Commit 30d6e0a4 authored by Jiri Slaby's avatar Jiri Slaby Committed by Thomas Gleixner
Browse files

futex: Remove duplicated code and fix undefined behaviour 



There is code duplicated over all architecture's headers for
futex_atomic_op_inuser. Namely op decoding, access_ok check for uaddr,
and comparison of the result.

Remove this duplication and leave up to the arches only the needed
assembly which is now in arch_futex_atomic_op_inuser.

This effectively distributes the Will Deacon's arm64 fix for undefined
behaviour reported by UBSAN to all architectures. The fix was done in
commit 5f16a046 (arm64: futex: Fix undefined behaviour with
FUTEX_OP_OPARG_SHIFT usage). Look there for an example dump.

And as suggested by Thomas, check for negative oparg too, because it was
also reported to cause undefined behaviour report.

Note that s390 removed access_ok check in d12a2970 ("s390/uaccess:
remove pointless access_ok() checks") as access_ok there returns true.
We introduce it back to the helper for the sake of simplicity (it gets
optimized away anyway).

Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Acked-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com> [s390]
Acked-by: Chris Metcalf <cmetcalf@mellanox.com> [for tile]
Reviewed-by: default avatarDarren Hart (VMware) <dvhart@infradead.org>
Reviewed-by: Will Deacon <will.deacon@arm.com> [core/arm64]
Cc: linux-mips@linux-mips.org
Cc: Rich Felker <dalias@libc.org>
Cc: linux-ia64@vger.kernel.org
Cc: linux-sh@vger.kernel.org
Cc: peterz@infradead.org
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: sparclinux@vger.kernel.org
Cc: Jonas Bonn <jonas@southpole.se>
Cc: linux-s390@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: linux-hexagon@vger.kernel.org
Cc: Helge Deller <deller@gmx.de>
Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Matt Turner <mattst88@gmail.com>
Cc: linux-snps-arc@lists.infradead.org
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: linux-xtensa@linux-xtensa.org
Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
Cc: openrisc@lists.librecores.org
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Stafford Horne <shorne@gmail.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Richard Henderson <rth@twiddle.net>
Cc: Chris Zankel <chris@zankel.net>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Tony Luck <tony.luck@intel.com>
Cc: linux-parisc@vger.kernel.org
Cc: Vineet Gupta <vgupta@synopsys.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Richard Kuo <rkuo@codeaurora.org>
Cc: linux-alpha@vger.kernel.org
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: linuxppc-dev@lists.ozlabs.org
Cc: "David S. Miller" <davem@davemloft.net>
Link: http://lkml.kernel.org/r/20170824073105.3901-1-jslaby@suse.cz
parent ca110694

arch/alpha/include/asm/futex.h

+5 −21
Original line number Diff line number Diff line
@@ -25,18 +25,10 @@ 
	:	"r" (uaddr), "r"(oparg)				\

	:	"memory")



static inline int futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)

static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,

		u32 __user *uaddr)

{

	int op = (encoded_op >> 28) & 7;

	int cmp = (encoded_op >> 24) & 15;

	int oparg = (encoded_op << 8) >> 20;

	int cmparg = (encoded_op << 20) >> 20;

	int oldval = 0, ret;

	if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))

		oparg = 1 << oparg;



	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))

		return -EFAULT;



	pagefault_disable();
@@ -62,17 +54,9 @@ static inline int futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr) 


	pagefault_enable();



	if (!ret) {

		switch (cmp) {

		case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;

		case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;

		case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;

		case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;

		case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;

		case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;

		default: ret = -ENOSYS;

		}

	}

	if (!ret)

		*oval = oldval;



	return ret;

}

arch/arc/include/asm/futex.h

+5 −35
Original line number Diff line number Diff line
@@ -73,20 +73,11 @@ 


#endif



static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)

static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,

		u32 __user *uaddr)

{

	int op = (encoded_op >> 28) & 7;

	int cmp = (encoded_op >> 24) & 15;

	int oparg = (encoded_op << 8) >> 20;

	int cmparg = (encoded_op << 20) >> 20;

	int oldval = 0, ret;



	if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))

		oparg = 1 << oparg;



	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))

		return -EFAULT;



#ifndef CONFIG_ARC_HAS_LLSC

	preempt_disable();	/* to guarantee atomic r-m-w of futex op */

#endif
@@ -118,30 +109,9 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr) 
	preempt_enable();

#endif



	if (!ret) {

		switch (cmp) {

		case FUTEX_OP_CMP_EQ:

			ret = (oldval == cmparg);

			break;

		case FUTEX_OP_CMP_NE:

			ret = (oldval != cmparg);

			break;

		case FUTEX_OP_CMP_LT:

			ret = (oldval < cmparg);

			break;

		case FUTEX_OP_CMP_GE:

			ret = (oldval >= cmparg);

			break;

		case FUTEX_OP_CMP_LE:

			ret = (oldval <= cmparg);

			break;

		case FUTEX_OP_CMP_GT:

			ret = (oldval > cmparg);

			break;

		default:

			ret = -ENOSYS;

		}

	}

	if (!ret)

		*oval = oldval;



	return ret;

}

arch/arm/include/asm/futex.h

+4 −22
Original line number Diff line number Diff line
@@ -128,20 +128,10 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, 
#endif /* !SMP */



static inline int

futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)

arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)

{

	int op = (encoded_op >> 28) & 7;

	int cmp = (encoded_op >> 24) & 15;

	int oparg = (encoded_op << 8) >> 20;

	int cmparg = (encoded_op << 20) >> 20;

	int oldval = 0, ret, tmp;



	if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))

		oparg = 1 << oparg;



	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))

		return -EFAULT;



#ifndef CONFIG_SMP

	preempt_disable();

#endif
@@ -172,17 +162,9 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr) 
	preempt_enable();

#endif



	if (!ret) {

		switch (cmp) {

		case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;

		case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;

		case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;

		case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;

		case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;

		case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;

		default: ret = -ENOSYS;

		}

	}

	if (!ret)

		*oval = oldval;



	return ret;

}

arch/arm64/include/asm/futex.h

+4 −22
Original line number Diff line number Diff line
@@ -48,20 +48,10 @@ do { \ 
} while (0)



static inline int

futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr)

arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)

{

	int op = (encoded_op >> 28) & 7;

	int cmp = (encoded_op >> 24) & 15;

	int oparg = (int)(encoded_op << 8) >> 20;

	int cmparg = (int)(encoded_op << 20) >> 20;

	int oldval = 0, ret, tmp;



	if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))

		oparg = 1U << (oparg & 0x1f);



	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))

		return -EFAULT;



	pagefault_disable();



	switch (op) {
@@ -91,17 +81,9 @@ futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr) 


	pagefault_enable();



	if (!ret) {

		switch (cmp) {

		case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;

		case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;

		case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;

		case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;

		case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;

		case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;

		default: ret = -ENOSYS;

		}

	}

	if (!ret)

		*oval = oldval;



	return ret;

}

arch/frv/include/asm/futex.h

+2 −1
Original line number Diff line number Diff line
@@ -7,7 +7,8 @@ 
#include <asm/errno.h>

#include <linux/uaccess.h>



extern int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr);

extern int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,

		u32 __user *uaddr);



static inline int

futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,

CRA Git | Maintained and supported by SUSTech CRA and CCSE