diff options
| author | Nicholas Miehlbradt <nicholas@linux.ibm.com> | 2023-02-28 05:43:55 +0000 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2023-04-04 22:11:03 +1000 |
| commit | ac9c8901cb10aab043bf3599d19eebacfcda2858 (patch) | |
| tree | d4e853d3daf6e4f2e99dacc5a3372e978bdaebee /arch/powerpc | |
| parent | 2500763dd3db37fad94d9b506907c59c2f5e97c6 (diff) | |
| download | linux-stable-ac9c8901cb10aab043bf3599d19eebacfcda2858.tar.gz linux-stable-ac9c8901cb10aab043bf3599d19eebacfcda2858.tar.bz2 linux-stable-ac9c8901cb10aab043bf3599d19eebacfcda2858.zip | |
powerpc: Implement arch_within_stack_frames
Walks the stack when copy_{to,from}_user address is in the stack to
ensure that the object being copied is entirely a single stack frame and
does not contain stack metadata.
Substantially similar to the x86 implementation. The back chain is used
to traverse the stack and identify stack frame boundaries.
Signed-off-by: Nicholas Miehlbradt <nicholas@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230228054355.300628-1-nicholas@linux.ibm.com
Diffstat (limited to 'arch/powerpc')
| -rw-r--r-- | arch/powerpc/Kconfig | 1 | ||||
| -rw-r--r-- | arch/powerpc/include/asm/ppc_asm.h | 8 | ||||
| -rw-r--r-- | arch/powerpc/include/asm/thread_info.h | 38 |
3 files changed, 47 insertions, 0 deletions
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index 47017975fc2b..fc4e81dafca7 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -200,6 +200,7 @@ config PPC select HAVE_ARCH_KCSAN if PPC_BOOK3S_64 select HAVE_ARCH_KFENCE if ARCH_SUPPORTS_DEBUG_PAGEALLOC select HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET + select HAVE_ARCH_WITHIN_STACK_FRAMES select HAVE_ARCH_KGDB select HAVE_ARCH_MMAP_RND_BITS select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h index d2f44612f4b0..1f1a64b780e3 100644 --- a/arch/powerpc/include/asm/ppc_asm.h +++ b/arch/powerpc/include/asm/ppc_asm.h @@ -837,4 +837,12 @@ END_FTR_SECTION_NESTED(CPU_FTR_CELL_TB_BUG, CPU_FTR_CELL_TB_BUG, 96) #define BTB_FLUSH(reg) #endif /* CONFIG_PPC_E500 */ +#if defined(CONFIG_PPC64_ELF_ABI_V1) +#define STACK_FRAME_PARAMS 48 +#elif defined(CONFIG_PPC64_ELF_ABI_V2) +#define STACK_FRAME_PARAMS 32 +#elif defined(CONFIG_PPC32) +#define STACK_FRAME_PARAMS 8 +#endif + #endif /* _ASM_POWERPC_PPC_ASM_H */ diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h index af58f1ed3952..cf13d84c4eb9 100644 --- a/arch/powerpc/include/asm/thread_info.h +++ b/arch/powerpc/include/asm/thread_info.h @@ -45,6 +45,7 @@ #include <linux/cache.h> #include <asm/processor.h> #include <asm/accounting.h> +#include <asm/ppc_asm.h> #define SLB_PRELOAD_NR 16U /* @@ -186,6 +187,43 @@ static inline bool test_thread_local_flags(unsigned int flags) #define is_elf2_task() (0) #endif +/* + * Walks up the stack frames to make sure that the specified object is + * entirely contained by a single stack frame. + * + * Returns: + * GOOD_FRAME if within a frame + * BAD_STACK if placed across a frame boundary (or outside stack) + */ +static inline int arch_within_stack_frames(const void * const stack, + const void * const stackend, + const void *obj, unsigned long len) +{ + const void *params; + const void *frame; + + params = *(const void * const *)current_stack_pointer + STACK_FRAME_PARAMS; + frame = **(const void * const * const *)current_stack_pointer; + + /* + * low -----------------------------------------------------------> high + * [backchain][metadata][params][local vars][saved registers][backchain] + * ^------------------------------------^ + * | allows copies only in this region | + * | | + * params frame + * The metadata region contains the saved LR, CR etc. + */ + while (stack <= frame && frame < stackend) { + if (obj + len <= frame) + return obj >= params ? GOOD_FRAME : BAD_STACK; + params = frame + STACK_FRAME_PARAMS; + frame = *(const void * const *)frame; + } + + return BAD_STACK; +} + #endif /* !__ASSEMBLY__ */ #endif /* __KERNEL__ */ |