2 files changed, 24 insertions, 0 deletions

diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 1309d64aa926..29d48690f2ac 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -230,9 +230,27 @@ void exit_thread(void)
 {
 }
 
+static void tls_thread_flush(void)
+{
+        asm ("msr tpidr_el0, xzr");
+
+        if (is_compat_task()) {
+                current->thread.tp_value = 0;
+
+                /*
+                 * We need to ensure ordering between the shadow state and the
+                 * hardware state, so that we don't corrupt the hardware state
+                 * with a stale shadow state during context switch.
+                 */
+                barrier();
+                asm ("msr tpidrro_el0, xzr");
+        }
+}
+
 void flush_thread(void)
 {
         fpsimd_flush_thread();
+        tls_thread_flush();
         flush_ptrace_hw_breakpoint(current);
 }
 
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index de2b0226e06d..dc47e53e9e28 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -79,6 +79,12 @@ long compat_arm_syscall(struct pt_regs *regs)
 
         case __ARM_NR_compat_set_tls:
                 current->thread.tp_value = regs->regs[0];
+
+                /*
+                 * Protect against register corruption from context switch.
+                 * See comment in tls_thread_flush.
+                 */
+                barrier();
                 asm ("msr tpidrro_el0, %0" : : "r" (regs->regs[0]));
                 return 0;