MIPS: Avoid clobbering struct pt_regs in kthreads

The resume() implementation octeon_switch.S examines the saved cp0_status
register.  We were clobbering the entire pt_regs structure in kernel
threads leading to random crashes.

When switching away from a kernel thread, the saved cp0_status is examined
and if bit 30 is set it is cleared and the CP2 state saved into the pt_regs
structure.  Since the kernel thread stack overlaid the pt_regs structure
this resulted in a corrupt stack.  When the kthread with the corrupt stack
was resumed, it could crash if it used any of the data in the stack that was
clobbered.

We fix it by moving the kernel thread stack down so it doesn't overlay
pt_regs.

Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

1 files changed, 2 insertions, 1 deletions

diff --git a/arch/mips/kernel/head.S b/arch/mips/kernel/head.S
index 492a0a8d70f..531ce7b1612 100644
--- a/arch/mips/kernel/head.S
+++ b/arch/mips/kernel/head.S
@@ -188,7 +188,8 @@ NESTED(kernel_entry, 16, sp)			# kernel entry point
 
         MTC0            zero, CP0_CONTEXT       # clear context register
         PTR_LA          $28, init_thread_union
-        PTR_LI          sp, _THREAD_SIZE - 32
+        /* Set the SP after an empty pt_regs.  */
+        PTR_LI          sp, _THREAD_SIZE - 32 - PT_SIZE
         PTR_ADDU        sp, $28
         set_saved_sp    sp, t0, t1
         PTR_SUBU        sp, 4 * SZREG           # init stack pointer