From patchwork Fri Nov 8 12:35:20 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 178902 Delivered-To: patch@linaro.org Received: by 2002:a92:38d5:0:0:0:0:0 with SMTP id g82csp2636694ilf; Fri, 8 Nov 2019 04:36:41 -0800 (PST) X-Google-Smtp-Source: APXvYqzlEvdwsUNguOjSeIQGbwTs/mR2x7ujnDUsWwVNt5gO4gXUbYV7QyntU0f2v5KDDTzQ48vy X-Received: by 2002:a17:906:48b:: with SMTP id f11mr8327802eja.225.1573216601132; Fri, 08 Nov 2019 04:36:41 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1573216601; cv=none; d=google.com; s=arc-20160816; b=YXDK9+t6tD01U13PXi2LJYXcjwcu80/1gqJU/jhQwJnbiuiybwlr5ajc0Ams8aH4TN OaxG9FkyyU0PoQlVIZaKAmR0+oYZvmMxVoLyh1By+kWXGWgRohT0PBhaxB/wuRhMQ9Wi WpyGi/lgKYE0WV3IW14QlSWRfAYOguc+oh6S21WJOlg4p/FHOwcbEMSDSv+7hXgbj5g/ 1MmsIZyhglgyDNPrUp0z1SMWRa+tn8VJNjYg7fFuIpbk5qVHDSSP9g5VKiPnEJFgPaM/ Cx8r0LeRQLKUHlMbRT6S2pI7QsytWFg9dhS17QjAR7RiXvPcCQJv9/Lhl/qsP9jZ6OGA 7mMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=oXzDF4kUMSNpL2LfGqVke6muD1Fhdk6CRhidJoae45I=; b=QBg2cL+EUTAwZY/VL3dItxkDm0HDK2m+vkZVVC5wDF7YZ9P8yN8qRTNNVV4fb8q4aH 7XVzsT0Ajs9ALMGrfvGhY1En4geaZYhrrlPHEqXAAe/zP0ca0mptzu9FHGZrz7iYk9fW h0Gziw5pjM9g40xBXVADbe3/O6NG0Xv/eiJZfOBJkmIdGRAukQSIxmKbsnAXJ41dNuK0 zfbYRQXz8ggnZ1L61B2Gx6fTp/Tpi2PPsrgo+1LmY12xJLRRfVNhVhZxB6/aYljPOy12 6dj9wBd4QjwMNuTL+nTMtrTshCRrY6EL1dyO35TRWQSpzR6eHbd9xLqlqdEBkSxbbstd l8Uw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=qsWzBCOO; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o19si3411305ejc.315.2019.11.08.04.36.40; Fri, 08 Nov 2019 04:36:41 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=qsWzBCOO; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726983AbfKHMgk (ORCPT + 14 others); Fri, 8 Nov 2019 07:36:40 -0500 Received: from mail.kernel.org ([198.145.29.99]:44190 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726121AbfKHMgk (ORCPT ); Fri, 8 Nov 2019 07:36:40 -0500 Received: from localhost.localdomain (lfbn-mar-1-550-151.w90-118.abo.wanadoo.fr [90.118.131.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A63B522473; Fri, 8 Nov 2019 12:36:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1573216598; bh=WSTMKA6CZD25gPji7U33DAMleVGxbEX54DWnjjhYd2E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qsWzBCOOTQsAdHUWwvrPJ/p6mVzuIJsxSPXaUgtM7iD76kS1OZGdt0rCggv5iayAp spZJiVcJNjl6e2CiRDlZ6/4dvAoCZCeJReFSNyTViROCSsyBDOODU6RRqE1ivkxJuU x1GpGjzT6rQkErbpkwWj6vHTsst/Qhz5nCN9HLZ4= From: Ard Biesheuvel To: stable@vger.kernel.org Cc: linus.walleij@linaro.org, rmk+kernel@armlinux.org.uk, Marc Zyngier , Ard Biesheuvel Subject: [PATCH for-stable-4.4 16/50] arm/arm64: smccc-1.1: Handle function result as parameters Date: Fri, 8 Nov 2019 13:35:20 +0100 Message-Id: <20191108123554.29004-17-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191108123554.29004-1-ardb@kernel.org> References: <20191108123554.29004-1-ardb@kernel.org> MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Marc Zyngier [ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ] If someone has the silly idea to write something along those lines: extern u64 foo(void); void bar(struct arm_smccc_res *res) { arm_smccc_1_1_smc(0xbad, foo(), res); } they are in for a surprise, as this gets compiled as: 0000000000000588 : 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 5a4: aa0003e1 mov x1, x0 5a8: d4000003 smc #0x0 5ac: b4000073 cbz x19, 5b8 5b0: a9000660 stp x0, x1, [x19] 5b4: a9010e62 stp x2, x3, [x19, #16] 5b8: f9400bf3 ldr x19, [sp, #16] 5bc: a8c27bfd ldp x29, x30, [sp], #32 5c0: d65f03c0 ret 5c4: d503201f nop The call to foo "overwrites" the x0 register for the return value, and we end up calling the wrong secure service. A solution is to evaluate all the parameters before assigning anything to specific registers, leading to the expected result: 0000000000000588 : 588: a9be7bfd stp x29, x30, [sp, #-32]! 