Hi, On Thu, Apr 21, 2016 at 06:04:53PM +0100, Paul Burton wrote: > If a kernel doesn't support MSA context (ie. CONFIG_CPU_HAS_MSA=n) then > it will only keep 64 bits per FP register in thread context, and the > calls to set_fpr64 in restore_msa_extcontext will overrun the end of the > FP register context into the FCSR & MSACSR values. GCC 6.x has become > smart enough to detect this & complain like so: > > arch/mips/kernel/signal.c: In function 'protected_restore_fp_context': > ./arch/mips/include/asm/processor.h:114:17: error: array subscript is above array bounds [-Werror=array-bounds] > fpr->val##width[FPR_IDX(width, idx)] = val; \ > ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ > ./arch/mips/include/asm/processor.h:118:1: note: in expansion of macro 'BUILD_FPR_ACCESS' > BUILD_FPR_ACCESS(64) > > The only way to trigger this code to run would be for a program to set > up an artificial extended MSA context structure following a sigframe & > execute sigreturn. Whilst this doesn't allow a program to write to any > state that it couldn't already, it makes little sense to allow this > "restoration" of MSA context in a system that doesn't support MSA. > > Fix this by killing a program with SIGSYS if it tries something as crazy > as "restoring" fake MSA context in this way, also fixing the build error > & allowing for most of restore_msa_extcontext to be optimised out of > kernels without support for MSA. > > Signed-off-by: Paul Burton <paul.burton@xxxxxxxxxx> > Reported-by: Michal Toman <michal.toman@xxxxxxxxxx> > Fixes: bf82cb30c7e5 ("MIPS: Save MSA extended context around signals") > Cc: James Hogan <james.hogan@xxxxxxxxxx> > Cc: stable <stable@xxxxxxxxxxxxxxx> # v4.3+ This patch is needed to build MIPS kernel with GCC 6.1. Tested-by: Aaro Koskinen <aaro.koskinen@xxxxxx> Thanks, A. > --- > > Changes in v2: > - Prevent potential for malformed errno/signal from protected_restore_fp_context. > > arch/mips/kernel/signal.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c > index bf792e2..fc7c1f0 100644 > --- a/arch/mips/kernel/signal.c > +++ b/arch/mips/kernel/signal.c > @@ -195,6 +195,9 @@ static int restore_msa_extcontext(void __user *buf, unsigned int size) > unsigned int csr; > int i, err; > > + if (!config_enabled(CONFIG_CPU_HAS_MSA)) > + return SIGSYS; > + > if (size != sizeof(*msa)) > return -EINVAL; > > @@ -398,8 +401,8 @@ int protected_restore_fp_context(void __user *sc) > } > > fp_done: > - if (used & USED_EXTCONTEXT) > - err |= restore_extcontext(sc_to_extcontext(sc)); > + if (!err && (used & USED_EXTCONTEXT)) > + err = restore_extcontext(sc_to_extcontext(sc)); > > return err ?: sig; > } > -- > 2.8.0 > > -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html