important ppc64 bug fixes

[Anton Blanchard]

> - Limit stack growth				(Anil/Anton)

I cleaned up Anil's patch a bit. Im a little worried by the two
constants (1MB and 2kB), do they still hold?

 foo_work-anton/arch/ppc64/mm/fault.c |   72 ++++++++++++++++++++++++++++++++++
 1 files changed, 72 insertions(+)

diff -puN arch/ppc64/mm/fault.c~stackgrowth arch/ppc64/mm/fault.c
--- foo_work/arch/ppc64/mm/fault.c~stackgrowth	2003-11-10 21:05:47.950740614 -0600
+++ foo_work-anton/arch/ppc64/mm/fault.c	2003-11-11 00:38:52.905989057 -0600
@@ -46,6 +46,46 @@ int debugger_kernel_faults = 1;
 void bad_page_fault(struct pt_regs *, unsigned long, int);

 /*
+ * Check whether the instruction at regs->nip is a store using an
+ * update addressing form which will update sp
+ */
+static int store_updates_sp(struct pt_regs *regs)
+{
+	unsigned int inst;
+
+	if (get_user(inst, (unsigned int *)regs->nip))
+		return 0;
+
+	/* check for 1 in the rA field */
+	if (((inst >> 16) & 0x1f) != 1)
+		return 0;
+
+	/* check major opcode */
+	switch (inst >> 26) {
+	case 37:	/* stwu */
+	case 39:	/* stbu */
+	case 45:	/* sthu */
+	case 53:	/* stfsu */
+	case 55:	/* stfdu */
+	case 62:	/* stdu */
+		return 1;
+	case 31:
+		/* check minor opcode */
+		switch((inst >> 1) & 0x3ff) {
+		case 181:	/* stwux */
+		case 183:	/* stbux */
+		case 247:	/* stdux */
+		case 439:	/* sthux */
+		case 695:	/* stfsux */
+		case 759:	/* stfdux */
+			return 1;
+		}
+	}
+
+	return 0;
+}
+
+/*
  * The error_code parameter is
  *  - DSISR for a non-SLB data access fault,
  *  - SRR1 & 0x08000000 for a non-SLB instruction access fault
@@ -96,6 +136,38 @@ void do_page_fault(struct pt_regs *regs,
 	}
 	if (!(vma->vm_flags & VM_GROWSDOWN))
 		goto bad_area;
+
+	/*
+	 * N.B. The ppc64 ABI allows programs to access up to 288
+	 * bytes below the stack pointer.
+	 * The kernel signal delivery code writes up to about 1.5kB
+	 * below the stack pointer (r1) before decrementing it.
+	 * The exec code can write slightly over 640kB to the stack
+	 * before setting the user r1.  Thus we allow the stack to
+	 * expand to 1MB without further checks.
+	 */
+	if (address + 0x100000 < vma->vm_end) {
+		/* get user regs even if this fault is in kernel mode */
+		struct pt_regs *uregs = current->thread.regs;
+		if (uregs == NULL)
+			goto bad_area;
+
+		/*
+		 * A user-mode access to an address a long way below
+		 * the stack pointer is only valid if the instruction
+		 * is one which would update the stack pointer to the
+		 * address accessed if the instruction completed,
+		 * i.e. either stwu rs,n(r1) or stwux rs,r1,rb
+		 * (or the byte, halfword, float or double forms).
+		 *
+		 * If we don't check this then any write to the area
+		 * between the last mapped region and the stack will
+		 * expand the stack rather than segfaulting.
+		 */
+		if (address + 2048 < uregs->gpr[1]
+		    && (!user_mode(regs) || !store_updates_sp(regs)))
+			goto bad_area;
+	}
 	if (expand_stack(vma, address))
 		goto bad_area;


_

** Sent via the linuxppc64-dev mail list. See http://lists.linuxppc.org/