Patch "arm64: hw_breakpoint: fix watchpoint matching for tagged pointers" has been added to the 3.18-stable tree

This is a note to let you know that I've just added the patch titled

arm64: hw_breakpoint: fix watchpoint matching for tagged pointers

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
arm64-hw_breakpoint-fix-watchpoint-matching-for-tagged-pointers.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Kristina Martsenko <[email protected]>
Date: Wed, 3 May 2017 16:37:46 +0100
Subject: arm64: hw_breakpoint: fix watchpoint matching for tagged pointers

From: Kristina Martsenko <[email protected]>

commit 7dcd9dd8cebe9fa626af7e2358d03a37041a70fb upstream.

When we take a watchpoint exception, the address that triggered the watchpoint is found in FAR_EL1. We compare it to the address of each configured watchpoint to see which one was hit.

The configured watchpoint addresses are untagged, while the address in FAR_EL1 will have an address tag if the data access was done using a tagged address. The tag needs to be removed to compare the address to the watchpoints.

Currently we don't remove it, and as a result can report the wrong watchpoint as being hit (specifically, always either the highest TTBR0 watchpoint or lowest TTBR1 watchpoint). This patch removes the tag.

---
 arch/arm64/include/asm/uaccess.h  |    8 ++++++++
 arch/arm64/kernel/hw_breakpoint.c |    3 ++-
 include/linux/bitops.h            |   11 +++++++++++
 3 files changed, 21 insertions(+), 1 deletion(-)

@@ -21,6 +21,7 @@
 /*
  * User space memory access functions
  */
+#include <linux/bitops.h>
 #include <linux/string.h>
 #include <linux/thread_info.h>
 

@@ -100,6 +101,13 @@ static inline void set_fs(mm_segment_t f
 	flag;								\
 })
 
+/*
+ * When dealing with data aborts, watchpoints, or instruction traps we may end
+ * up with a tagged userland pointer. Clear the tag to get a sane pointer to
+ * pass on to access_ok(), for instance.
+ */
+#define untagged_addr(addr)		sign_extend64(addr, 55)
+
 #define access_ok(type, addr, size)	__range_ok(addr, size)
 #define user_addr_max			get_fs
 

@@ -35,6 +35,7 @@
 #include <asm/traps.h>
 #include <asm/cputype.h>
 #include <asm/system_misc.h>
+#include <asm/uaccess.h>
 
 /* Breakpoint currently in use for each BRP. */
 static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]);

@@ -688,7 +689,7 @@ static int watchpoint_handler(unsigned l
 
 		/* Check if the watchpoint value matches. */
 		val = read_wb_reg(AARCH64_DBG_REG_WVR, i);
-		if (val != (addr & ~alignment_mask))
+		if (val != (untagged_addr(addr) & ~alignment_mask))
 			goto unlock;
 
 		/* Possible match, check the byte address select to confirm. */

@@ -171,6 +171,17 @@ static inline __s32 sign_extend32(__u32
 	return (__s32)(value << shift) >> shift;
 }
 
+/**
+ * sign_extend64 - sign extend a 64-bit value using specified bit as sign-bit
+ * @value: value to sign extend
+ * @index: 0 based bit index (0<=index<64) to sign bit
+ */
+static inline __s64 sign_extend64(__u64 value, int index)
+{
+	__u8 shift = 63 - index;
+	return (__s64)(value << shift) >> shift;
+}
+
 static inline unsigned fls_long(unsigned long l)
 {
 	if (sizeof(l) == 4)

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/arm64-hw_breakpoint-fix-watchpoint-matching-for-tagged-pointers.patch queue-3.18/arm64-entry-improve-data-abort-handling-of-tagged-pointers.patch