parisc: Correct completer in lws start

The completer in the "or,ev %r1,%r30,%r30" instruction is reversed, so we are not clipping the LWS number when we are called from a 32-bit process (W=0). We need to nulify the following depdi instruction when the least-significant bit of %r30 is 1. If the %r20 register is not clipped, a user process could perform a LWS call that would branch to an undefined location in the kernel and potentially crash the machine. Signed-off-by: John David Anglin <[email protected]> Cc: [email protected] # 4.19+ Signed-off-by: Helge Deller <[email protected]>
ambv · Dec 21, 2021 · 8f66fce · 8f66fce
1 parent 484730e
commit 8f66fce
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
@@ -472,7 +472,7 @@ lws_start:
 	extrd,u	%r1,PSW_W_BIT,1,%r1
 	/* sp must be aligned on 4, so deposit the W bit setting into
 	 * the bottom of sp temporarily */
-	or,ev	%r1,%r30,%r30
+	or,od	%r1,%r30,%r30
 
 	/* Clip LWS number to a 32-bit value for 32-bit processes */
 	depdi	0, 31, 32, %r20