mips_atomic_set fixups (with LLSC)

The kernel can be caused to crash when making the following syscall sysmips(MIPS_ATOMIC_SET, [unaligned addr], value, 0);

The latest mips_atomic_set does not use the fixups that are defined for the ll/sc instructions.

If an unaligned address is passed in we take the exception and unaligned.c:emulate_load_store_insn ignores the fixups for the ll/sc and sends a SIGBUS instead, thus causing the kernel to die.

The patch is to make the ll/sc instructions lookup the fixup table and do them if present.

Also the fixup for the instructions in scall_o32.S appears to be inappropriate, so the fixup is set to be bad_addr and an -EFAULT is returned from the syscall.

Cheers

----
Liam Davies
[email protected]

@@ -114,12 +114,14 @@
 	 * These are instructions that a compiler doesn't generate.  We
 	 * can assume therefore that the code is MIPS-aware and
 	 * really buggy.  Emulating these instructions would break the
-	 * semantics anyway.
+	 * semantics anyway. However, we do want to look at the exception
+	 * table to see if we can exit gracefully.
 	 */
 	case ll_op:
 	case lld_op:
 	case sc_op:
 	case scd_op:
+		goto fault;
 
 	/*
 	 * For these instructions the only way to create an address

@@ -201,7 +201,7 @@
 	or	a0, a0, a1
 	li	v0, -EFAULT
 	and	a0, a0, v1
-	bltz	a0, 8f
+	bltz	a0, bad_address
 
 #ifdef CONFIG_CPU_HAS_LLSC
 	/* Ok, this is the ll/sc case.  World is sane :-)  */

@@ -211,8 +211,8 @@
 	beqz	a0, 1b
 
 	.section __ex_table,"a"
-	PTR	1b, bad_stack
-	PTR	2b, bad_stack
+	PTR	1b, bad_address
+	PTR	2b, bad_address
 	.previous
 #else
 	sw	a1, 16(sp)

@@ -256,8 +256,9 @@
 no_mem:	li	v0, -ENOMEM
 	jr	ra
 
-8:	li	v0, -EFAULT
-9:	jr	ra
+bad_address:
+	li	v0, -EFAULT
+	jr	ra
 	END(mips_atomic_set)	
 
 	LEAF(sys_sysmips)

An unaligned ll/sc instruction in the kernel is a bug in itself as such it's not unaligned.c that is to blame. As such I'm going to checkin a patch that is close but not identical to your patch.

Blame me for this bug, I *knew* and forgot about it ...

Ralf