• Nicolas Pitre's avatar
    ARM: 6401/1: plug a race in the alignment trap handler · 2f27bf83
    Nicolas Pitre authored
    When the policy for user space is to ignore misaligned accesses from user
    space, the processor then performs a documented rotation on the accessed
    data.  This is the result of the access being trapped, and the kernel
    disabling the alignment trap before returning to user space again.
    
    In kernel space we always want misaligned accesses to be fixed up.  This
    is enforced by always re-enabling the alignment trap on every entry into
    kernel space from user space.  No such re-enabling is performed when an
    exception occurs while already in kernel space as the alignment trap is
    always supposed to be enabled in that case.
    
    There is however a small race window when a misaligned access in user
    space is trapped and the alignment trap disabled, but the CPU didn't
    return to user space just yet.  Any exception would be entered from kernel
    space at that point and the kernel would then execute with the alignment
    trap disabled.
    
    Thanks to Maxime Bizon <mbizon@freebox.fr> for providing a test module
    that made this issue reproducible.
    Signed-off-by: default avatarNicolas Pitre <nicolas.pitre@linaro.org>
    Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
    2f27bf83
alignment.c 24.7 KB