lkml.org 
[lkml]   [2007]   [Jul]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 18/26] POWERPC: Fix subtle FP state corruption bug in signal return on SMP
    -stable review patch.  If anyone has any objections, please let us know.

    ------------------

    This fixes a bug which can cause corruption of the floating-point state
    on return from a signal handler. If we have a signal handler that has
    used the floating-point registers, and it happens to context-switch to
    another task while copying the interrupted floating-point state from the
    user stack into the thread struct (e.g. because of a page fault, or
    because it gets preempted), the context switch code will think that the
    FP registers contain valid FP state that needs to be copied into the
    thread_struct, and will thus overwrite the values that the signal return
    code has put into the thread_struct.

    This can occur because we clear the MSR bits that indicate the presence
    of valid FP state after copying the state into the thread_struct. To fix
    this we just move the clearing of the MSR bits to before the copy. A
    similar potential problem also occurs with the Altivec state, and this
    fixes that in the same way.

    Signed-off-by: Paul Mackerras <paulus@samba.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ---
    arch/powerpc/kernel/signal_64.c | 10 +++++++---
    1 file changed, 7 insertions(+), 3 deletions(-)

    --- linux-2.6.21.6.orig/arch/powerpc/kernel/signal_64.c
    +++ linux-2.6.21.6/arch/powerpc/kernel/signal_64.c
    @@ -177,6 +177,13 @@ static long restore_sigcontext(struct pt
    */
    discard_lazy_cpu_state();

    + /*
    + * Force reload of FP/VEC.
    + * This has to be done before copying stuff into current->thread.fpr/vr
    + * for the reasons explained in the previous comment.
    + */
    + regs->msr &= ~(MSR_FP | MSR_FE0 | MSR_FE1 | MSR_VEC);
    +
    err |= __copy_from_user(&current->thread.fpr, &sc->fp_regs, FP_REGS_SIZE);

    #ifdef CONFIG_ALTIVEC
    @@ -198,9 +205,6 @@ static long restore_sigcontext(struct pt
    current->thread.vrsave = 0;
    #endif /* CONFIG_ALTIVEC */

    - /* Force reload of FP/VEC */
    - regs->msr &= ~(MSR_FP | MSR_FE0 | MSR_FE1 | MSR_VEC);
    -
    return err;
    }

    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-07-31 06:41    [W:4.639 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site