Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf681c2e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 

Pull s390 fixes from Martin Schwidefsky:
 "Three more bug fixes for 4.6

   - Due to a race in the dynamic page table code a multi-threaded
     program can cause a translation specification exception.  With
     panic_on_oops a user space program can crash the system.

   - An information leak with the /dev/sclp device.

   - A use after free in the s390 PCI code"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/sclp_ctl: fix potential information leak with /dev/sclp
  s390/mm: fix asce_bits handling with dynamic pagetable levels
  s390/pci: fix use after free in dma_init
parents b75a2bf8 532c34b5

arch/s390/include/asm/mmu.h

+1 −1
Original line number Diff line number Diff line
@@ -11,7 +11,7 @@ typedef struct { 
	spinlock_t list_lock;

	struct list_head pgtable_list;

	struct list_head gmap_list;

	unsigned long asce_bits;

	unsigned long asce;

	unsigned long asce_limit;

	unsigned long vdso_base;

	/* The mmu context allocates 4K page tables. */

arch/s390/include/asm/mmu_context.h

+22 −6
Original line number Diff line number Diff line
@@ -26,12 +26,28 @@ static inline int init_new_context(struct task_struct *tsk, 
	mm->context.has_pgste = 0;

	mm->context.use_skey = 0;

#endif

	if (mm->context.asce_limit == 0) {

	switch (mm->context.asce_limit) {

	case 1UL << 42:

		/*

		 * forked 3-level task, fall through to set new asce with new

		 * mm->pgd

		 */

	case 0:

		/* context created by exec, set asce limit to 4TB */

		mm->context.asce_bits = _ASCE_TABLE_LENGTH |

			_ASCE_USER_BITS | _ASCE_TYPE_REGION3;

		mm->context.asce_limit = STACK_TOP_MAX;

	} else if (mm->context.asce_limit == (1UL << 31)) {

		mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |

				   _ASCE_USER_BITS | _ASCE_TYPE_REGION3;

		break;

	case 1UL << 53:

		/* forked 4-level task, set new asce with new mm->pgd */

		mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |

				   _ASCE_USER_BITS | _ASCE_TYPE_REGION2;

		break;

	case 1UL << 31:

		/* forked 2-level compat task, set new asce with new mm->pgd */

		mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |

				   _ASCE_USER_BITS | _ASCE_TYPE_SEGMENT;

		/* pgd_alloc() did not increase mm->nr_pmds */

		mm_inc_nr_pmds(mm);

	}

	crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm));
@@ -42,7 +58,7 @@ static inline int init_new_context(struct task_struct *tsk, 


static inline void set_user_asce(struct mm_struct *mm)

{

	S390_lowcore.user_asce = mm->context.asce_bits | __pa(mm->pgd);

	S390_lowcore.user_asce = mm->context.asce;

	if (current->thread.mm_segment.ar4)

		__ctl_load(S390_lowcore.user_asce, 7, 7);

	set_cpu_flag(CIF_ASCE);
@@ -71,7 +87,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next, 
{

	int cpu = smp_processor_id();



	S390_lowcore.user_asce = next->context.asce_bits | __pa(next->pgd);

	S390_lowcore.user_asce = next->context.asce;

	if (prev == next)

		return;

	if (MACHINE_HAS_TLB_LC)

arch/s390/include/asm/pgalloc.h

+2 −2
Original line number Diff line number Diff line
@@ -52,8 +52,8 @@ static inline unsigned long pgd_entry_type(struct mm_struct *mm) 
	return _REGION2_ENTRY_EMPTY;

}



int crst_table_upgrade(struct mm_struct *, unsigned long limit);

void crst_table_downgrade(struct mm_struct *, unsigned long limit);

int crst_table_upgrade(struct mm_struct *);

void crst_table_downgrade(struct mm_struct *);



static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address)

{

arch/s390/include/asm/processor.h

+1 −1
Original line number Diff line number Diff line
@@ -175,7 +175,7 @@ extern __vector128 init_task_fpu_regs[__NUM_VXRS]; 
	regs->psw.mask	= PSW_USER_BITS | PSW_MASK_BA;			\

	regs->psw.addr	= new_psw;					\

	regs->gprs[15]	= new_stackp;					\

	crst_table_downgrade(current->mm, 1UL << 31);			\

	crst_table_downgrade(current->mm);				\

	execve_tail();							\

} while (0)

arch/s390/include/asm/tlbflush.h

+3 −6
Original line number Diff line number Diff line
@@ -110,8 +110,7 @@ static inline void __tlb_flush_asce(struct mm_struct *mm, unsigned long asce) 
static inline void __tlb_flush_kernel(void)

{

	if (MACHINE_HAS_IDTE)

		__tlb_flush_idte((unsigned long) init_mm.pgd |

				 init_mm.context.asce_bits);

		__tlb_flush_idte(init_mm.context.asce);

	else

		__tlb_flush_global();

}
@@ -133,8 +132,7 @@ static inline void __tlb_flush_asce(struct mm_struct *mm, unsigned long asce) 
static inline void __tlb_flush_kernel(void)

{

	if (MACHINE_HAS_TLB_LC)

		__tlb_flush_idte_local((unsigned long) init_mm.pgd |

				       init_mm.context.asce_bits);

		__tlb_flush_idte_local(init_mm.context.asce);

	else

		__tlb_flush_local();

}
@@ -148,8 +146,7 @@ static inline void __tlb_flush_mm(struct mm_struct * mm) 
	 * only ran on the local cpu.

	 */

	if (MACHINE_HAS_IDTE && list_empty(&mm->context.gmap_list))

		__tlb_flush_asce(mm, (unsigned long) mm->pgd |

				 mm->context.asce_bits);

		__tlb_flush_asce(mm, mm->context.asce);

	else

		__tlb_flush_full(mm);

}