[S390] Add EX_TABLE for addressing exception in usercopy functions.

This patch adds an EX_TABLE entry to mvc{p|s|os} usercopy functions that
may be called with KERNEL_DS. In combination with collaborative memory
management, kernel pages marked as unused may trigger an adressing exception
in the usercopy functions. This fixes an unhandled addressing exception bug
where strncpy_from_user() is used with len > strnlen and KERNEL_DS, crossing
a page boundary to an unused page.

Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

2 files changed, 14 insertions, 12 deletions

diff --git a/arch/s390/lib/uaccess_mvcos.c b/arch/s390/lib/uaccess_mvcos.c
index 3f15aaf54855..58da3f461214 100644
--- a/arch/s390/lib/uaccess_mvcos.c
+++ b/arch/s390/lib/uaccess_mvcos.c
@@ -36,7 +36,7 @@ static size_t copy_from_user_mvcos(size_t size, const void __user *ptr, void *x)
         tmp1 = -4096UL;
         asm volatile(
                 "0: .insn ss,0xc80000000000,0(%0,%2),0(%1),0\n"
-                "   jz    7f\n"
+                "9: jz    7f\n"
                 "1:"ALR"  %0,%3\n"
                 "  "SLR"  %1,%3\n"
                 "  "SLR"  %2,%3\n"
@@ -47,7 +47,7 @@ static size_t copy_from_user_mvcos(size_t size, const void __user *ptr, void *x)
                 "  "CLR"  %0,%4\n"      /* copy crosses next page boundary? */
                 "   jnh   4f\n"
                 "3: .insn ss,0xc80000000000,0(%4,%2),0(%1),0\n"
-                "  "SLR"  %0,%4\n"
+                "10:"SLR"  %0,%4\n"
                 "  "ALR"  %2,%4\n"
                 "4:"LHI"  %4,-1\n"
                 "  "ALR"  %4,%0\n"      /* copy remaining size, subtract 1 */
@@ -61,7 +61,7 @@ static size_t copy_from_user_mvcos(size_t size, const void __user *ptr, void *x)
                 "   j     8f\n"
                 "7:"SLR"  %0,%0\n"
                 "8: \n"
-                EX_TABLE(0b,2b) EX_TABLE(3b,4b)
+                EX_TABLE(0b,2b) EX_TABLE(3b,4b) EX_TABLE(9b,2b) EX_TABLE(10b,4b)
                 : "+a" (size), "+a" (ptr), "+a" (x), "+a" (tmp1), "=a" (tmp2)
                 : "d" (reg0) : "cc", "memory");
         return size;
@@ -82,7 +82,7 @@ static size_t copy_to_user_mvcos(size_t size, void __user *ptr, const void *x)
         tmp1 = -4096UL;
         asm volatile(
                 "0: .insn ss,0xc80000000000,0(%0,%1),0(%2),0\n"
-                "   jz    4f\n"
+                "6: jz    4f\n"
                 "1:"ALR"  %0,%3\n"
                 "  "SLR"  %1,%3\n"
                 "  "SLR"  %2,%3\n"
@@ -93,11 +93,11 @@ static size_t copy_to_user_mvcos(size_t size, void __user *ptr, const void *x)
                 "  "CLR"  %0,%4\n"      /* copy crosses next page boundary? */
                 "   jnh   5f\n"
                 "3: .insn ss,0xc80000000000,0(%4,%1),0(%2),0\n"
-                "  "SLR"  %0,%4\n"
+                "7:"SLR"  %0,%4\n"
                 "   j     5f\n"
                 "4:"SLR"  %0,%0\n"
                 "5: \n"
-                EX_TABLE(0b,2b) EX_TABLE(3b,5b)
+                EX_TABLE(0b,2b) EX_TABLE(3b,5b) EX_TABLE(6b,2b) EX_TABLE(7b,5b)
