linux-kernel - Re: [PATCH] sparc64: Swap registers for fault code and address in mna trap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20160617.231234.1295900275353757289.davem@davemloft.net>
Date:	Fri, 17 Jun 2016 23:12:34 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	hikanda@...b.co.jp
Cc:	sparclinux@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] sparc64: Swap registers for fault code and address in
 mna trap

From: 神田　尚 <hikanda@...b.co.jp>
Date: Fri, 17 Jun 2016 01:49:11 +0000

> This bug may occur in the following.
>
> user_rtt_fill_64bit          <= If mna trap occurred, call do_mna
> +-> do_mna                   <= Mistake storing registers for fault code and address
>     +-> winfix_mna
>         +-> user_rtt_fill_fixup  <= Put fault address into thread_info->flag's TI_FAULT_CODE 
>             +-> do_sparc64_fault() <= If fault address has FAULT_CODE_ITLB and FAULT_CODE_DTLB bits, call BUG()
>                 +-> BUG()

We should not be invoking do_sparc64_fault() in this case.

Instead, we call either sun4v_do_mna() or mem_address_unaligned().

Neither of which care about the values stored in the thread's fault
address and code.

If you can really trigger this code path, please post the kernel log
backtrace that happens when the BUG() triggers.  That way we can
figure out what the real problem is.

Your patch is also wrong for other reasons, it would break the
unaligned trap code paths that don't go via user_rtt_fill_64bit
fixups.