linux-kernel - [4.2.y-ckt stable] Patch "MIPS: math-emu: Fix jalr emulation when rd == $0" has been added to the 4.2.y-ckt tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1465482910-23593-1-git-send-email-kamal@canonical.com>
Date:	Thu,  9 Jun 2016 07:35:10 -0700
From:	Kamal Mostafa <kamal@...onical.com>
To:	Paul Burton <paul.burton@...tec.com>
Cc:	"Maciej W . Rozycki" <macro@...tec.com>,
	James Hogan <james.hogan@...tec.com>,
	linux-mips@...ux-mips.org, linux-kernel@...r.kernel.org,
	Ralf Baechle <ralf@...ux-mips.org>,
	Kamal Mostafa <kamal@...onical.com>,
	kernel-team@...ts.ubuntu.com
Subject: [4.2.y-ckt stable] Patch "MIPS: math-emu: Fix jalr emulation when rd == $0" has been added to the 4.2.y-ckt tree

This is a note to let you know that I have just added a patch titled

    MIPS: math-emu: Fix jalr emulation when rd == $0

to the linux-4.2.y-queue branch of the 4.2.y-ckt extended stable tree 
which can be found at:

    https://git.launchpad.net/~canonical-kernel/linux/+git/linux-stable-ckt/log/?h=linux-4.2.y-queue

This patch is scheduled to be released in version 4.2.8-ckt12.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 4.2.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

---8<------------------------------------------------------------

>From e4a68a824140f11f989e262c1929658b2b179e95 Mon Sep 17 00:00:00 2001
From: Paul Burton <paul.burton@...tec.com>
Date: Thu, 21 Apr 2016 14:04:55 +0100
Subject: MIPS: math-emu: Fix jalr emulation when rd == $0

commit ab4a92e66741b35ca12f8497896bafbe579c28a1 upstream.

When emulating a jalr instruction with rd == $0, the code in
isBranchInstr was incorrectly writing to GPR $0 which should actually
always remain zeroed. This would lead to any further instructions
emulated which use $0 operating on a bogus value until the task is next
context switched, at which point the value of $0 in the task context
would be restored to the correct zero by a store in SAVE_SOME. Fix this
by not writing to rd if it is $0.

Fixes: 102cedc32a6e ("MIPS: microMIPS: Floating point support.")
Signed-off-by: Paul Burton <paul.burton@...tec.com>
Cc: Maciej W. Rozycki <macro@...tec.com>
Cc: James Hogan <james.hogan@...tec.com>
Cc: linux-mips@...ux-mips.org
Cc: linux-kernel@...r.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13160/
Signed-off-by: Ralf Baechle <ralf@...ux-mips.org>
Signed-off-by: Kamal Mostafa <kamal@...onical.com>
---
 arch/mips/math-emu/cp1emu.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index f0f1b98..2bf9209 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -445,9 +445,11 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
 	case spec_op:
 		switch (insn.r_format.func) {
 		case jalr_op:
-			regs->regs[insn.r_format.rd] =
-				regs->cp0_epc + dec_insn.pc_inc +
-				dec_insn.next_pc_inc;
+			if (insn.r_format.rd != 0) {
+				regs->regs[insn.r_format.rd] =
+					regs->cp0_epc + dec_insn.pc_inc +
+					dec_insn.next_pc_inc;
+			}
 			/* Fall through */
 		case jr_op:
 			/* For R6, JR already emulated in jalr_op */
--
2.7.4