1 files changed, 43 insertions, 9 deletions

diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 151fd2f0893a..b9a014411f83 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -22,6 +22,7 @@
 #include <linux/compat.h>
 #include <linux/suspend.h>
 #include <linux/compiler.h>
+#include <linux/uaccess.h>
 
 #include <asm/abi.h>
 #include <asm/asm.h>
@@ -29,7 +30,6 @@
 #include <linux/bitops.h>
 #include <asm/cacheflush.h>
 #include <asm/sim.h>
-#include <asm/uaccess.h>
 #include <asm/ucontext.h>
 #include <asm/system.h>
 #include <asm/fpu.h>
@@ -176,6 +176,46 @@ struct rt_sigframe32 {
 /*
  * sigcontext handlers
  */
+static int protected_save_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(1);
+                err = save_fp_context32(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __put_user(0, &sc->sc_fpregs[0]) |
+                        __put_user(0, &sc->sc_fpregs[31]) |
+                        __put_user(0, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
+static int protected_restore_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err, tmp;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(0);
+                err = restore_fp_context32(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __get_user(tmp, &sc->sc_fpregs[0]) |
+                        __get_user(tmp, &sc->sc_fpregs[31]) |
+                        __get_user(tmp, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
 static int setup_sigcontext32(struct pt_regs *regs,
                               struct sigcontext32 __user *sc)
 {
@@ -209,10 +249,7 @@ static int setup_sigcontext32(struct pt_regs *regs,
                  * Save FPU state to signal context.  Signal handler
                  * will "inherit" current FPU state.
                  */
-                own_fpu(1);
-                enable_fp_in_kernel();
-                err |= save_fp_context32(sc);
-                disable_fp_in_kernel();
+                err |= protected_save_fp_context32(sc);
         }
         return err;
 }
@@ -225,7 +262,7 @@ check_and_restore_fp_context32(struct sigcontext32 __user *sc)
         err = sig = fpcsr_pending(&sc->sc_fpc_csr);
         if (err > 0)
                 err = 0;
-        err |= restore_fp_context32(sc);
+        err |= protected_restore_fp_context32(sc);
         return err ?: sig;
 }
 
@@ -261,11 +298,8 @@ static int restore_sigcontext32(struct pt_regs *regs,
 
         if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu(0);
-                enable_fp_in_kernel();
                 if (!err)
                         err = check_and_restore_fp_context32(sc);
-                disable_fp_in_kernel();
         } else {
                 /* signal handler may have used FPU.  Give it up. */
                 lose_fpu(0);