diff options
author | James Hogan <james.hogan@imgtec.com> | 2016-02-01 14:50:36 +0100 |
---|---|---|
committer | Ralf Baechle <ralf@linux-mips.org> | 2016-02-01 23:36:03 +0100 |
commit | 76e5846d3bdf59eb1010d5607003da2dc3910bb1 (patch) | |
tree | 2d65784119d5a2b61b6af9b0c255ad111110cb35 /arch/mips/kernel/process.c | |
parent | MIPS: Fix buffer overflow in syscall_get_arguments() (diff) | |
download | linux-76e5846d3bdf59eb1010d5607003da2dc3910bb1.tar.xz linux-76e5846d3bdf59eb1010d5607003da2dc3910bb1.zip |
MIPS: Properly disable FPU in start_thread()
start_thread() (called for execve(2)) clears the TIF_USEDFPU flag
without atomically disabling the FPU. With a preemptive kernel, an
unfortunately timed preemption after this could result in another
task (or KVM guest) being scheduled in with the FPU still enabled, since
lose_fpu_inatomic() only turns it off if TIF_USEDFPU is set.
Use lose_fpu(0) instead of the separate FPU / MSA management, which
should do the right thing (drop FPU properly and atomically without
saving state) and will be more future proof.
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Reviewed-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/12302/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Diffstat (limited to 'arch/mips/kernel/process.c')
-rw-r--r-- | arch/mips/kernel/process.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c index f2975d4d1e44..eddd5fd6fdfa 100644 --- a/arch/mips/kernel/process.c +++ b/arch/mips/kernel/process.c @@ -65,12 +65,10 @@ void start_thread(struct pt_regs * regs, unsigned long pc, unsigned long sp) status = regs->cp0_status & ~(ST0_CU0|ST0_CU1|ST0_FR|KU_MASK); status |= KU_USER; regs->cp0_status = status; + lose_fpu(0); + clear_thread_flag(TIF_MSA_CTX_LIVE); clear_used_math(); - clear_fpu_owner(); init_dsp(); - clear_thread_flag(TIF_USEDMSA); - clear_thread_flag(TIF_MSA_CTX_LIVE); - disable_msa(); regs->cp0_epc = pc; regs->regs[29] = sp; } |