s390/vdso: fix stack corruption

The kernel provided vdso functions do not get a stack frame from the
calling function and therefore may not change the stack contents, unless
they allocate space on their own.

This problem was exposed with 070b7be633dc "s390/vdso: replace stck with
stcke" which writes 16 bytes instead of 8 bytes into the stack frame. These
additional 8 bytes however were indeed used by the caller (glibc) to save
data and therefore this data was corrupted by the vdso code.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

diff --git a/arch/s390/kernel/vdso32/clock_gettime.S b/arch/s390/kernel/vdso32/clock_gettime.S
index 48c2206..5eec9af 100644 (file)
--- a/arch/s390/kernel/vdso32/clock_gettime.S
+++ b/arch/s390/kernel/vdso32/clock_gettime.S
@@ -19,6 +19,7 @@
        .type  __kernel_clock_gettime,@function
 __kernel_clock_gettime:
        .cfi_startproc
+       ahi     %r15,-16
        basr    %r5,0
 0:     al      %r5,21f-0b(%r5)                 /* get &_vdso_data */
        chi     %r2,__CLOCK_REALTIME_COARSE
@@ -34,8 +35,8 @@ __kernel_clock_gettime:
 1:     l       %r4,__VDSO_UPD_COUNT+4(%r5)     /* load update counter */
        tml     %r4,0x0001                      /* pending update ? loop */
        jnz     1b
-       stcke   24(%r15)                        /* Store TOD clock */
-       lm      %r0,%r1,25(%r15)
+       stcke   0(%r15)                         /* Store TOD clock */
+       lm      %r0,%r1,1(%r15)
        s       %r0,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
        sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
        brc     3,2f
@@ -70,6 +71,7 @@ __kernel_clock_gettime:
 8:     st      %r2,0(%r3)                      /* store tp->tv_sec */
        st      %r1,4(%r3)                      /* store tp->tv_nsec */
        lhi     %r2,0
+       ahi     %r15,16
        br      %r14
 
        /* CLOCK_MONOTONIC_COARSE */
@@ -96,8 +98,8 @@ __kernel_clock_gettime:
 11:    l       %r4,__VDSO_UPD_COUNT+4(%r5)     /* load update counter */
        tml     %r4,0x0001                      /* pending update ? loop */
        jnz     11b
-       stcke   24(%r15)                        /* Store TOD clock */
-       lm      %r0,%r1,25(%r15)
+       stcke   0(%r15)                         /* Store TOD clock */
+       lm      %r0,%r1,1(%r15)
        s       %r0,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
        sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
        brc     3,12f
@@ -132,11 +134,13 @@ __kernel_clock_gettime:
 17:    st      %r2,0(%r3)                      /* store tp->tv_sec */
        st      %r1,4(%r3)                      /* store tp->tv_nsec */
        lhi     %r2,0
+       ahi     %r15,16
        br      %r14
 
        /* Fallback to system call */
 19:    lhi     %r1,__NR_clock_gettime
        svc     0
+       ahi     %r15,16
        br      %r14
 
 20:    .long   1000000000

diff --git a/arch/s390/kernel/vdso32/gettimeofday.S b/arch/s390/kernel/vdso32/gettimeofday.S
index 60def5f..719de61 100644 (file)
--- a/arch/s390/kernel/vdso32/gettimeofday.S
+++ b/arch/s390/kernel/vdso32/gettimeofday.S
@@ -19,6 +19,7 @@
        .type  __kernel_gettimeofday,@function
 __kernel_gettimeofday:
        .cfi_startproc
+       ahi     %r15,-16
        basr    %r5,0
 0:     al      %r5,13f-0b(%r5)                 /* get &_vdso_data */
 1:     ltr     %r3,%r3                         /* check if tz is NULL */
@@ -29,30 +30,30 @@ __kernel_gettimeofday:
        l       %r4,__VDSO_UPD_COUNT+4(%r5)     /* load update counter */
        tml     %r4,0x0001                      /* pending update ? loop */
        jnz     1b
-       stcke   24(%r15)                        /* Store TOD clock */
-       lm      %r0,%r1,25(%r15)
+       stcke   0(%r15)                         /* Store TOD clock */
+       lm      %r0,%r1,1(%r15)
        s       %r0,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
        sl      %r1,__VDSO_XTIME_STAMP+4(%r5)
        brc     3,3f
        ahi     %r0,-1
 3:     ms      %r0,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
-       st      %r0,24(%r15)
+       st      %r0,0(%r15)
        l       %r0,__VDSO_TK_MULT(%r5)
        ltr     %r1,%r1
        mr      %r0,%r0
        jnm     4f
        a       %r0,__VDSO_TK_MULT(%r5)
-4:     al      %r0,24(%r15)
+4:     al      %r0,0(%r15)
        al      %r0,__VDSO_XTIME_NSEC(%r5)      /*  + xtime */
        al      %r1,__VDSO_XTIME_NSEC+4(%r5)
        brc     12,5f
        ahi     %r0,1
-5:     mvc     24(4,%r15),__VDSO_XTIME_SEC+4(%r5)
+5:     mvc     0(4,%r15),__VDSO_XTIME_SEC+4(%r5)
        cl      %r4,__VDSO_UPD_COUNT+4(%r5)     /* check update counter */
        jne     1b
        l       %r4,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
        srdl    %r0,0(%r4)                      /*  >> tk->shift */
-       l       %r4,24(%r15)                    /* get tv_sec from stack */
+       l       %r4,0(%r15)                     /* get tv_sec from stack */
        basr    %r5,0
 6:     ltr     %r0,%r0
        jnz     7f
@@ -71,6 +72,7 @@ __kernel_gettimeofday:
 9:     srl     %r0,6
        st      %r0,4(%r2)                      /* store tv->tv_usec */
 10:    slr     %r2,%r2
+       ahi     %r15,16
        br      %r14
 11:    .long   1000000000
 12:    .long   274877907

