From: Dave Martin Dave.Martin@arm.com
[ Upstream commit 53b1a742ed251780267a57415bc955bd50f40c3d ]
If get_user() fails when reading the new FPSCR value from userspace in compat_vfp_get(), then garbage* will be written to the task's FPSR and FPCR registers.
This patch prevents this by checking the return from get_user() first.
[*] Actually, zero, due to the behaviour of get_user() on error, but that's still not what userspace expects.
Fixes: 478fcb2cdb23 ("arm64: Debugging support") Signed-off-by: Dave Martin Dave.Martin@arm.com Signed-off-by: Will Deacon will.deacon@arm.com Signed-off-by: Sasha Levin alexander.levin@microsoft.com --- arch/arm64/kernel/ptrace.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 2e845f5c8ab2..a12eb17e7985 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -785,8 +785,10 @@ static int compat_vfp_set(struct task_struct *target,
if (count && !ret) { ret = get_user(fpscr, (compat_ulong_t *)ubuf); - uregs->fpsr = fpscr & VFP_FPSCR_STAT_MASK; - uregs->fpcr = fpscr & VFP_FPSCR_CTRL_MASK; + if (!ret) { + uregs->fpsr = fpscr & VFP_FPSCR_STAT_MASK; + uregs->fpcr = fpscr & VFP_FPSCR_CTRL_MASK; + } }
fpsimd_flush_task_state(target);