Skip to contentSkip to conversation

4.4.30-stable review

PATCH In review Greg Kroah-Hartman 3 participants 7 messages Oct 31, 2016 Stable branch

lore
Share & tools
lore

Greg Kroah-Hartman

author maintainer
#0 lore raw

cover 4.4.30-stable review

Based on the discussion at the kernel summit a few hours ago, here's a quick bug-fix release for 4.4-stable to resolve an issue with 4.4.29 and older kernels. I'll probably release it once the testing systems run on it to verify nothing is broken.

This is the start of the stable review cycle for the 4.4.30 release. There are 2 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made as soon as possible!

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.30-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 4.4.30-rc1

Greg Kroah-Hartman <[email protected]>
Revert "fix minor infoleak in get_user_ex()"

Greg Kroah-Hartman <[email protected]>
Revert "x86/mm: Expand the exception table logic to allow new handling options"

-------------

Diffstat:

 Documentation/x86/exception-tables.txt |  35 ------------
 Makefile                               |   4 +-
 arch/x86/include/asm/asm.h             |  40 ++++++-------
 arch/x86/include/asm/uaccess.h         |  22 +++-----
 arch/x86/kernel/kprobes/core.c         |   2 +-
 arch/x86/kernel/traps.c                |   6 +-
 arch/x86/mm/extable.c                  | 100 +++++++++------------------------
 arch/x86/mm/fault.c                    |   2 +-
 scripts/sortextable.c                  |  32 -----------
 9 files changed, 60 insertions(+), 183 deletions(-)
author maintainer
#1 lore raw

PATCH 1/2 Revert "x86/mm: Expand the exception table logic to allow new handling options"

4.4-stable review patch. If anyone has any objections, please let me know.

------------------

This reverts commit fcf5e5198b447969ed2a56ec335dae3c695a6b46 which is 548acf19234dbda5a52d5a8e7e205af46e9da840 upstream.

Cc Tony Luck <[email protected]>
Cc Borislav Petkov <[email protected]>
Cc Linus Torvalds <[email protected]>
Cc Peter Zijlstra <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Ingo Molnar <[email protected]>
---
 Documentation/x86/exception-tables.txt |   35 -----------
 arch/x86/include/asm/asm.h             |   40 +++++-------
 arch/x86/include/asm/uaccess.h         |   16 ++---
 arch/x86/kernel/kprobes/core.c         |    2 
 arch/x86/kernel/traps.c                |    6 -
 arch/x86/mm/extable.c                  |  102 +++++++++------------------------
 arch/x86/mm/fault.c                    |    2 
 scripts/sortextable.c                  |   32 ----------
 8 files changed, 58 insertions(+), 177 deletions(-)
Documentation/x86/exception-tables.txt +0 -35
@@ -290,38 +290,3 @@ Due to the way that the exception table
 only use exceptions for code in the .text section.  Any other section
 will cause the exception table to not be sorted correctly, and the
 exceptions will fail.
-
-Things changed when 64-bit support was added to x86 Linux. Rather than
-double the size of the exception table by expanding the two entries
-from 32-bits to 64 bits, a clever trick was used to store addresses
-as relative offsets from the table itself. The assembly code changed
-from:
-	.long 1b,3b
-to:
-        .long (from) - .
-        .long (to) - .
-
-and the C-code that uses these values converts back to absolute addresses
-like this:
-
-	ex_insn_addr(const struct exception_table_entry *x)
-	{
-		return (unsigned long)&x->insn + x->insn;
-	}
-
-In v4.6 the exception table entry was expanded with a new field "handler".
-This is also 32-bits wide and contains a third relative function
-pointer which points to one of:
-
-1) int ex_handler_default(const struct exception_table_entry *fixup)
-   This is legacy case that just jumps to the fixup code
-2) int ex_handler_fault(const struct exception_table_entry *fixup)
-   This case provides the fault number of the trap that occurred at
-   entry->insn. It is used to distinguish page faults from machine
-   check.
-3) int ex_handler_ext(const struct exception_table_entry *fixup)
-   This case is used for uaccess_err ... we need to set a flag
-   in the task structure. Before the handler functions existed this
-   case was handled by adding a large offset to the fixup to tag
-   it as special.
-More functions can easily be added.
arch/x86/include/asm/asm.h +16 -24
@@ -44,22 +44,19 @@
 
