Commit:     ae62fbb5f1f796d87cbdbe6701e13f2b52d5c0a7
Parent:     74609f4536f2b8fd6a48381bbbe3cd37da20a527
Author:     Paul Mackerras <[EMAIL PROTECTED]>
AuthorDate: Tue Jun 26 14:49:11 2007 +1000
Committer:  Paul Mackerras <[EMAIL PROTECTED]>
CommitDate: Tue Jun 26 14:49:11 2007 +1000

    [POWERPC] Fix subtle FP state corruption bug in signal return on SMP
    This fixes a bug which can cause corruption of the floating-point state
    on return from a signal handler.  If we have a signal handler that has
    used the floating-point registers, and it happens to context-switch to
    another task while copying the interrupted floating-point state from the
    user stack into the thread struct (e.g. because of a page fault, or
    because it gets preempted), the context switch code will think that the
    FP registers contain valid FP state that needs to be copied into the
    thread_struct, and will thus overwrite the values that the signal return
    code has put into the thread_struct.
    This can occur because we clear the MSR bits that indicate the presence
    of valid FP state after copying the state into the thread_struct.  To fix
    this we just move the clearing of the MSR bits to before the copy.  A
    similar potential problem also occurs with the Altivec state, and this
    fixes that in the same way.
    Signed-off-by: Paul Mackerras <[EMAIL PROTECTED]>
 arch/powerpc/kernel/signal_64.c |   10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 1ce0ae3..b27e268 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -176,6 +176,13 @@ static long restore_sigcontext(struct pt_regs *regs, 
sigset_t *set, int sig,
+       /*
+        * Force reload of FP/VEC.
+        * This has to be done before copying stuff into current->thread.fpr/vr
+        * for the reasons explained in the previous comment.
+        */
+       regs->msr &= ~(MSR_FP | MSR_FE0 | MSR_FE1 | MSR_VEC);
        err |= __copy_from_user(&current->thread.fpr, &sc->fp_regs, 
@@ -197,9 +204,6 @@ static long restore_sigcontext(struct pt_regs *regs, 
sigset_t *set, int sig,
                current->thread.vrsave = 0;
 #endif /* CONFIG_ALTIVEC */
-       /* Force reload of FP/VEC */
-       regs->msr &= ~(MSR_FP | MSR_FE0 | MSR_FE1 | MSR_VEC);
        return err;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to