ARM: vfp: use __copy_from_user() when restoring VFP state

Commit 42019fc50dfadb219f9e6ddf4c354f3837057d80 upstream.

__get_user_error() is used as a fast accessor to make copying structure
members in the signal handling path as efficient as possible.  However,
with software PAN and the recent Spectre variant 1, the efficiency is
reduced as these are no longer fast accessors.

In the case of software PAN, it has to switch the domain register around
each access, and with Spectre variant 1, it would have to repeat the
access_ok() check for each access.

Use __copy_from_user() rather than __get_user_err() for individual
members when restoring VFP state.

Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David A. Long <dave.long@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 776757d1604ab3901996bb24bb02748e54c2aee7..57d2ad9c75cae39537f541ba823fac5c03b68f10 100644 (file)
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -126,8 +126,8 @@ struct user_vfp_exc;
 
 extern int vfp_preserve_user_clear_hwstate(struct user_vfp __user *,
                                           struct user_vfp_exc __user *);
-extern int vfp_restore_user_hwstate(struct user_vfp __user *,
-                                   struct user_vfp_exc __user *);
+extern int vfp_restore_user_hwstate(struct user_vfp *,
+                                   struct user_vfp_exc *);
 #endif
 
 /*

diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index a592bc0287f86761aef8a3f0f201f265a3b79e30..6bee5c9b11338c029c9c9f2a613ce178ea338c1c 100644 (file)
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -107,21 +107,20 @@ static int preserve_vfp_context(struct vfp_sigframe __user *frame)
        return vfp_preserve_user_clear_hwstate(&frame->ufp, &frame->ufp_exc);
 }
 
-static int restore_vfp_context(struct vfp_sigframe __user *frame)
+static int restore_vfp_context(struct vfp_sigframe __user *auxp)
 {
-       unsigned long magic;
-       unsigned long size;
-       int err = 0;
+       struct vfp_sigframe frame;
+       int err;
 
-       __get_user_error(magic, &frame->magic, err);
-       __get_user_error(size, &frame->size, err);
+       err = __copy_from_user(&frame, (char __user *) auxp, sizeof(frame));
 
        if (err)
-               return -EFAULT;
-       if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
+               return err;
+
+       if (frame.magic != VFP_MAGIC || frame.size != VFP_STORAGE_SIZE)
                return -EINVAL;
 
-       return vfp_restore_user_hwstate(&frame->ufp, &frame->ufp_exc);
+       return vfp_restore_user_hwstate(&frame.ufp, &frame.ufp_exc);
 }
 
 #endif

diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 5629d7580973bf65b845cd6f91ee0c27d8ccb360..8e5e97989fda6365d958b18d7252467e334139d1 100644 (file)
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -597,13 +597,11 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,
 }
 
 /* Sanitise and restore the current VFP state from the provided structures. */
-int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
-                            struct user_vfp_exc __user *ufp_exc)
+int vfp_restore_user_hwstate(struct user_vfp *ufp, struct user_vfp_exc *ufp_exc)
 {
        struct thread_info *thread = current_thread_info();
        struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
        unsigned long fpexc;
-       int err = 0;
 
        /* Disable VFP to avoid corrupting the new thread state. */
        vfp_flush_hwstate(thread);
@@ -612,17 +610,16 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
         * Copy the floating point registers. There can be unused
         * registers see asm/hwcap.h for details.
         */
-       err |= __copy_from_user(&hwstate->fpregs, &ufp->fpregs,
-                               sizeof(hwstate->fpregs));
+       memcpy(&hwstate->fpregs, &ufp->fpregs, sizeof(hwstate->fpregs));
        /*
         * Copy the status and control register.
         */
-       __get_user_error(hwstate->fpscr, &ufp->fpscr, err);
+       hwstate->fpscr = ufp->fpscr;
 
        /*
         * Sanitise and restore the exception registers.
         */
-       __get_user_error(fpexc, &ufp_exc->fpexc, err);
+       fpexc = ufp_exc->fpexc;
 
        /* Ensure the VFP is enabled. */
        fpexc |= FPEXC_EN;
@@ -631,10 +628,10 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
        fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
        hwstate->fpexc = fpexc;
 
-       __get_user_error(hwstate->fpinst, &ufp_exc->fpinst, err);
-       __get_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err);
+       hwstate->fpinst = ufp_exc->fpinst;
+       hwstate->fpinst2 = ufp_exc->fpinst2;
 
-       return err ? -EFAULT : 0;
+       return 0;
 }
 
 /*