Skip to content
  • Paul Burton's avatar
    MIPS: Prevent user from setting FCSR cause bits · b1442d39
    Paul Burton authored
    
    
    If one or more matching FCSR cause & enable bits are set in saved thread
    context then when that context is restored the kernel will take an FP
    exception. This is of course undesirable and considered an oops, leading
    to the kernel writing a backtrace to the console and potentially
    rebooting depending upon the configuration. Thus the kernel avoids this
    situation by clearing the cause bits of the FCSR register when handling
    FP exceptions and after emulating FP instructions.
    
    However the kernel does not prevent userland from setting arbitrary FCSR
    cause & enable bits via ptrace, using either the PTRACE_POKEUSR or
    PTRACE_SETFPREGS requests. This means userland can trivially cause the
    kernel to oops on any system with an FPU. Prevent this from happening
    by clearing the cause bits when writing to the saved FCSR context via
    ptrace.
    
    This problem appears to exist at least back to the beginning of the git
    era in the PTRACE_POKEUSR case.
    
    Signed-off-by: default avatarPaul Burton <paul.burton@imgtec.com>
    Cc: stable@vger.kernel.org
    Cc: linux-mips@linux-mips.org
    Cc: Paul Burton <paul.burton@imgtec.com>
    Cc: stable@vger.kernel.org
    Patchwork: https://patchwork.linux-mips.org/patch/7438/
    
    
    Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
    b1442d39