[IA64] Fix race condition in the rt_sigprocmask fastcall

current->blocked will be set to the value of current->thread_info->flags if the
cmpxchg to update thread_info->flags fails. For performance reasons the store into
current->blocked was placed in the cmpxchg loop. However, the cmpxchg overwrites the
register holding the value to be stored. In the rare case of a retry the value of
thread_info->flags will be written into current->blocked.

The fix is to use another register so that the register containing the current->blocked
value is not overwritten.

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/arch/ia64/kernel/fsys.S b/arch/ia64/kernel/fsys.S
index 4f3cdef75797..962b6c4e32b5 100644
--- a/arch/ia64/kernel/fsys.S
+++ b/arch/ia64/kernel/fsys.S
@@ -460,9 +460,9 @@ EX(.fail_efault, ld8 r14=[r33])			// r14 <- *set
         ;;
 
         st8 [r2]=r14                            // update current->blocked with new mask
-        cmpxchg4.acq r14=[r9],r18,ar.ccv        // current->thread_info->flags <- r18
+        cmpxchg4.acq r8=[r9],r18,ar.ccv         // current->thread_info->flags <- r18
         ;;
-        cmp.ne p6,p0=r17,r14                    // update failed?
+        cmp.ne p6,p0=r17,r8                     // update failed?
 (p6)    br.cond.spnt.few 1b                     // yes -> retry
 
 #ifdef CONFIG_SMP