android_kernel_oneplus_msm8998/arch
James Hogan 3040ecd425 metag/usercopy: Fix src fixup in from user rapf loops
commit 2c0b1df88b987a12d95ea1d6beaf01894f3cc725 upstream.

The fixup code to rewind the source pointer in
__asm_copy_from_user_{32,64}bit_rapf_loop() always rewound the source by
a single unit (4 or 8 bytes), however this is insufficient if the fault
didn't occur on the first load in the loop, as the source pointer will
have been incremented but nothing will have been stored until all 4
register [pairs] are loaded.

Read the LSM_STEP field of TXSTATUS (which is already loaded into a
register), a bit like the copy_to_user versions, to determine how many
iterations of MGET[DL] have taken place, all of which need rewinding.

Fixes: 373cd784d0 ("metag: Memory handling")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-04-12 12:38:34 +02:00
..
alpha alpha: fix copy_from_user() 2016-09-24 10:07:45 +02:00
arc ARC: [arcompact] brown paper bag bug in unaligned access delay slot fixup 2017-02-14 15:22:50 -08:00
arm arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region 2017-04-12 12:38:33 +02:00
arm64 arm/arm64: KVM: Enforce unconditional flush to PoC when mapping to stage-2 2017-03-12 06:37:28 +01:00
avr32 avr32: off by one in at32_init_pio() 2016-10-07 15:23:45 +02:00
blackfin net: smc91x: fix SMC accesses 2016-09-30 10:18:37 +02:00
c6x c6x/ptrace: Remove useless PTRACE_SETREGSET implementation 2017-03-31 09:49:53 +02:00
cris cris: Only build flash rescue image if CONFIG_ETRAX_AXISFLASHMAP is selected 2017-01-12 11:22:48 +01:00
frv frv: fix clear_user() 2016-09-24 10:07:44 +02:00
h8300 h8300/ptrace: Fix incorrect register transfer count 2017-03-31 09:49:53 +02:00
hexagon hexagon: fix strncpy_from_user() error return 2016-09-24 10:07:44 +02:00
ia64 ia64: copy_from_user() should zero the destination on access_ok() failure 2016-09-24 10:07:46 +02:00
m32r m32r: fix __get_user() 2016-09-24 10:07:43 +02:00
m68k m68k: Fix ndelay() macro 2016-12-15 08:49:23 -08:00
metag metag/usercopy: Fix src fixup in from user rapf loops 2017-04-12 12:38:34 +02:00
microblaze microblaze: fix copy_from_user() 2016-09-24 10:07:43 +02:00
mips MIPS: Lantiq: Fix cascaded IRQ setup 2017-04-08 09:53:32 +02:00
mn10300 mn10300: copy_from_user() should zero on access_ok() failure... 2016-09-24 10:07:45 +02:00
nios2 nios2: copy_from_user() should zero the tail of destination 2016-09-24 10:07:45 +02:00
openrisc openrisc: fix the fix of copy_from_user() 2016-09-24 10:07:46 +02:00
parisc parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header 2017-02-01 08:30:53 +01:00
powerpc powerpc/boot: Fix zImage TOC alignment 2017-03-26 12:13:19 +02:00
s390 s390/pci: fix use after free in dma_init 2017-03-26 12:13:18 +02:00
score score: fix copy_from_user() and friends 2016-09-24 10:07:44 +02:00
sh sh: fix copy_from_user() 2016-09-24 10:07:44 +02:00
sparc sparc/ptrace: Preserve previous registers for short regset write 2017-03-31 09:49:54 +02:00
tile tile/ptrace: Preserve previous registers for short regset write 2017-02-01 08:30:52 +01:00
um um: Don't discard .text.exit section 2016-09-07 08:32:38 +02:00
unicore32 pwm: Changes for v4.4-rc1 2015-11-11 09:16:10 -08:00
x86 xen/setup: Don't relocate p2m over existing one 2017-04-08 09:53:30 +02:00
xtensa xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD 2017-03-15 09:57:14 +08:00
.gitignore
Kconfig