]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
powerpc/64s: Fix copy-paste data exposure into newly created tasks
authorNicholas Piggin <npiggin@gmail.com>
Tue, 22 Jun 2021 05:30:36 +0000 (15:30 +1000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 14 Jul 2021 15:00:26 +0000 (17:00 +0200)
commit9b399bf0c44e53abc4af40e4b1ced1c98c940773
tree8168ee7adf8192966987bbdaf84f2f23aadf6da4
parentc4843f6d07ef1afb545a7033408c3289f44d23ad
powerpc/64s: Fix copy-paste data exposure into newly created tasks

[ Upstream commit f35d2f249ef05b9671e7898f09ad89aa78f99122 ]

copy-paste contains implicit "copy buffer" state that can contain
arbitrary user data (if the user process executes a copy instruction).
This could be snooped by another process if a context switch hits while
the state is live. So cp_abort is executed on context switch to clear
out possible sensitive data and prevent the leak.

cp_abort is done after the low level _switch(), which means it is never
reached by newly created tasks, so they could snoop on this buffer
between their first and second context switch.

Fix this by doing the cp_abort before calling _switch. Add some
comments which should make the issue harder to miss.

Fixes: 07d2a628bc000 ("powerpc/64s: Avoid cpabort in context switch when possible")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210622053036.474678-1-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
arch/powerpc/kernel/process.c