sh: __copy_user function can corrupt the stack in case of exception

[linux-2.6-omap-h63xx.git] / arch / sh / lib / copy_page.S

diff --git a/arch/sh/lib/copy_page.S b/arch/sh/lib/copy_page.S
index b879545fa28b2245335aae1833598b4fb9fe95b7..43de7e8e4e17df58849aef36e69dd28895e46bab 100644 (file)
--- a/arch/sh/lib/copy_page.S
+++ b/arch/sh/lib/copy_page.S
@@ -41,11 +41,11 @@ ENTRY(copy_page)
        mov.l   @r11+,r5
        mov.l   @r11+,r6
        mov.l   @r11+,r7
-#if defined(CONFIG_CPU_SH3)
-       mov.l   r0,@r10
-#elif defined(CONFIG_CPU_SH4)
+#if defined(CONFIG_CPU_SH4)
        movca.l r0,@r10
        mov     r10,r0
+#else
+       mov.l   r0,@r10
 #endif
        add     #32,r10
        mov.l   r7,@-r10
@@ -68,8 +68,9 @@ ENTRY(copy_page)
        rts
         nop
 
-       .align 2
+       .balign 4
 .Lpsz: .long   PAGE_SIZE
+
 /*
  * __kernel_size_t __copy_user(void *to, const void *from, __kernel_size_t n);
  * Return the number of bytes NOT copied
@@ -79,6 +80,11 @@ ENTRY(copy_page)
        .section __ex_table, "a";       \
        .long 9999b, 6000f      ;       \
        .previous
+#define EX_NO_POP(...)                 \
+       9999: __VA_ARGS__ ;             \
+       .section __ex_table, "a";       \
+       .long 9999b, 6005f      ;       \
+       .previous
 ENTRY(__copy_user)
        ! Check if small number of bytes
        mov     #11,r0
@@ -138,9 +144,9 @@ EX( mov.b   r1,@r4          )
        bt      1f
 
 2:
-EX(    mov.b   @r5+,r0         )
+EX_NO_POP(     mov.b   @r5+,r0         )
        dt      r6
-EX(    mov.b   r0,@r4          )
+EX_NO_POP(     mov.b   r0,@r4          )
        bf/s    2b
         add    #1,r4
 
@@ -149,7 +155,7 @@ EX( mov.b   r0,@r4          )
 
 # Exception handler:
 .section .fixup, "ax"
-6000:
+6005:
        mov.l   8000f,r1
        mov     r3,r0
        jmp     @r1