aboutsummaryrefslogtreecommitdiffstats
path: root/arch/powerpc
diff options
context:
space:
mode:
authorPaul Mackerras <paulus@samba.org>2007-06-26 00:49:11 -0400
committerPaul Mackerras <paulus@samba.org>2007-06-26 00:49:11 -0400
commitae62fbb5f1f796d87cbdbe6701e13f2b52d5c0a7 (patch)
tree42c190d210c90876dbc799fd58896fbdce9164ce /arch/powerpc
parent74609f4536f2b8fd6a48381bbbe3cd37da20a527 (diff)
[POWERPC] Fix subtle FP state corruption bug in signal return on SMP
This fixes a bug which can cause corruption of the floating-point state on return from a signal handler. If we have a signal handler that has used the floating-point registers, and it happens to context-switch to another task while copying the interrupted floating-point state from the user stack into the thread struct (e.g. because of a page fault, or because it gets preempted), the context switch code will think that the FP registers contain valid FP state that needs to be copied into the thread_struct, and will thus overwrite the values that the signal return code has put into the thread_struct. This can occur because we clear the MSR bits that indicate the presence of valid FP state after copying the state into the thread_struct. To fix this we just move the clearing of the MSR bits to before the copy. A similar potential problem also occurs with the Altivec state, and this fixes that in the same way. Signed-off-by: Paul Mackerras <paulus@samba.org>
Diffstat (limited to 'arch/powerpc')
-rw-r--r--arch/powerpc/kernel/signal_64.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 1ce0ae3f6ffc..b27e26852fdb 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -176,6 +176,13 @@ static long restore_sigcontext(struct pt_regs *regs, sigset_t *set, int sig,
176 */ 176 */
177 discard_lazy_cpu_state(); 177 discard_lazy_cpu_state();
178 178
179 /*
180 * Force reload of FP/VEC.
181 * This has to be done before copying stuff into current->thread.fpr/vr
182 * for the reasons explained in the previous comment.
183 */
184 regs->msr &= ~(MSR_FP | MSR_FE0 | MSR_FE1 | MSR_VEC);
185
179 err |= __copy_from_user(&current->thread.fpr, &sc->fp_regs, FP_REGS_SIZE); 186 err |= __copy_from_user(&current->thread.fpr, &sc->fp_regs, FP_REGS_SIZE);
180 187
181#ifdef CONFIG_ALTIVEC 188#ifdef CONFIG_ALTIVEC
@@ -197,9 +204,6 @@ static long restore_sigcontext(struct pt_regs *regs, sigset_t *set, int sig,
197 current->thread.vrsave = 0; 204 current->thread.vrsave = 0;
198#endif /* CONFIG_ALTIVEC */ 205#endif /* CONFIG_ALTIVEC */
199 206
200 /* Force reload of FP/VEC */
201 regs->msr &= ~(MSR_FP | MSR_FE0 | MSR_FE1 | MSR_VEC);
202
203 return err; 207 return err;
204} 208}
205 209