linux-kernel - [PATCH v4 0/5] Fix accurate exception reporting in SPARC assembly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250905-memcpy_series-v4-0-1ca72dda195b@mkarcher.dialup.fu-berlin.de>
Date: Fri, 05 Sep 2025 00:03:29 +0200
From: Michael Karcher <kernel@...rcher.dialup.fu-berlin.de>
To: Andreas Larsson <andreas@...sler.com>
Cc: sparclinux@...r.kernel.org, linux-kernel@...r.kernel.org, 
 Michael Karcher <kernel@...rcher.dialup.fu-berlin.de>, 
 John Paul Adrian Glaubitz <glaubitz@...sik.fu-berlin.de>, 
 Anthony Yznaga <anthony.yznaga@...cle.com>, 
 René Rebe <rene@...ctcode.com>, 
 Jonathan 'theJPster' Pallant <kernel@...jpster.org.uk>, 
 Magnus Lindholm <linmag7@...il.com>, Tony Rodriguez <unixpro1970@...il.com>
Subject: [PATCH v4 0/5] Fix accurate exception reporting in SPARC assembly

In 2018, David Miller implemented accurate exception reporting in
copy_from_user and copy_to_user by handling exceptions on each load
or store instruction that accesses userspace memory and calculating
the remaining bytes from the processor context. As issues with
transparent huge page support and folio support in ext4 were due
to a bogus return value from copy_from_user, I wrote a comprehensive
testsuite for the generic variant, and the machine-specific variants
for UltraSPARC I/II, UltraSPARC III, Niagara, Niagara 2/3,
Niagara 4 and M7, see

https://github.com/karcherm/sparc-cfu-bug-reproducer

despite the name of the project, it does not only test copy_from_user,
but also copy_to_user, and it also contains fixes to a very small amount
of exception handler references that were calculating the result in
a wrong way.

For UltraSPARC III, I chose to adjust the memcpy code itself instead of
adding complexity to multiple exception handlers. That fix has already
been tested to fix stability issues observed by Adrian Glaubitz which
kicked off the investigation. On all other architectures, the changes
are just to the exception handlers.

Kind regards,
  Michael Karcher

Signed-off-by: Michael Karcher <kernel@...rcher.dialup.fu-berlin.de>
---
Changes in v4:
- Add further credit for running tests on machines with this patch applied
- Link to v3: https://lore.kernel.org/r/20250904-memcpy_series-v3-0-906655a5a7ad@mkarcher.dialup.fu-berlin.de

Changes in v3:
- Fix bad formatting in commit messages (missing line wrap,
  extra empty line after Fixes:)
- Consistently add hardware to Tested-By lines
- Link to v2: https://lore.kernel.org/r/20250904-memcpy_series-v2-0-9806dd1784e7@mkarcher.dialup.fu-berlin.de

Changes in v2:
- More verbose description on how these issues were found
- Add M7 change, previously separate in
  https://lore.kernel.org/r/20250828121844.2250-1-kernel@mkarcher.dialup.fu-berlin.de
- Link to v1: https://lore.kernel.org/r/20250826160312.2070-1-kernel@mkarcher.dialup.fu-berlin.de

---
Michael Karcher (5):
      sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
      sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
      sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
      sparc: fix accurate exception reporting in copy_to_user for Niagara 4
      sparc: fix accurate exception reporting in copy_{from,to}_user for M7

 arch/sparc/lib/M7memcpy.S     | 20 ++++++++++----------
 arch/sparc/lib/Memcpy_utils.S |  9 +++++++++
 arch/sparc/lib/NG4memcpy.S    |  2 +-
 arch/sparc/lib/NGmemcpy.S     | 29 ++++++++++++++++++-----------
 arch/sparc/lib/U1memcpy.S     | 19 ++++++++++---------
 arch/sparc/lib/U3memcpy.S     |  2 +-
 6 files changed, 49 insertions(+), 32 deletions(-)
---
base-commit: b320789d6883cc00ac78ce83bccbfe7ed58afcf0
change-id: 20250902-memcpy_series-b3bdd5542ca7

Best regards,
-- 
Michael Karcher <kernel@...rcher.dialup.fu-berlin.de>