| From | Kamal Mostafa <> | Subject | [PATCH 3.19.y-ckt 133/196] s390/compat: correct restore of high gprs on signal return | Date | Tue, 8 Mar 2016 16:29:51 -0800 |
| |
3.19.8-ckt16 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
commit 342300cc9cd3428bc6bfe5809bfcc1b9a0f06702 upstream.
git commit 8070361799ae1e3f4ef347bd10f0a508ac10acfb "s390: add support for vector extension" broke 31-bit compat processes in regard to signal handling.
The restore_sigregs_ext32() function is used to restore the additional elements from the user space signal frame. Among the additional elements are the upper registers halves for 64-bit register support for 31-bit processes. The copy_from_user that is used to retrieve the high-gprs array from the user stack uses an incorrect length, 8 bytes instead of 64 bytes. This causes incorrect upper register halves to get loaded.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- arch/s390/kernel/compat_signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c index f564740..020e872 100644 --- a/arch/s390/kernel/compat_signal.c +++ b/arch/s390/kernel/compat_signal.c @@ -293,7 +293,7 @@ static int restore_sigregs_ext32(struct pt_regs *regs, /* Restore high gprs from signal stack */ if (__copy_from_user(&gprs_high, &sregs_ext->gprs_high, - sizeof(&sregs_ext->gprs_high))) + sizeof(sregs_ext->gprs_high))) return -EFAULT; for (i = 0; i < NUM_GPRS; i++) *(__u32 *)®s->gprs[i] = gprs_high[i]; -- 2.7.0
|