Patch "MIPS: Don't unwind to user mode with EVA" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

MIPS: Don't unwind to user mode with EVA

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mips-don-t-unwind-to-user-mode-with-eva.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: James Hogan <[email protected]>
Date: Fri, 4 Dec 2015 22:25:01 +0000
Subject: MIPS: Don't unwind to user mode with EVA

From: James Hogan <[email protected]>

commit a816b306c62195b7c43c92cb13330821a96bdc27 upstream.

When unwinding through IRQs and exceptions, the unwinding only continues if the PC is a kernel text address, however since EVA it is possible for user and kernel address ranges to overlap, potentially allowing unwinding to continue to user mode if the user PC happens to be in the kernel text address range.

Adjust the check to also ensure that the register state from before the exception is actually running in kernel mode, i.e. !user_mode(regs).

I don't believe any harm can come of this problem, since the PC is only output, the stack pointer is checked to ensure it resides within the task's stack page before it is dereferenced in search of the return address, and the return address register is similarly only output (if the PC is in a leaf function or the beginning of a non-leaf function).

However unwind_stack() is only meant for unwinding kernel code, so to be correct the unwind should stop there.

Patchwork: https://patchwork.linux-mips.org/patch/11700/

---
 arch/mips/kernel/process.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -455,7 +455,7 @@ unsigned long notrace unwind_stack_by_ad
 		    *sp + sizeof(*regs) <= stack_page + THREAD_SIZE - 32) {
 			regs = (struct pt_regs *)*sp;
 			pc = regs->cp0_epc;
-			if (__kernel_text_address(pc)) {
+			if (!user_mode(regs) && __kernel_text_address(pc)) {
 				*sp = regs->regs[29];
 				*ra = regs->regs[31];
 				return pc;

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/mips64-r6-r2-emulation-bugfix.patch queue-4.6/mips-fix-uapi-include-in-exported-asm-siginfo.h.patch queue-4.6/mips-disable-preemption-during-prctl-pr_set_fp_mode.patch queue-4.6/mips-fix-sigreturn-via-vdso-on-micromips-kernel.patch queue-4.6/mips-fix-siginfo.h-to-use-strict-posix-types.patch queue-4.6/mips-force-cpus-to-lose-fp-context-during-mode-switches.patch queue-4.6/mips-don-t-unwind-to-user-mode-with-eva.patch queue-4.6/mips-vdso-build-with-fno-strict-aliasing.patch queue-4.6/mips-fix-watchpoint-restoration.patch queue-4.6/mips-build-micromips-vdso-for-micromips-kernels.patch queue-4.6/mips-math-emu-fix-jalr-emulation-when-rd-0.patch queue-4.6/mips-fix-msa-ld_-st_-asm-macros-to-use-ptr_addu.patch queue-4.6/mips-avoid-using-unwind_stack-with-usermode.patch queue-4.6/mips-prevent-restoration-of-msa-context-in-non-msa-kernels.patch queue-4.6/mips-use-copy_s.fmt-rather-than-copy_u.fmt.patch