diff --git a/arch/s390/kernel/vdso64/clock_gettime.S b/arch/s390/kernel/vdso64/clock_gettime.S
index 9d9761f..7699e73 100644 (file)
--- a/arch/s390/kernel/vdso64/clock_gettime.S
+++ b/arch/s390/kernel/vdso64/clock_gettime.S
@@ -19,6 +19,7 @@
        .type  __kernel_clock_gettime,@function
 __kernel_clock_gettime:
        .cfi_startproc
+       aghi    %r15,-16
        larl    %r5,_vdso_data
        cghi    %r2,__CLOCK_REALTIME_COARSE
        je      4f
@@ -37,10 +38,10 @@ __kernel_clock_gettime:
 0:     lg      %r4,__VDSO_UPD_COUNT(%r5)       /* load update counter */
        tmll    %r4,0x0001                      /* pending update ? loop */
        jnz     0b
-       stcke   48(%r15)                        /* Store TOD clock */
+       stcke   0(%r15)                         /* Store TOD clock */
        lgf     %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
        lg      %r0,__VDSO_WTOM_SEC(%r5)
-       lg      %r1,49(%r15)
+       lg      %r1,1(%r15)
        sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
        msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
        alg     %r1,__VDSO_WTOM_NSEC(%r5)
@@ -56,6 +57,7 @@ __kernel_clock_gettime:
 2:     stg     %r0,0(%r3)                      /* store tp->tv_sec */
        stg     %r1,8(%r3)                      /* store tp->tv_nsec */
        lghi    %r2,0
+       aghi    %r15,16
        br      %r14
 
        /* CLOCK_MONOTONIC_COARSE */
@@ -82,9 +84,9 @@ __kernel_clock_gettime:
 5:     lg      %r4,__VDSO_UPD_COUNT(%r5)       /* load update counter */
        tmll    %r4,0x0001                      /* pending update ? loop */
        jnz     5b
-       stcke   48(%r15)                        /* Store TOD clock */
+       stcke   0(%r15)                         /* Store TOD clock */
        lgf     %r2,__VDSO_TK_SHIFT(%r5)        /* Timekeeper shift */
-       lg      %r1,49(%r15)
+       lg      %r1,1(%r15)
        sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
        msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
@@ -101,6 +103,7 @@ __kernel_clock_gettime:
 7:     stg     %r0,0(%r3)                      /* store tp->tv_sec */
        stg     %r1,8(%r3)                      /* store tp->tv_nsec */
        lghi    %r2,0
+       aghi    %r15,16
        br      %r14
 
        /* CLOCK_THREAD_CPUTIME_ID for this thread */
@@ -134,11 +137,13 @@ __kernel_clock_gettime:
        slgr    %r4,%r0                         /* r4 = tv_nsec */
        stg     %r4,8(%r3)
        lghi    %r2,0
+       aghi    %r15,16
        br      %r14
 
        /* Fallback to system call */
 12:    lghi    %r1,__NR_clock_gettime
        svc     0
+       aghi    %r15,16
        br      %r14
 
 13:    .quad   1000000000

diff --git a/arch/s390/kernel/vdso64/gettimeofday.S b/arch/s390/kernel/vdso64/gettimeofday.S
index 7a34499..6ce4670 100644 (file)
--- a/arch/s390/kernel/vdso64/gettimeofday.S
+++ b/arch/s390/kernel/vdso64/gettimeofday.S
@@ -19,6 +19,7 @@
        .type  __kernel_gettimeofday,@function
 __kernel_gettimeofday:
        .cfi_startproc
+       aghi    %r15,-16
        larl    %r5,_vdso_data
 0:     ltgr    %r3,%r3                         /* check if tz is NULL */
        je      1f
@@ -28,8 +29,8 @@ __kernel_gettimeofday:
        lg      %r4,__VDSO_UPD_COUNT(%r5)       /* load update counter */
        tmll    %r4,0x0001                      /* pending update ? loop */
        jnz     0b
-       stcke   48(%r15)                        /* Store TOD clock */
-       lg      %r1,49(%r15)
+       stcke   0(%r15)                         /* Store TOD clock */
+       lg      %r1,1(%r15)
        sg      %r1,__VDSO_XTIME_STAMP(%r5)     /* TOD - cycle_last */
        msgf    %r1,__VDSO_TK_MULT(%r5)         /*  * tk->mult */
        alg     %r1,__VDSO_XTIME_NSEC(%r5)      /*  + tk->xtime_nsec */
@@ -50,6 +51,7 @@ __kernel_gettimeofday:
        srlg    %r0,%r0,6
        stg     %r0,8(%r2)                      /* store tv->tv_usec */
 4:     lghi    %r2,0
+       aghi    %r15,16
        br      %r14
 5:     .quad   1000000000
        .long   274877907