ARM: poison memory between kuser helpers

Poison the memory between each kuser helper.  This ensures that any
branch between the kuser helpers will be appropriately trapped.

Cc: <stable@vger.kernel.org>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

1 files changed, 16 insertions, 9 deletions

diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index a39cfc2a1f90..02437345289a 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -742,6 +742,17 @@ ENDPROC(__switch_to)
 #endif
         .endm
 
+        .macro  kuser_pad, sym, size
+        .if     (. - \sym) & 3
+        .rept   4 - (. - \sym) & 3
+        .byte   0
+        .endr
+        .endif
+        .rept   (\size - (. - \sym)) / 4
+        .word   0xe7fddef1
+        .endr
+        .endm
+
         .align  5
         .globl  __kuser_helper_start
 __kuser_helper_start:
@@ -832,18 +843,13 @@ kuser_cmpxchg64_fixup:
 #error "incoherent kernel configuration"
 #endif
 
-        /* pad to next slot */
-        .rept   (16 - (. - __kuser_cmpxchg64)/4)
-        .word   0
-        .endr
-
-        .align  5
+        kuser_pad __kuser_cmpxchg64, 64
 
 __kuser_memory_barrier:                         @ 0xffff0fa0
         smp_dmb arm
         usr_ret lr
 
-        .align  5
+        kuser_pad __kuser_memory_barrier, 32
 
 __kuser_cmpxchg:                                @ 0xffff0fc0
 
@@ -916,13 +922,14 @@ kuser_cmpxchg32_fixup:
 
 #endif
 
-        .align  5
+        kuser_pad __kuser_cmpxchg, 32
 
 __kuser_get_tls:                                @ 0xffff0fe0
         ldr     r0, [pc, #(16 - 8)]     @ read TLS, set in kuser_get_tls_init
         usr_ret lr
         mrc     p15, 0, r0, c13, c0, 3  @ 0xffff0fe8 hardware TLS code
-        .rep    4
+        kuser_pad __kuser_get_tls, 16
+        .rep    3
         .word   0                       @ 0xffff0ff0 software TLS value, then
         .endr                           @ pad up to __kuser_helper_version