tree 52a33019fd0423f298a27e7fce3356fa272e9c4a
parent daf70d89f80c6e1772233da9e020114b1254e7e0
author Matt Redfearn <matt.redfearn@mips.com> 1523979600 +0100
committer James Hogan <jhogan@kernel.org> 1524085049 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEd80NauSabkiESfLYbAtpk944dnoFAlrXsTkACgkQbAtpk944
 dnpqQw//dgx5Lbs1aOH02QMa6uAb/qL/LbdxQE/CdeHuhQiAqC0AJLMx8o3PeCjg
 0ws6ThDlFVf7z5LuW6qfeqlhC8G6VhLqfYp63L34DJrnQfI+LUuuYNen/KWkVSGn
 lOya+HlJ9Uh2Yppk9XbJNPHfChe5esOHdJlp5HZ/qAeHYO+yPFIhYI8qkwqNqvsF
 QH57/6iRSRAZq9VX8VlGjmJYm6GsmUzwg75RmKfMTU4Lhrb7ZoUf/8XlDCtm+V+Y
 rDb4Mb0nF7sE7fKDL8FNLjfdH365eZ1cqqftjHSECq6LcnCMkzB4TCug6bCNgZQ+
 5XgOMhbr2bwpW87YH3/f1q3RiVACyP9gbul3SPqMhs8vak+hw3YNOeAsMTw8Zxxj
 97KRfMw4Uo3rZGEIKsSCDT/nJnNTA+hACAK71GX1OXEEzrSFhJO5E+ChFmBIrSMN
 kZ/QXJRwq6zSgaLHAwt/UEFVKcg9nTFrsaJ6X4woX/YHsZZDtRYU9OTDkX5B/uIx
 HJQWFRdrUHMEij7VrYEiqtIT89LO0N56ZOuN7bDguZVtTXePQ7pi6mYbU4R8rIdd
 fLQaI+0C3M+/XhZvlceeovNSYD233ULHwvoBrj6kmpwKdCWr+5vx98/6B4J1GbeA
 55pSJ9eEFSwBHTao+/LTWsI6a/SEfozSO1hcbcaS9kO2Asnl99w=
 =AQaO
 -----END PGP SIGNATURE-----

MIPS: memset.S: Fix clobber of v1 in last_fixup

The label .Llast_fixup\@ is jumped to on page fault within the final
byte set loop of memset (on < MIPSR6 architectures). For some reason, in
this fault handler, the v1 register is randomly set to a2 & STORMASK.
This clobbers v1 for the calling function. This can be observed with the
following test code:

static int __init __attribute__((optimize("O0"))) test_clear_user(void)
{
  register int t asm("v1");
  char *test;
  int j, k;

  pr_info("\n\n\nTesting clear_user\n");
  test = vmalloc(PAGE_SIZE);

  for (j = 256; j < 512; j++) {
    t = 0xa5a5a5a5;
    if ((k = clear_user(test + PAGE_SIZE - 256, j)) != j - 256) {
        pr_err("clear_user (%px %d) returned %d\n", test + PAGE_SIZE - 256, j, k);
    }
    if (t != 0xa5a5a5a5) {
       pr_err("v1 was clobbered to 0x%x!\n", t);
    }
  }

  return 0;
}
late_initcall(test_clear_user);

Which demonstrates that v1 is indeed clobbered (MIPS64):

Testing clear_user
v1 was clobbered to 0x1!
v1 was clobbered to 0x2!
v1 was clobbered to 0x3!
v1 was clobbered to 0x4!
v1 was clobbered to 0x5!
v1 was clobbered to 0x6!
v1 was clobbered to 0x7!

Since the number of bytes that could not be set is already contained in
a2, the andi placing a value in v1 is not necessary and actively
harmful in clobbering v1.

Reported-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Matt Redfearn <matt.redfearn@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/19109/
Signed-off-by: James Hogan <jhogan@kernel.org>