[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-7.2.7 37/62] linux-user/sh4: Fix crashes on signal delivery
From: |
Michael Tokarev |
Subject: |
[Stable-7.2.7 37/62] linux-user/sh4: Fix crashes on signal delivery |
Date: |
Thu, 9 Nov 2023 16:59:05 +0300 |
From: Mikulas Patocka <mpatocka@redhat.com>
sh4 uses gUSA (general UserSpace Atomicity) to provide atomicity on CPUs
that don't have atomic instructions. A gUSA region that adds 1 to an
atomic variable stored in @R2 looks like this:
4004b6: 03 c7 mova 4004c4 <gusa+0x10>,r0
4004b8: f3 61 mov r15,r1
4004ba: 09 00 nop
4004bc: fa ef mov #-6,r15
4004be: 22 63 mov.l @r2,r3
4004c0: 01 73 add #1,r3
4004c2: 32 22 mov.l r3,@r2
4004c4: 13 6f mov r1,r15
R0 contains a pointer to the end of the gUSA region
R1 contains the saved stack pointer
R15 contains negative length of the gUSA region
When this region is interrupted by a signal, the kernel detects if
R15 >= -128U. If yes, the kernel rolls back PC to the beginning of the
region and restores SP by copying R1 to R15.
The problem happens if we are interrupted by a signal at address 4004c4.
R15 still holds the value -6, but the atomic value was already written by
an instruction at address 4004c2. In this situation we can't undo the
gUSA. The function unwind_gusa does nothing, the signal handler attempts
to push a signal frame to the address -6 and crashes.
This patch fixes it, so that if we are interrupted at the last instruction
in a gUSA region, we copy R1 to R15 to restore the correct stack pointer
and avoid crashing.
There's another bug: if we are interrupted in a delay slot, we save the
address of the instruction in the delay slot. We must save the address of
the previous instruction.
Cc: qemu-stable@nongnu.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: Yoshinori Sato <ysato@users.sourcefoege.jp>
Message-Id: <b16389f7-6c62-70b7-59b3-87533c0bcc@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 3b894b699c9a9c064466e128c18be80a3f2113bc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/linux-user/sh4/signal.c b/linux-user/sh4/signal.c
index c4ba962708..c16c2c2d57 100644
--- a/linux-user/sh4/signal.c
+++ b/linux-user/sh4/signal.c
@@ -104,6 +104,14 @@ static void unwind_gusa(CPUSH4State *regs)
/* Reset the SP to the saved version in R1. */
regs->gregs[15] = regs->gregs[1];
+ } else if (regs->gregs[15] >= -128u && regs->pc == regs->gregs[0]) {
+ /* If we are on the last instruction of a gUSA region, we must reset
+ the SP, otherwise we would be pushing the signal context to
+ invalid memory. */
+ regs->gregs[15] = regs->gregs[1];
+ } else if (regs->flags & TB_FLAG_DELAY_SLOT) {
+ /* If we are in a delay slot, push the previous instruction. */
+ regs->pc -= 2;
}
}
--
2.39.2
- [Stable-7.2.7 25/62] target/i386: generalize operand size "ph" for use in CVTPS2PD, (continued)
- [Stable-7.2.7 25/62] target/i386: generalize operand size "ph" for use in CVTPS2PD, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 28/62] chardev/char-pty: Avoid losing bytes when the other side just (re-)connected, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 30/62] amd_iommu: Fix APIC address check, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 29/62] linux-user/hppa: Fix struct target_sigcontext layout, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 31/62] migration/qmp: Fix crash on setting tls-authz with null, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 32/62] hw/audio/es1370: reset current sample counter, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 33/62] disas/riscv: Fix the typo of inverted order of pmpaddr13 and pmpaddr14, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 34/62] hw/pvrdma: Protect against buggy or malicious guest driver, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 36/62] linux-user/mips: fix abort on integer overflow, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 38/62] lasips2: LASI PS/2 devices are not user-createable, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 37/62] linux-user/sh4: Fix crashes on signal delivery,
Michael Tokarev <=
- [Stable-7.2.7 42/62] tests/tcg: Add -fno-stack-protector, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 43/62] qemu-img: rebase: stop when reaching EOF of old backing file, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 44/62] qemu-iotests: 024: add rebasing test case for overlay_size > backing_size, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 45/62] Revert "linux-user: add more compat ioctl definitions", Michael Tokarev, 2023/11/09
- [Stable-7.2.7 35/62] migration: Fix analyze-migration read operation signedness, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 41/62] tests/migration: Add -fno-stack-protector, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 40/62] misc/led: LED state is set opposite of what is expected, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 39/62] hw/sd/sdhci: Block Size Register bits [14:12] is lost, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 47/62] target/arm: Don't access TCG code when debugging with KVM, Michael Tokarev, 2023/11/09
- [Stable-7.2.7 46/62] Revert "linux-user: fix compat with glibc >= 2.36 sys/mount.h", Michael Tokarev, 2023/11/09