 /* Exception table entry */
 #ifdef __ASSEMBLY__
-# define _ASM_EXTABLE_HANDLE(from, to, handler)			\
+# define _ASM_EXTABLE(from,to)					\
 	.pushsection "__ex_table","a" ;				\
-	.balign 4 ;						\
+	.balign 8 ;						\
 	.long (from) - . ;					\
 	.long (to) - . ;					\
-	.long (handler) - . ;					\
 	.popsection
 
-# define _ASM_EXTABLE(from, to)					\
-	_ASM_EXTABLE_HANDLE(from, to, ex_handler_default)
-
-# define _ASM_EXTABLE_FAULT(from, to)				\
-	_ASM_EXTABLE_HANDLE(from, to, ex_handler_fault)
-
-# define _ASM_EXTABLE_EX(from, to)				\
-	_ASM_EXTABLE_HANDLE(from, to, ex_handler_ext)
+# define _ASM_EXTABLE_EX(from,to)				\
+	.pushsection "__ex_table","a" ;				\
+	.balign 8 ;						\
+	.long (from) - . ;					\
+	.long (to) - . + 0x7ffffff0 ;				\
+	.popsection
 
 # define _ASM_NOKPROBE(entry)					\
 	.pushsection "_kprobe_blacklist","aw" ;			\
@@ -92,24 +89,19 @@
 	.endm
 
 #else
-# define _EXPAND_EXTABLE_HANDLE(x) #x
-# define _ASM_EXTABLE_HANDLE(from, to, handler)			\
+# define _ASM_EXTABLE(from,to)					\
 	" .pushsection \"__ex_table\",\"a\"\n"			\
-	" .balign 4\n"						\
+	" .balign 8\n"						\
 	" .long (" #from ") - .\n"				\
 	" .long (" #to ") - .\n"				\
-	" .long (" _EXPAND_EXTABLE_HANDLE(handler) ") - .\n"	\
 	" .popsection\n"
 
-# define _ASM_EXTABLE(from, to)					\
-	_ASM_EXTABLE_HANDLE(from, to, ex_handler_default)
-
-# define _ASM_EXTABLE_FAULT(from, to)				\
-	_ASM_EXTABLE_HANDLE(from, to, ex_handler_fault)
-
-# define _ASM_EXTABLE_EX(from, to)				\
-	_ASM_EXTABLE_HANDLE(from, to, ex_handler_ext)
-
+# define _ASM_EXTABLE_EX(from,to)				\
+	" .pushsection \"__ex_table\",\"a\"\n"			\
+	" .balign 8\n"						\
+	" .long (" #from ") - .\n"				\
+	" .long (" #to ") - . + 0x7ffffff0\n"			\
+	" .popsection\n"
 /* For C file, we already have NOKPROBE_SYMBOL macro */
 #endif
 
arch/x86/include/asm/uaccess.h +8 -8
@@ -90,11 +90,12 @@ static inline bool __chk_range_not_ok(un
 	likely(!__range_not_ok(addr, size, user_addr_max()))
 
 /*
- * The exception table consists of triples of addresses relative to the
- * exception table entry itself. The first address is of an instruction
- * that is allowed to fault, the second is the target at which the program
- * should continue. The third is a handler function to deal with the fault
- * caused by the instruction in the first field.
+ * The exception table consists of pairs of addresses relative to the
+ * exception table enty itself: the first is the address of an
+ * instruction that is allowed to fault, and the second is the address
+ * at which the program should continue.  No registers are modified,
+ * so it is entirely up to the continuation code to figure out what to
+ * do.
  *
  * All the routines below use bits of fixup code that are out of line
  * with the main instruction path.  This means when everything is well,
@@ -103,14 +104,13 @@ static inline bool __chk_range_not_ok(un
  */
 
 struct exception_table_entry {
-	int insn, fixup, handler;
+	int insn, fixup;
 };
 /* This is not the generic standard exception_table_entry format */
 #define ARCH_HAS_SORT_EXTABLE
 #define ARCH_HAS_SEARCH_EXTABLE
 
