From owner-dev-commits-src-all@freebsd.org Wed Dec 30 22:45:53 2020 Return-Path: Delivered-To: dev-commits-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id C8FEE4D15CC; Wed, 30 Dec 2020 22:45:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4D5mbP5NSNz4mpV; Wed, 30 Dec 2020 22:45:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id ABF9F25AB9; Wed, 30 Dec 2020 22:45:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 0BUMjr9c032401; Wed, 30 Dec 2020 22:45:53 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 0BUMjrpm032399; Wed, 30 Dec 2020 22:45:53 GMT (envelope-from git) Date: Wed, 30 Dec 2020 22:45:53 GMT Message-Id: <202012302245.0BUMjrpm032399@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Piotr Kubaj Subject: git: 76ff03aef741 - main - powerpc: Fix copyin/copyout race condition MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pkubaj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 76ff03aef7411e601673dfc997bd6d691bd9a14e Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2020 22:45:53 -0000 The branch main has been updated by pkubaj (ports committer): URL: https://cgit.FreeBSD.org/src/commit/?id=76ff03aef7411e601673dfc997bd6d691bd9a14e commit 76ff03aef7411e601673dfc997bd6d691bd9a14e Author: Justin Hibbits AuthorDate: 2020-12-08 22:49:25 +0000 Commit: Piotr Kubaj CommitDate: 2020-12-30 22:45:44 +0000 powerpc: Fix copyin/copyout race condition It's possible for a context switch, and CPU migration, to occur between fetching the PCPU context and extracting the pc_curpcb. This can cause the fault handler to be installed for the wrong thread, leading to a panic in copyin()/copyout(). Since curthread is already in %r13, just use that directly, as GPRs are migrated, so there is no migration race risk. --- sys/powerpc/powerpc/support.S | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/sys/powerpc/powerpc/support.S b/sys/powerpc/powerpc/support.S index 9ff1bcc02437..10d3192972d5 100644 --- a/sys/powerpc/powerpc/support.S +++ b/sys/powerpc/powerpc/support.S @@ -61,6 +61,7 @@ /* log_2(8 * WORD) */ #define LOOP_LOG 6 #define LOG_WORD 3 +#define CURTHREAD %r13 #else #define LOAD lwz #define STORE stw @@ -70,6 +71,7 @@ /* log_2(8 * WORD) */ #define LOOP_LOG 5 #define LOG_WORD 2 +#define CURTHREAD %r2 #endif #ifdef AIM @@ -149,32 +151,26 @@ #endif -#define PCPU(reg) mfsprg reg, 0 - #define SET_COPYFAULT(raddr, rpcb, len) \ VALIDATE_ADDR_COPY(raddr, len) ;\ - PCPU(%r9) ;\ li %r0, COPYFAULT ;\ - LOAD rpcb, PC_CURPCB(%r9) ;\ + LOAD rpcb, TD_PCB(CURTHREAD) ;\ STORE %r0, PCB_ONFAULT(rpcb) ;\ #define SET_COPYFAULT_TRUNCATE(raddr, rpcb, len)\ VALIDATE_TRUNCATE_ADDR_COPY(raddr, len) ;\ - PCPU(%r9) ;\ li %r0, COPYFAULT ;\ - LOAD rpcb, PC_CURPCB(%r9) ;\ + LOAD rpcb, TD_PCB(CURTHREAD) ;\ STORE %r0, PCB_ONFAULT(rpcb) #define SET_FUSUFAULT(raddr, rpcb) \ VALIDATE_ADDR_FUSU(raddr) ;\ - PCPU(%r9) ;\ li %r0, FUSUFAULT ;\ - LOAD rpcb, PC_CURPCB(%r9) ;\ + LOAD rpcb, TD_PCB(CURTHREAD) ;\ STORE %r0, PCB_ONFAULT(rpcb) #define CLEAR_FAULT_NO_CLOBBER(rpcb) \ - PCPU(%r9) ;\ - LOAD rpcb, PC_CURPCB(%r9) ;\ + LOAD rpcb, TD_PCB(CURTHREAD) ;\ li %r0, 0 ;\ STORE %r0, PCB_ONFAULT(rpcb)