• Will Deacon's avatar
    arm64: swp emulation: bound LL/SC retries before rescheduling · 1c5b51df
    Will Deacon authored
    If a CPU does not implement a global monitor for certain memory types,
    then userspace can attempt a kernel DoS by issuing SWP instructions
    targetting the problematic memory (for example, a framebuffer mapped
    with non-cacheable attributes).
    
    The SWP emulation code protects against these sorts of attacks by
    checking for pending signals and potentially rescheduling when the STXR
    instruction fails during the emulation. Whilst this is good for avoiding
    livelock, it harms emulation of legitimate SWP instructions on CPUs
    where forward progress is not guaranteed if there are memory accesses to
    the same reservation granule (up to 2k) between the failing STXR and
    the retry of the LDXR.
    
    This patch solves the problem by retrying the STXR a bounded number of
    times (4) before breaking out of the LL/SC loop and looking for
    something else to do.
    
    Cc: <stable@vger.kernel.org>
    Fixes: bd35a4ad ("arm64: Port SWP/SWPB emulation support from arm")
    Reviewed-by: default avatarMark Rutland <mark.rutland@arm.com>
    Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
    1c5b51df
armv8_deprecated.c 15.4 KB