-extern int fixup_exception(struct pt_regs *regs, int trapnr);
-extern bool ex_has_fault_handler(unsigned long ip);
+extern int fixup_exception(struct pt_regs *regs);
 extern int early_fixup_exception(unsigned long *ip);
 
 /*
arch/x86/kernel/kprobes/core.c +1 -1
@@ -1000,7 +1000,7 @@ int kprobe_fault_handler(struct pt_regs
 		 * In case the user-specified fault handler returned
 		 * zero, try to fix up.
 		 */
-		if (fixup_exception(regs, trapnr))
+		if (fixup_exception(regs))
 			return 1;
 
 		/*
arch/x86/kernel/traps.c +3 -3
@@ -199,7 +199,7 @@ do_trap_no_signal(struct task_struct *ts
 	}
 
 	if (!user_mode(regs)) {
-		if (!fixup_exception(regs, trapnr)) {
+		if (!fixup_exception(regs)) {
 			tsk->thread.error_code = error_code;
 			tsk->thread.trap_nr = trapnr;
 			die(str, regs, error_code);
@@ -453,7 +453,7 @@ do_general_protection(struct pt_regs *re
 
 	tsk = current;
 	if (!user_mode(regs)) {
-		if (fixup_exception(regs, X86_TRAP_GP))
+		if (fixup_exception(regs))
 			return;
 
 		tsk->thread.error_code = error_code;
@@ -699,7 +699,7 @@ static void math_error(struct pt_regs *r
 	conditional_sti(regs);
 
 	if (!user_mode(regs)) {
-		if (!fixup_exception(regs, trapnr)) {
+		if (!fixup_exception(regs)) {
 			task->thread.error_code = error_code;
 			task->thread.trap_nr = trapnr;
 			die(str, regs, error_code);
arch/x86/mm/extable.c +29 -73

144 lines not on this page · raw message

arch/x86/mm/fault.c +1 -1
@@ -663,7 +663,7 @@ no_context(struct pt_regs *regs, unsigne
 	int sig;
 
 	/* Are we prepared to handle this kernel fault? */
-	if (fixup_exception(regs, X86_TRAP_PF)) {
+	if (fixup_exception(regs)) {
 		/*
 		 * Any interrupt that takes a fault gets the fixup. This makes
 		 * the below recursive fault logic only apply to a faults from
scripts/sortextable.c +0 -32
@@ -209,35 +209,6 @@ static int compare_relative_table(const
 	return 0;
 }
 
-static void x86_sort_relative_table(char *extab_image, int image_size)
-{
-	int i;
-
-	i = 0;
-	while (i < image_size) {
-		uint32_t *loc = (uint32_t *)(extab_image + i);
-
-		w(r(loc) + i, loc);
-		w(r(loc + 1) + i + 4, loc + 1);
-		w(r(loc + 2) + i + 8, loc + 2);
-
-		i += sizeof(uint32_t) * 3;
-	}
-
-	qsort(extab_image, image_size / 12, 12, compare_relative_table);
-
-	i = 0;
-	while (i < image_size) {
-		uint32_t *loc = (uint32_t *)(extab_image + i);
-
-		w(r(loc) - i, loc);
-		w(r(loc + 1) - (i + 4), loc + 1);
-		w(r(loc + 2) - (i + 8), loc + 2);
-
-		i += sizeof(uint32_t) * 3;
-	}
-}
-
 static void sort_relative_table(char *extab_image, int image_size)
 {
 	int i;
@@ -310,9 +281,6 @@ do_file(char const *const fname)
 		break;
 	case EM_386:
 	case EM_X86_64:
-		custom_sort = x86_sort_relative_table;
-		break;
-
 	case EM_S390:
 		custom_sort = sort_relative_table;
 		break;
author maintainer
#2 lore raw

PATCH 2/2 Revert "fix minor infoleak in get_user_ex()"

In reply to Greg Kroah-Hartman

4.4-stable review patch. If anyone has any objections, please let me know.

