Commit a3552dac authored by Paul Burton's avatar Paul Burton Committed by Ralf Baechle
Browse files

MIPS: Prevent unaligned accesses during stack unwinding 



During stack unwinding we call a number of functions to determine what
type of instruction we're looking at. The union mips_instruction pointer
provided to them may be pointing at a 2 byte, but not 4 byte, aligned
address & we thus cannot directly access the 4 byte wide members of the
union mips_instruction. To avoid this is_ra_save_ins() copies the
required half-words of the microMIPS instruction to a correctly aligned
union mips_instruction on the stack, which it can then access safely.
The is_jump_ins() & is_sp_move_ins() functions do not correctly perform
this temporary copy, and instead attempt to directly dereference 4 byte
fields which may be misaligned and lead to an address exception.

Fix this by copying the instruction halfwords to a temporary union
mips_instruction in get_frame_info() such that we can provide a 4 byte
aligned union mips_instruction to the is_*_ins() functions and they do
not need to deal with misalignment themselves.

Signed-off-by: default avatarPaul Burton <paul.burton@imgtec.com>
Fixes: 34c2f668 ("MIPS: microMIPS: Add unaligned access support.")
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: <stable@vger.kernel.org> # v3.10+
Patchwork: https://patchwork.linux-mips.org/patch/14529/


Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
parent ccaf7caf

arch/mips/kernel/process.c

+35 −35
Original line number Diff line number Diff line
@@ -199,8 +199,6 @@ struct mips_frame_info { 
static inline int is_ra_save_ins(union mips_instruction *ip)

{

#ifdef CONFIG_CPU_MICROMIPS

	union mips_instruction mmi;



	/*

	 * swsp ra,offset

	 * swm16 reglist,offset(sp)
@@ -210,23 +208,20 @@ static inline int is_ra_save_ins(union mips_instruction *ip) 
	 *

	 * microMIPS is way more fun...

	 */

	if (mm_insn_16bit(ip->halfword[0])) {

		mmi.word = (ip->halfword[0] << 16);

		return (mmi.mm16_r5_format.opcode == mm_swsp16_op &&

			mmi.mm16_r5_format.rt == 31) ||

		       (mmi.mm16_m_format.opcode == mm_pool16c_op &&

			mmi.mm16_m_format.func == mm_swm16_op);

	if (mm_insn_16bit(ip->halfword[1])) {

		return (ip->mm16_r5_format.opcode == mm_swsp16_op &&

			ip->mm16_r5_format.rt == 31) ||

		       (ip->mm16_m_format.opcode == mm_pool16c_op &&

			ip->mm16_m_format.func == mm_swm16_op);

	}

	else {

		mmi.halfword[0] = ip->halfword[1];

		mmi.halfword[1] = ip->halfword[0];

		return (mmi.mm_m_format.opcode == mm_pool32b_op &&

			mmi.mm_m_format.rd > 9 &&

			mmi.mm_m_format.base == 29 &&

			mmi.mm_m_format.func == mm_swm32_func) ||

		       (mmi.i_format.opcode == mm_sw32_op &&

			mmi.i_format.rs == 29 &&

			mmi.i_format.rt == 31);

		return (ip->mm_m_format.opcode == mm_pool32b_op &&

			ip->mm_m_format.rd > 9 &&

			ip->mm_m_format.base == 29 &&

			ip->mm_m_format.func == mm_swm32_func) ||

		       (ip->i_format.opcode == mm_sw32_op &&

			ip->i_format.rs == 29 &&

			ip->i_format.rt == 31);

	}

#else

	/* sw / sd $ra, offset($sp) */
@@ -247,12 +242,8 @@ static inline int is_jump_ins(union mips_instruction *ip) 
	 *

	 * microMIPS is kind of more fun...

	 */

	union mips_instruction mmi;



	mmi.word = (ip->halfword[0] << 16);



	if ((mmi.mm16_r5_format.opcode == mm_pool16c_op &&

	    (mmi.mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op) ||

	if ((ip->mm16_r5_format.opcode == mm_pool16c_op &&

	    (ip->mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op) ||

	    ip->j_format.opcode == mm_jal32_op)

		return 1;

	if (ip->r_format.opcode != mm_pool32a_op ||
@@ -281,15 +272,13 @@ static inline int is_sp_move_ins(union mips_instruction *ip) 
	 *

	 * microMIPS is not more fun...

	 */

	if (mm_insn_16bit(ip->halfword[0])) {

		union mips_instruction mmi;



		mmi.word = (ip->halfword[0] << 16);

		return (mmi.mm16_r3_format.opcode == mm_pool16d_op &&

			mmi.mm16_r3_format.simmediate && mm_addiusp_func) ||

		       (mmi.mm16_r5_format.opcode == mm_pool16d_op &&

			mmi.mm16_r5_format.rt == 29);

	if (mm_insn_16bit(ip->halfword[1])) {

		return (ip->mm16_r3_format.opcode == mm_pool16d_op &&

			ip->mm16_r3_format.simmediate && mm_addiusp_func) ||

		       (ip->mm16_r5_format.opcode == mm_pool16d_op &&

			ip->mm16_r5_format.rt == 29);

	}



	return ip->mm_i_format.opcode == mm_addiu32_op &&

	       ip->mm_i_format.rt == 29 && ip->mm_i_format.rs == 29;

#else
@@ -304,7 +293,8 @@ static inline int is_sp_move_ins(union mips_instruction *ip) 


static int get_frame_info(struct mips_frame_info *info)

{

	union mips_instruction *ip;

	bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS);

	union mips_instruction insn, *ip;

	unsigned max_insns = info->func_size / sizeof(union mips_instruction);

	unsigned i;
@@ -320,11 +310,21 @@ static int get_frame_info(struct mips_frame_info *info) 
	max_insns = min(128U, max_insns);



	for (i = 0; i < max_insns; i++, ip++) {

		if (is_mmips && mm_insn_16bit(ip->halfword[0])) {

			insn.halfword[0] = 0;

			insn.halfword[1] = ip->halfword[0];

		} else if (is_mmips) {

			insn.halfword[0] = ip->halfword[1];

			insn.halfword[1] = ip->halfword[0];

		} else {

			insn.word = ip->word;

		}



		if (is_jump_ins(ip))

		if (is_jump_ins(&insn))

			break;



		if (!info->frame_size) {

			if (is_sp_move_ins(ip))

			if (is_sp_move_ins(&insn))

			{

#ifdef CONFIG_CPU_MICROMIPS

				if (mm_insn_16bit(ip->halfword[0]))
@@ -347,7 +347,7 @@ static int get_frame_info(struct mips_frame_info *info) 
			}

			continue;

		}

		if (info->pc_offset == -1 && is_ra_save_ins(ip)) {

		if (info->pc_offset == -1 && is_ra_save_ins(&insn)) {

			info->pc_offset =

				ip->i_format.simmediate / sizeof(long);

			break;

CRA Git | Maintained and supported by SUSTech CRA and CCSE