x86, tls: Off by one limit check
[linux-2.6.git] / arch / x86 / kernel / tls.c
1 #include <linux/kernel.h>
2 #include <linux/errno.h>
3 #include <linux/sched.h>
4 #include <linux/user.h>
5 #include <linux/regset.h>
6
7 #include <asm/uaccess.h>
8 #include <asm/desc.h>
9 #include <asm/system.h>
10 #include <asm/ldt.h>
11 #include <asm/processor.h>
12 #include <asm/proto.h>
13 #include <asm/syscalls.h>
14
15 #include "tls.h"
16
17 /*
18  * sys_alloc_thread_area: get a yet unused TLS descriptor index.
19  */
20 static int get_free_idx(void)
21 {
22         struct thread_struct *t = &current->thread;
23         int idx;
24
25         for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
26                 if (desc_empty(&t->tls_array[idx]))
27                         return idx + GDT_ENTRY_TLS_MIN;
28         return -ESRCH;
29 }
30
31 static void set_tls_desc(struct task_struct *p, int idx,
32                          const struct user_desc *info, int n)
33 {
34         struct thread_struct *t = &p->thread;
35         struct desc_struct *desc = &t->tls_array[idx - GDT_ENTRY_TLS_MIN];
36         int cpu;
37
38         /*
39          * We must not get preempted while modifying the TLS.
40          */
41         cpu = get_cpu();
42
43         while (n-- > 0) {
44                 if (LDT_empty(info))
45                         desc->a = desc->b = 0;
46                 else
47                         fill_ldt(desc, info);
48                 ++info;
49                 ++desc;
50         }
51
52         if (t == &current->thread)
53                 load_TLS(t, cpu);
54
55         put_cpu();
56 }
57
58 /*
59  * Set a given TLS descriptor:
60  */
61 int do_set_thread_area(struct task_struct *p, int idx,
62                        struct user_desc __user *u_info,
63                        int can_allocate)
64 {
65         struct user_desc info;
66
67         if (copy_from_user(&info, u_info, sizeof(info)))
68                 return -EFAULT;
69
70         if (idx == -1)
71                 idx = info.entry_number;
72
73         /*
74          * index -1 means the kernel should try to find and
75          * allocate an empty descriptor:
76          */
77         if (idx == -1 && can_allocate) {
78                 idx = get_free_idx();
79                 if (idx < 0)
80                         return idx;
81                 if (put_user(idx, &u_info->entry_number))
82                         return -EFAULT;
83         }
84
85         if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
86                 return -EINVAL;
87
88         set_tls_desc(p, idx, &info, 1);
89
90         return 0;
91 }
92
93 asmlinkage int sys_set_thread_area(struct user_desc __user *u_info)
94 {
95         int ret = do_set_thread_area(current, -1, u_info, 1);
96         asmlinkage_protect(1, ret, u_info);
97         return ret;
98 }
99
100
101 /*
102  * Get the current Thread-Local Storage area:
103  */
104
105 static void fill_user_desc(struct user_desc *info, int idx,
106                            const struct desc_struct *desc)
107
108 {
109         memset(info, 0, sizeof(*info));
110         info->entry_number = idx;
111         info->base_addr = get_desc_base(desc);
112         info->limit = get_desc_limit(desc);
113         info->seg_32bit = desc->d;
114         info->contents = desc->type >> 2;
115         info->read_exec_only = !(desc->type & 2);
116         info->limit_in_pages = desc->g;
117         info->seg_not_present = !desc->p;
118         info->useable = desc->avl;
119 #ifdef CONFIG_X86_64
120         info->lm = desc->l;
121 #endif
122 }
123
124 int do_get_thread_area(struct task_struct *p, int idx,
125                        struct user_desc __user *u_info)
126 {
127         struct user_desc info;
128
129         if (idx == -1 && get_user(idx, &u_info->entry_number))
130                 return -EFAULT;
131
132         if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
133                 return -EINVAL;
134
135         fill_user_desc(&info, idx,
136                        &p->thread.tls_array[idx - GDT_ENTRY_TLS_MIN]);
137
138         if (copy_to_user(u_info, &info, sizeof(info)))
139                 return -EFAULT;
140         return 0;
141 }
142
143 asmlinkage int sys_get_thread_area(struct user_desc __user *u_info)
144 {
145         int ret = do_get_thread_area(current, -1, u_info);
146         asmlinkage_protect(1, ret, u_info);
147         return ret;
148 }
149
150 int regset_tls_active(struct task_struct *target,
151                       const struct user_regset *regset)
152 {
153         struct thread_struct *t = &target->thread;
154         int n = GDT_ENTRY_TLS_ENTRIES;
155         while (n > 0 && desc_empty(&t->tls_array[n - 1]))
156                 --n;
157         return n;
158 }
159
160 int regset_tls_get(struct task_struct *target, const struct user_regset *regset,
161                    unsigned int pos, unsigned int count,
162                    void *kbuf, void __user *ubuf)
163 {
164         const struct desc_struct *tls;
165
166         if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
167             (pos % sizeof(struct user_desc)) != 0 ||
168             (count % sizeof(struct user_desc)) != 0)
169                 return -EINVAL;
170
171         pos /= sizeof(struct user_desc);
172         count /= sizeof(struct user_desc);
173
174         tls = &target->thread.tls_array[pos];
175
176         if (kbuf) {
177                 struct user_desc *info = kbuf;
178                 while (count-- > 0)
179                         fill_user_desc(info++, GDT_ENTRY_TLS_MIN + pos++,
180                                        tls++);
181         } else {
182                 struct user_desc __user *u_info = ubuf;
183                 while (count-- > 0) {
184                         struct user_desc info;
185                         fill_user_desc(&info, GDT_ENTRY_TLS_MIN + pos++, tls++);
186                         if (__copy_to_user(u_info++, &info, sizeof(info)))
187                                 return -EFAULT;
188                 }
189         }
190
191         return 0;
192 }
193
194 int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
195                    unsigned int pos, unsigned int count,
196                    const void *kbuf, const void __user *ubuf)
197 {
198         struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
199         const struct user_desc *info;
200
201         if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
202             (pos % sizeof(struct user_desc)) != 0 ||
203             (count % sizeof(struct user_desc)) != 0)
204                 return -EINVAL;
205
206         if (kbuf)
207                 info = kbuf;
208         else if (__copy_from_user(infobuf, ubuf, count))
209                 return -EFAULT;
210         else
211                 info = infobuf;
212
213         set_tls_desc(target,
214                      GDT_ENTRY_TLS_MIN + (pos / sizeof(struct user_desc)),
215                      info, count / sizeof(struct user_desc));
216
217         return 0;
218 }