Patch "MIPS: Prevent "restoration" of MSA context in non-MSA kernels" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

MIPS: Prevent "restoration" of MSA context in non-MSA kernels

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mips-prevent-restoration-of-msa-context-in-non-msa-kernels.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Paul Burton <[email protected]>
Date: Thu, 21 Apr 2016 18:04:53 +0100
Subject: MIPS: Prevent "restoration" of MSA context in non-MSA kernels

From: Paul Burton <[email protected]>

commit 6533af4d4831c421cd9aa4dce7cfc19a3514cc09 upstream.

If a kernel doesn't support MSA context (ie. CONFIG_CPU_HAS_MSA=n) then it will only keep 64 bits per FP register in thread context, and the calls to set_fpr64 in restore_msa_extcontext will overrun the end of the FP register context into the FCSR & MSACSR values. GCC 6.x has become smart enough to detect this & complain like so:

arch/mips/kernel/signal.c: In function 'protected_restore_fp_context':
./arch/mips/include/asm/processor.h:114:17: error: array subscript is above array bounds [-Werror=array-bounds]
fpr->val##width[FPR_IDX(width, idx)] = val; \
~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~
./arch/mips/include/asm/processor.h:118:1: note: in expansion of macro 'BUILD_FPR_ACCESS'
BUILD_FPR_ACCESS(64)

The only way to trigger this code to run would be for a program to set up an artificial extended MSA context structure following a sigframe & execute sigreturn. Whilst this doesn't allow a program to write to any state that it couldn't already, it makes little sense to allow this "restoration" of MSA context in a system that doesn't support MSA.

Fix this by killing a program with SIGSYS if it tries something as crazy as "restoring" fake MSA context in this way, also fixing the build error & allowing for most of restore_msa_extcontext to be optimised out of kernels without support for MSA.

Patchwork: https://patchwork.linux-mips.org/patch/13164/

---
 arch/mips/kernel/signal.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -195,6 +195,9 @@ static int restore_msa_extcontext(void _
 	unsigned int csr;
 	int i, err;
 
+	if (!config_enabled(CONFIG_CPU_HAS_MSA))
+		return SIGSYS;
+
 	if (size != sizeof(*msa))
 		return -EINVAL;
 

@@ -398,8 +401,8 @@ int protected_restore_fp_context(void __
 	}
 
 fp_done:
-	if (used & USED_EXTCONTEXT)
-		err |= restore_extcontext(sc_to_extcontext(sc));
+	if (!err && (used & USED_EXTCONTEXT))
+		err = restore_extcontext(sc_to_extcontext(sc));
 
 	return err ?: sig;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/mips-disable-preemption-during-prctl-pr_set_fp_mode.patch queue-4.6/mips-fix-sigreturn-via-vdso-on-micromips-kernel.patch queue-4.6/mips-force-cpus-to-lose-fp-context-during-mode-switches.patch queue-4.6/mips-handle-highmem-pages-in-__update_cache.patch queue-4.6/mips-fix-watchpoint-restoration.patch queue-4.6/mips-build-micromips-vdso-for-micromips-kernels.patch queue-4.6/mips-math-emu-fix-jalr-emulation-when-rd-0.patch queue-4.6/mips-sync-icache-dcache-in-set_pte_at.patch queue-4.6/mips-fix-msa-ld_-st_-asm-macros-to-use-ptr_addu.patch queue-4.6/mips-prevent-restoration-of-msa-context-in-non-msa-kernels.patch queue-4.6/mips-use-copy_s.fmt-rather-than-copy_u.fmt.patch