ARM: BUG if jumping to usermode address in kernel mode

commit 8bafae202c82dc257f649ea3c275a0f35ee15113 upstream.

Detect if we are returning to usermode via the normal kernel exit paths
but the saved PSR value indicates that we are in kernel mode.  This
could occur due to corrupted stack state, which has been observed with
"ftracetest".

This ensures that we catch the problem case before we get to user code.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Cc: Alex Shi <alex.shi@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index b2bc8e11471d3ee3e4fcd5f207406222ffa04bf1..2c16d9e7c03caedb4f1f01f807e06c8afb9a16ac 100644 (file)
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -512,4 +512,22 @@ THUMB(     orr     \reg , \reg , #PSR_T_BIT        )
 #endif
        .endm
 
+       .macro  bug, msg, line
+#ifdef CONFIG_THUMB2_KERNEL
+1:     .inst   0xde02
+#else
+1:     .inst   0xe7f001f2
+#endif
+#ifdef CONFIG_DEBUG_BUGVERBOSE
+       .pushsection .rodata.str, "aMS", %progbits, 1
+2:     .asciz  "\msg"
+       .popsection
+       .pushsection __bug_table, "aw"
+       .align  2
+       .word   1b, 2b
+       .hword  \line
+       .popsection
+#endif
+       .endm
+
 #endif /* __ASM_ASSEMBLER_H__ */

diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
index 0d22ad206d5230ba05a40b4101bb1dd2e4addd10..3fd24e22036b471bbef77495ea41d9628f6353d6 100644 (file)
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -295,6 +295,8 @@
        mov     r2, sp
        ldr     r1, [r2, #\offset + S_PSR]      @ get calling cpsr
        ldr     lr, [r2, #\offset + S_PC]!      @ get pc
+       tst     r1, #0xcf
+       bne     1f
        msr     spsr_cxsf, r1                   @ save in spsr_svc
 #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
        @ We must avoid clrex due to Cortex-A15 erratum #830321
@@ -309,6 +311,7 @@
                                                @ after ldm {}^
        add     sp, sp, #\offset + S_FRAME_SIZE
        movs    pc, lr                          @ return & move spsr_svc into cpsr
+1:     bug     "Returning to usermode but unexpected PSR bits set?", \@
 #elif defined(CONFIG_CPU_V7M)
        @ V7M restore.
        @ Note that we don't need to do clrex here as clearing the local
@@ -324,6 +327,8 @@
        ldr     r1, [sp, #\offset + S_PSR]      @ get calling cpsr
        ldr     lr, [sp, #\offset + S_PC]       @ get pc
        add     sp, sp, #\offset + S_SP
+       tst     r1, #0xcf
+       bne     1f
        msr     spsr_cxsf, r1                   @ save in spsr_svc
 
        @ We must avoid clrex due to Cortex-A15 erratum #830321
@@ -336,6 +341,7 @@
        .endif
        add     sp, sp, #S_FRAME_SIZE - S_SP
        movs    pc, lr                          @ return & move spsr_svc into cpsr
+1:     bug     "Returning to usermode but unexpected PSR bits set?", \@
 #endif /* !CONFIG_THUMB2_KERNEL */
        .endm