                 : "+a" (size), "+a" (ptr), "+a" (x), "+a" (tmp1), "=a" (tmp2)
                 : "d" (reg0) : "cc", "memory");
         return size;
diff --git a/arch/s390/lib/uaccess_std.c b/arch/s390/lib/uaccess_std.c
index d2ffbadb51a7..07deaeee14c8 100644
--- a/arch/s390/lib/uaccess_std.c
+++ b/arch/s390/lib/uaccess_std.c
@@ -36,12 +36,12 @@ size_t copy_from_user_std(size_t size, const void __user *ptr, void *x)
         tmp1 = -256UL;
         asm volatile(
                 "0: mvcp  0(%0,%2),0(%1),%3\n"
-                "   jz    8f\n"
+                "10:jz    8f\n"
                 "1:"ALR"  %0,%3\n"
                 "   la    %1,256(%1)\n"
                 "   la    %2,256(%2)\n"
                 "2: mvcp  0(%0,%2),0(%1),%3\n"
-                "   jnz   1b\n"
+                "11:jnz   1b\n"
                 "   j     8f\n"
                 "3: la    %4,255(%1)\n" /* %4 = ptr + 255 */
                 "  "LHI"  %3,-4096\n"
@@ -50,7 +50,7 @@ size_t copy_from_user_std(size_t size, const void __user *ptr, void *x)
                 "  "CLR"  %0,%4\n"      /* copy crosses next page boundary? */
                 "   jnh   5f\n"
                 "4: mvcp  0(%4,%2),0(%1),%3\n"
-                "  "SLR"  %0,%4\n"
+                "12:"SLR"  %0,%4\n"
                 "  "ALR"  %2,%4\n"
                 "5:"LHI"  %4,-1\n"
                 "  "ALR"  %4,%0\n"      /* copy remaining size, subtract 1 */
@@ -65,6 +65,7 @@ size_t copy_from_user_std(size_t size, const void __user *ptr, void *x)
                 "8:"SLR"  %0,%0\n"
                 "9: \n"
                 EX_TABLE(0b,3b) EX_TABLE(2b,3b) EX_TABLE(4b,5b)
+                EX_TABLE(10b,3b) EX_TABLE(11b,3b) EX_TABLE(12b,5b)
                 : "+a" (size), "+a" (ptr), "+a" (x), "+a" (tmp1), "=a" (tmp2)
                 : : "cc", "memory");
         return size;
@@ -85,12 +86,12 @@ size_t copy_to_user_std(size_t size, void __user *ptr, const void *x)
         tmp1 = -256UL;
         asm volatile(
                 "0: mvcs  0(%0,%1),0(%2),%3\n"
-                "   jz    5f\n"
+                "7: jz    5f\n"
                 "1:"ALR"  %0,%3\n"
                 "   la    %1,256(%1)\n"
                 "   la    %2,256(%2)\n"
                 "2: mvcs  0(%0,%1),0(%2),%3\n"
-                "   jnz   1b\n"
+                "8: jnz   1b\n"
                 "   j     5f\n"
                 "3: la    %4,255(%1)\n" /* %4 = ptr + 255 */
                 "  "LHI"  %3,-4096\n"
@@ -99,11 +100,12 @@ size_t copy_to_user_std(size_t size, void __user *ptr, const void *x)
                 "  "CLR"  %0,%4\n"      /* copy crosses next page boundary? */
                 "   jnh   6f\n"
                 "4: mvcs  0(%4,%1),0(%2),%3\n"
-                "  "SLR"  %0,%4\n"
+                "9:"SLR"  %0,%4\n"
                 "   j     6f\n"
                 "5:"SLR"  %0,%0\n"
                 "6: \n"
                 EX_TABLE(0b,3b) EX_TABLE(2b,3b) EX_TABLE(4b,6b)
+                EX_TABLE(7b,3b) EX_TABLE(8b,3b) EX_TABLE(9b,6b)
                 : "+a" (size), "+a" (ptr), "+a" (x), "+a" (tmp1), "=a" (tmp2)
                 : : "cc", "memory");
         return size;