s390: fix save and restore of the floating-point-control register

The FPC_VALID_MASK has been used to check the validity of the value
to be loaded into the floating-point-control register. With the
introduction of the floating-point extension facility and the
decimal-floating-point additional bits have been defined which need
to be checked in a non straight forward way. So far these bits have
been ignored which can cause an incorrect results for decimal-
floating-point operations, e.g. an incorrect rounding mode to be
set after signal return.

The static check with the FPC_VALID_MASK is replaced with a trial
load of the floating-point-control value, see test_fp_ctl.

In addition an information leak with the padding word between the
floating-point-control word and the floating-point registers in
the s390_fp_regs is fixed.

Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

1 files changed, 13 insertions, 8 deletions

diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index 5c0ce019a8ae..4c28c39e3718 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -62,14 +62,15 @@ static int save_sigregs(struct pt_regs *regs, _sigregs __user *sregs)
         user_sregs.regs.psw.addr = regs->psw.addr;
         memcpy(&user_sregs.regs.gprs, &regs->gprs, sizeof(sregs->regs.gprs));
         memcpy(&user_sregs.regs.acrs, current->thread.acrs,
-               sizeof(sregs->regs.acrs));
+               sizeof(user_sregs.regs.acrs));
         /* 
          * We have to store the fp registers to current->thread.fp_regs
          * to merge them with the emulated registers.
          */
-        save_fp_regs(&current->thread.fp_regs);
+        save_fp_ctl(&current->thread.fp_regs.fpc);
+        save_fp_regs(current->thread.fp_regs.fprs);
         memcpy(&user_sregs.fpregs, &current->thread.fp_regs,
-               sizeof(s390_fp_regs));
+               sizeof(user_sregs.fpregs));
         if (__copy_to_user(sregs, &user_sregs, sizeof(_sigregs)))
                 return -EFAULT;
         return 0;
@@ -82,8 +83,13 @@ static int restore_sigregs(struct pt_regs *regs, _sigregs __user *sregs)
         /* Alwys make any pending restarted system call return -EINTR */
         current_thread_info()->restart_block.fn = do_no_restart_syscall;
 
-        if (__copy_from_user(&user_sregs, sregs, sizeof(_sigregs)))
+        if (__copy_from_user(&user_sregs, sregs, sizeof(user_sregs)))
                 return -EFAULT;
+
+        /* Loading the floating-point-control word can fail. Do that first. */
+        if (restore_fp_ctl(&user_sregs.fpregs.fpc))
+                return -EINVAL;
+
         /* Use regs->psw.mask instead of PSW_USER_BITS to preserve PER bit. */
         regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
                 (user_sregs.regs.psw.mask & PSW_MASK_USER);
@@ -97,14 +103,13 @@ static int restore_sigregs(struct pt_regs *regs, _sigregs __user *sregs)
         regs->psw.addr = user_sregs.regs.psw.addr;
         memcpy(&regs->gprs, &user_sregs.regs.gprs, sizeof(sregs->regs.gprs));
         memcpy(&current->thread.acrs, &user_sregs.regs.acrs,
-               sizeof(sregs->regs.acrs));
+               sizeof(current->thread.acrs));
         restore_access_regs(current->thread.acrs);
 
         memcpy(&current->thread.fp_regs, &user_sregs.fpregs,
-               sizeof(s390_fp_regs));
-        current->thread.fp_regs.fpc &= FPC_VALID_MASK;
+               sizeof(current->thread.fp_regs));
 
-        restore_fp_regs(&current->thread.fp_regs);
+        restore_fp_regs(current->thread.fp_regs.fprs);
         clear_thread_flag(TIF_SYSCALL); /* No longer in a system call */
         return 0;
 }