bcf4dd5f9e
The test_fp_ctl function is used to test if a given value is a valid
floating-point control. The inline assembly in test_fp_ctl uses an
incorrect constraint for the 'orig_fpc' variable. If the compiler
chooses the same register for 'fpc' and 'orig_fpc' the test_fp_ctl()
function always returns true. This allows user space to trigger
kernel oopses with invalid floating-point control values on the
signal stack.
This problem has been introduced with git commit 4725c86055
"s390: fix save and restore of the floating-point-control register"
Cc: stable@vger.kernel.org # v3.13+
Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
31 lines
505 B
C
31 lines
505 B
C
/*
|
|
* In-kernel FPU support functions
|
|
*
|
|
* Copyright IBM Corp. 2015
|
|
* Author(s): Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
|
|
*/
|
|
|
|
#ifndef _ASM_S390_FPU_API_H
|
|
#define _ASM_S390_FPU_API_H
|
|
|
|
void save_fpu_regs(void);
|
|
|
|
static inline int test_fp_ctl(u32 fpc)
|
|
{
|
|
u32 orig_fpc;
|
|
int rc;
|
|
|
|
asm volatile(
|
|
" efpc %1\n"
|
|
" sfpc %2\n"
|
|
"0: sfpc %1\n"
|
|
" la %0,0\n"
|
|
"1:\n"
|
|
EX_TABLE(0b,1b)
|
|
: "=d" (rc), "=&d" (orig_fpc)
|
|
: "d" (fpc), "0" (-EINVAL));
|
|
return rc;
|
|
}
|
|
|
|
#endif /* _ASM_S390_FPU_API_H */
|