_list: array where facility list can be stored @@ -76,13 +88,8 @@ static inline void stfle(u64 *stfle_fac_ memcpy(stfle_fac_list, &S390_lowcore.stfl_fac_list, 4); if (S390_lowcore.stfl_fac_list & 0x01000000) { /* More facility bits available with stfle */ - register unsigned long reg0 asm("0") = size - 1; - - asm volatile(".insn s,0xb2b00000,0(%1)" /* stfle */ - : "+d" (reg0) - : "a" (stfle_fac_list) - : "memory", "cc"); - nr = (reg0 + 1) * 8; /* # bytes stored by stfle */ + nr = __stfle_asm(stfle_fac_list, size); + nr = min_t(unsigned long, (nr + 1) * 8, size * 8); } memset((char *) stfle_fac_list + nr, 0, size * 8 - nr); preempt_enable();