1 files changed, 12 insertions, 1 deletions

diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index c83c115858c1..b2c002993d78 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -452,9 +452,20 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
         if (MSR_TM_RESV(msr))
                 return -EINVAL;
 
-        /* pull in MSR TM from user context */
+        /* pull in MSR TS bits from user context */
         regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
 
+        /*
+         * Ensure that TM is enabled in regs->msr before we leave the signal
+         * handler. It could be the case that (a) user disabled the TM bit
+         * through the manipulation of the MSR bits in uc_mcontext or (b) the
+         * TM bit was disabled because a sufficient number of context switches
+         * happened whilst in the signal handler and load_tm overflowed,
+         * disabling the TM bit. In either case we can end up with an illegal
+         * TM state leading to a TM Bad Thing when we return to userspace.
+         */
+        regs->msr |= MSR_TM;
+
         /* pull in MSR LE from user context */
         regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);