[PATCH 1/5] MIPS: lib/uncached: fix run_uncached()'s stack switch

[Imre Kaloz <kaloz@kernel.org>]

run_uncached() derives the uncached stack pointer for FUNC from $sp and
then spills $16 and $31 into a frame of its own. The compiler may read
$sp before the prologue that allocates that frame, in which case FUNC's
stack starts at the caller's sp and its frame overlaps the saved
registers.

Move the uncached stack pointer down by the two spilled registers.

Signed-off-by: Imre Kaloz <kaloz@kernel.org>
---
 arch/mips/lib/uncached.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/mips/lib/uncached.c b/arch/mips/lib/uncached.c
index f80a67c092b6..acfc489698f0 100644
--- a/arch/mips/lib/uncached.c
+++ b/arch/mips/lib/uncached.c
@@ -56,6 +56,13 @@ unsigned long run_uncached(void *func)
 		BUG();
 		usp = sp;
 	}
+
+	/*
+	 * "sp" may have been read before the prologue allocated the slots
+	 * for $16 and $31 spilled below; keep FUNC's stack clear of them.
+	 */
+	usp -= 2 * sizeof(long);
+
 	if (lfunc >= (long)CKSEG0 && lfunc < (long)CKSEG2)
 		ufunc = CKSEG1ADDR(lfunc);
 #ifdef CONFIG_64BIT
-- 
2.47.3