[IA64] make exception handler in copy_user more robust

The exception handler in copy user always expects fault occurs only on
user space address and the fall back recovery code is written with that
very assumption in mind.  Recent source code inspection revealed that
while it worked splendid and to the expectation under normal circumstances,
It broke down under unexpected condition where some address calculation
might go outside the legal address range the original copy_user was
called for.  This patch is to make copy_user exception handler more robust
and to prevent potential memory corruption.

Signed-off-by: Ken Chen <kenneth.w.chen@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

diff --git a/arch/ia64/lib/memcpy_mck.S b/arch/ia64/lib/memcpy_mck.S
index 6f308e62c1377cc04ee24efcd08775a66ed24dae..46c9331e7ab5f81181b5e19745c154a80c4b852e 100644 (file)
--- a/arch/ia64/lib/memcpy_mck.S
+++ b/arch/ia64/lib/memcpy_mck.S
@@ -625,8 +625,11 @@ EK(.ex_handler,  (p17)     st8     [dst1]=r39,8);                                          \
        clrrrb
        ;;
        alloc   saved_pfs_stack=ar.pfs,3,3,3,0
+       cmp.lt  p8,p0=A,r0
        sub     B = dst0, saved_in0     // how many byte copied so far
        ;;
+(p8)   mov     A = 0;                  // A shouldn't be negative, cap it
+       ;;
        sub     C = A, B
        sub     D = saved_in2, A
        ;;