linux-kernel - [PATCH] ARM: vfp: Fix up exception location in Thumb mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1294990949-2729-1-git-send-email-ccross@android.com>
Date:	Thu, 13 Jan 2011 23:42:29 -0800
From:	Colin Cross <ccross@...roid.com>
To:	linux-arm-kernel@...ts.infradead.org
Cc:	Catalin Marinas <catalin.marinas@....com>,
	Colin Cross <ccross@...roid.com>,
	Russell King <linux@....linux.org.uk>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] ARM: vfp: Fix up exception location in Thumb mode

The exception handler in entry-armv.S checks for thumb mode and
correctly determines the exception location and instruction,
but VFP_bounce uses the uncorrected location off the stack.
If the VFP exception occured in Thumb mode, fix up the
exception location to match the value that would be returned
in ARM mode.

Fixes segfaults in userspace applications running in Thumb mode
caused by a handled VFP exception returning to the middle of the
instruction that triggered the exception.

Change-Id: I6c6ba1ab88e107bec166ea334d7e0974a4f6bfba
Signed-off-by: Colin Cross <ccross@...roid.com>
---
 arch/arm/vfp/vfpmodule.c |   10 ++++++++++
 1 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 0797cb5..63ed73d 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -275,6 +275,16 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs)
 	pr_debug("VFP: bounce: trigger %08x fpexc %08x\n", trigger, fpexc);
 
 	/*
+	 * If the exception occured in thumb mode, pc is exception location + 2,
+	 * the middle of the 32-bit VFP instruction.  Add 2 to get exception
+	 * location + 4, the same we get in ARM mode.
+	 */
+#ifdef CONFIG_ARM_THUMB
+	if (regs->ARM_cpsr & PSR_T_BIT)
+		regs->ARM_pc += 2;
+#endif
+
+	/*
 	 * At this point, FPEXC can have the following configuration:
 	 *
 	 *  EX DEX IXE
-- 
1.7.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/