ARM: vfp: use __copy_from_user() when restoring VFP state
authorRussell King <rmk+kernel@armlinux.org.uk>
Fri, 8 Nov 2019 12:35:35 +0000 (13:35 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 10 Nov 2019 10:21:30 +0000 (11:21 +0100)
commit318625c2b8522da85b7da326127a4bf897931b4f
treea4f47dd9068e0fc380e3e5bd7bfb6910bd6993bd
parentd9230bf9127df2956fd45ae198ab9bd137feaa9e
ARM: vfp: use __copy_from_user() when restoring VFP state

Commit 42019fc50dfadb219f9e6ddf4c354f3837057d80 upstream.

__get_user_error() is used as a fast accessor to make copying structure
members in the signal handling path as efficient as possible.  However,
with software PAN and the recent Spectre variant 1, the efficiency is
reduced as these are no longer fast accessors.

In the case of software PAN, it has to switch the domain register around
each access, and with Spectre variant 1, it would have to repeat the
access_ok() check for each access.

Use __copy_from_user() rather than __get_user_err() for individual
members when restoring VFP state.

Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David A. Long <dave.long@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/arm/include/asm/thread_info.h
arch/arm/kernel/signal.c
arch/arm/vfp/vfpmodule.c