Patch "s390/compat: correct restore of high gprs on signal return" has been added to the 4.4-stable tree

Patch "s390/compat: correct restore of high gprs on signal return" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    s390/compat: correct restore of high gprs on signal return

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     s390-compat-correct-restore-of-high-gprs-on-signal-return.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 342300cc9cd3428bc6bfe5809bfcc1b9a0f06702 Mon Sep 17 00:00:00 2001
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
Date: Fri, 19 Feb 2016 14:44:14 +0100
Subject: s390/compat: correct restore of high gprs on signal return

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

commit 342300cc9cd3428bc6bfe5809bfcc1b9a0f06702 upstream.

git commit 8070361799ae1e3f4ef347bd10f0a508ac10acfb
"s390: add support for vector extension"
broke 31-bit compat processes in regard to signal handling.

The restore_sigregs_ext32() function is used to restore the additional
elements from the user space signal frame. Among the additional elements
are the upper registers halves for 64-bit register support for 31-bit
processes. The copy_from_user that is used to retrieve the high-gprs
array from the user stack uses an incorrect length, 8 bytes instead of
64 bytes. This causes incorrect upper register halves to get loaded.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/kernel/compat_signal.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -271,7 +271,7 @@ static int restore_sigregs_ext32(struct
 
 	/* Restore high gprs from signal stack */
 	if (__copy_from_user(&gprs_high, &sregs_ext->gprs_high,
-			     sizeof(&sregs_ext->gprs_high)))
+			     sizeof(sregs_ext->gprs_high)))
 		return -EFAULT;
 	for (i = 0; i < NUM_GPRS; i++)
 		*(__u32 *)&regs->gprs[i] = gprs_high[i];


Patches currently in stable-queue which might be from schwidefsky@de.ibm.com are

queue-4.4/s390-kvm-remove-dependency-on-struct-save_area-definition.patch
queue-4.4/s390-fix-normalization-bug-in-exception-table-sorting.patch
queue-4.4/s390-dasd-prevent-incorrect-length-error-under-z-vm-after-pav-changes.patch
queue-4.4/s390-fpu-signals-vs.-floating-point-control-register.patch
queue-4.4/s390-dasd-fix-refcount-for-pav-reassignment.patch
queue-4.4/s390-compat-correct-restore-of-high-gprs-on-signal-return.patch
queue-4.4/s390-dasd-fix-performance-drop.patch