------------------

This reverts commit 9d25c78ec01c402dc56272693c44ef9d72ecdd2e which is 1c109fabbd51863475cd12ac206bdd249aee35af upstream

---
 arch/x86/include/asm/uaccess.h |    6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)
arch/x86/include/asm/uaccess.h +1 -5
@@ -394,11 +394,7 @@ do {									\
 #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
 	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
 		     "2:\n"						\
-		     ".section .fixup,\"ax\"\n"				\
-                     "3:xor"itype" %"rtype"0,%"rtype"0\n"		\
-		     "  jmp 2b\n"					\
-		     ".previous\n"					\
-		     _ASM_EXTABLE_EX(1b, 3b)				\
+		     _ASM_EXTABLE_EX(1b, 2b)				\
 		     : ltype(x) : "m" (__m(addr)))
 
 #define __put_user_nocheck(x, ptr, size)			\
#3 lore raw
In reply to Greg Kroah-Hartman
Quoted 11 lines · Greg Kroah-Hartman

Based on the discussion at the kernel summit a few hours ago, here's a quick bug-fix release for 4.4-stable to resolve an issue with 4.4.29 and older kernels. I'll probably release it once the testing systems run on it to verify nothing is broken.

This is the start of the stable review cycle for the 4.4.30 release. There are 2 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made as soon as possible!

FWIW I've just booted it in an x86_64 VM here and didn't notice anything wrong.

Willy

author maintainer
#4 lore raw
Quoted 11 lines · Willy Tarreau
Quoted 10 lines · Greg Kroah-Hartman

Based on the discussion at the kernel summit a few hours ago, here's a quick bug-fix release for 4.4-stable to resolve an issue with 4.4.29 and older kernels. I'll probably release it once the testing systems run on it to verify nothing is broken.

This is the start of the stable review cycle for the 4.4.30 release. There are 2 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Quoted 4 lines
Quoted 1 line

Responses should be made as soon as possible!

FWIW I've just booted it in an x86_64 VM here and didn't notice anything wrong.

Thanks for testing and letting me know.

greg k-h

#5 lore raw
In reply to Greg Kroah-Hartman
Quoted 5 lines · Greg Kroah-Hartman

Based on the discussion at the kernel summit a few hours ago, here's a quick bug-fix release for 4.4-stable to resolve an issue with 4.4.29 and older kernels. I'll probably release it once the testing systems run on it to verify nothing is broken.

Quoted 7 lines

This is the start of the stable review cycle for the 4.4.30 release. There are 2 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made as soon as possible!

Build results:

	total: 149 pass: 149 fail: 0
Qemu test results:
	total: 106 pass: 106 fail: 0

Deetails are available at http://kerneltests.org/builders.

Guenter

author maintainer
#6 lore raw
Quoted 14 lines · Guenter Roeck
Quoted 5 lines · Greg Kroah-Hartman

Based on the discussion at the kernel summit a few hours ago, here's a quick bug-fix release for 4.4-stable to resolve an issue with 4.4.29 and older kernels. I'll probably release it once the testing systems run on it to verify nothing is broken.

Quoted 7 lines

This is the start of the stable review cycle for the 4.4.30 release. There are 2 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made as soon as possible!

Quoted 6 lines

Build results:

	total: 149 pass: 149 fail: 0
Qemu test results:
	total: 106 pass: 106 fail: 0

Deetails are available at http://kerneltests.org/builders.

Wonderful, thanks so much for the quick turn-around.

greg k-h