58c: 910003fd mov x29, sp 590: f9000bf3 str x19, [sp, #16] 594: aa0003f3 mov x19, x0 598: aa1e03e0 mov x0, x30 59c: 94000000 bl 0 <_mcount> 5a0: 94000000 bl 0 5a4: aa0003e1 mov x1, x0 5a8: d28175a0 mov x0, #0xbad 5ac: d4000003 smc #0x0 5b0: b4000073 cbz x19, 5bc 5b4: a9000660 stp x0, x1, [x19] 5b8: a9010e62 stp x2, x3, [x19, #16] 5bc: f9400bf3 ldr x19, [sp, #16] 5c0: a8c27bfd ldp x29, x30, [sp], #32 5c4: d65f03c0 ret Reported-by: Julien Grall Signed-off-by: Marc Zyngier Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ard Biesheuvel --- include/linux/arm-smccc.h | 30 +++++++++++++------- 1 file changed, 20 insertions(+), 10 deletions(-) -- 2.20.1 diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h index 9b340ff4fd7b..78b8e0a61f3f 100644 --- a/include/linux/arm-smccc.h +++ b/include/linux/arm-smccc.h @@ -173,41 +173,51 @@ asmlinkage void arm_smccc_hvc(unsigned long a0, unsigned long a1, register unsigned long r3 asm("r3") #define __declare_arg_1(a0, a1, res) \ + typeof(a1) __a1 = a1; \ struct arm_smccc_res *___res = res; \ register unsigned long r0 asm("r0") = (u32)a0; \ - register unsigned long r1 asm("r1") = a1; \ + register unsigned long r1 asm("r1") = __a1; \ register unsigned long r2 asm("r2"); \ register unsigned long r3 asm("r3") #define __declare_arg_2(a0, a1, a2, res) \ + typeof(a1) __a1 = a1; \ + typeof(a2) __a2 = a2; \ struct arm_smccc_res *___res = res; \ register unsigned long r0 asm("r0") = (u32)a0; \ - register unsigned long r1 asm("r1") = a1; \ - register unsigned long r2 asm("r2") = a2; \ + register unsigned long r1 asm("r1") = __a1; \ + register unsigned long r2 asm("r2") = __a2; \ register unsigned long r3 asm("r3") #define __declare_arg_3(a0, a1, a2, a3, res) \ + typeof(a1) __a1 = a1; \ + typeof(a2) __a2 = a2; \ + typeof(a3) __a3 = a3; \ struct arm_smccc_res *___res = res; \ register unsigned long r0 asm("r0") = (u32)a0; \ - register unsigned long r1 asm("r1") = a1; \ - register unsigned long r2 asm("r2") = a2; \ - register unsigned long r3 asm("r3") = a3 + register unsigned long r1 asm("r1") = __a1; \ + register unsigned long r2 asm("r2") = __a2; \ + register unsigned long r3 asm("r3") = __a3 #define __declare_arg_4(a0, a1, a2, a3, a4, res) \ + typeof(a4) __a4 = a4; \ __declare_arg_3(a0, a1, a2, a3, res); \ - register typeof(a4) r4 asm("r4") = a4 + register unsigned long r4 asm("r4") = __a4 #define __declare_arg_5(a0, a1, a2, a3, a4, a5, res) \ + typeof(a5) __a5 = a5; \ __declare_arg_4(a0, a1, a2, a3, a4, res); \ - register typeof(a5) r5 asm("r5") = a5 + register unsigned long r5 asm("r5") = __a5 #define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res) \ + typeof(a6) __a6 = a6; \ __declare_arg_5(a0, a1, a2, a3, a4, a5, res); \ - register typeof(a6) r6 asm("r6") = a6 + register unsigned long r6 asm("r6") = __a6 #define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res) \ + typeof(a7) __a7 = a7; \ __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res); \ - register typeof(a7) r7 asm("r7") = a7 + register unsigned long r7 asm("r7") = __a7 #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) #define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__)