From 9d38e66bf07b6e57c8e60767c454e1db9aac4484 Mon Sep 17 00:00:00 2001 From: Tony Luck Date: Fri, 13 Apr 2012 11:32:44 -0700 Subject: [PATCH] [IA64] Fix futex_atomic_cmpxchg_inatomic() Michel Lespinasse cleaned up the futex calling conventions in commit 37a9d912b24f96a0591773e6e6c3642991ae5a70 futex: Sanitize cmpxchg_futex_value_locked API But the ia64 implementation was subtly broken. Gcc does not know that register "r8" will be updated by the fault handler if the cmpxchg instruction takes an exception. So it feels safe in letting the initialization of r8 slide to after the cmpxchg. Result: we always return 0 whether the user address faulted or not. Fix by moving the initialization of r8 into the __asm__ code so gcc won't move it. Reported-by: Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42757 Cc: stable@vger.kernel.org # v2.6.39+ Signed-off-by: Tony Luck --- arch/ia64/include/asm/futex.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/ia64/include/asm/futex.h b/arch/ia64/include/asm/futex.h index 8428525ddb22..71949a579e1e 100644 --- a/arch/ia64/include/asm/futex.h +++ b/arch/ia64/include/asm/futex.h @@ -107,10 +107,11 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, return -EFAULT; { - register unsigned long r8 __asm ("r8") = 0; + register unsigned long r8 __asm ("r8"); unsigned long prev; __asm__ __volatile__( " mf;; \n" + " mov r8=r0 \n" " mov ar.ccv=%3;; \n" "[1:] cmpxchg4.acq %0=[%1],%2,ar.ccv \n" " .xdata4 \"__ex_table\", 1b-., 2f-. \n" -- 2.39.5