[PATCH 1/2] arm64/fpsimd: signal: Require ZA context when restoring ZT context

[Bradley Morgan]

When restoring the signal frame, restore_zt_context() checks whether ZA
is enabled via thread_za_enabled(&current->thread). However, if user.za
is omitted from the signal frame, restore_za_context() is skipped entirely.
If the signal handler touched SME prior to rt_sigreturn(), ZA remains
enabled in current->thread.svcr from the handler context, causing
thread_za_enabled() to succeed and restore_zt_context() to write userspace
ZT data without restoring ZA state.

Require user->za to be present in the signal frame before restoring ZT.

Fixes: ee072cf70804 ("arm64/sme: Implement signal handling for ZT")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Bradley Morgan <bradley.morgan@xxxxxxxxx>
---
 arch/arm64/kernel/signal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
index 6a06a4e352b1d..20d5f19921e0d 100644
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -678,7 +678,7 @@ static int restore_zt_context(struct user_ctxs *user)
 	u16 nregs;
 
 	/* ZA must be restored first for this check to be valid */
-	if (!thread_za_enabled(&current->thread))
+	if (!user->za || !thread_za_enabled(&current->thread))
 		return -EINVAL;
 
 	if (user->zt_size != ZT_SIG_CONTEXT_SIZE(1))
-- 
2.53.0