Commit 5df24082 authored by Stas Sergeev's avatar Stas Sergeev Committed by Linus Torvalds

[PATCH] fix crash in entry.S restore_all

Fix the access-above-bottom-of-stack crash.

1. Allows to preserve the valueable optimization

2. Works for NMIs

3.  Doesn't care whether or not there are more of the like instances
   where the stack is left empty.

4. Seems to work for me without the crashes:) 

(akpm: this is still under discussion, although I _think_ it's OK.  You might
want to hold off)

Signed-off-by: Stas Sergeev <stsp@aknet.ru> 
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent e493073d
...@@ -245,6 +245,9 @@ syscall_exit: ...@@ -245,6 +245,9 @@ syscall_exit:
restore_all: restore_all:
movl EFLAGS(%esp), %eax # mix EFLAGS, SS and CS movl EFLAGS(%esp), %eax # mix EFLAGS, SS and CS
# Warning: OLDSS(%esp) contains the wrong/random values if we
# are returning to the kernel.
# See comments in process.c:copy_thread() for details.
movb OLDSS(%esp), %ah movb OLDSS(%esp), %ah
movb CS(%esp), %al movb CS(%esp), %al
andl $(VM_MASK | (4 << 8) | 3), %eax andl $(VM_MASK | (4 << 8) | 3), %eax
......
...@@ -405,7 +405,17 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long esp, ...@@ -405,7 +405,17 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,
childregs->esp = esp; childregs->esp = esp;
p->thread.esp = (unsigned long) childregs; p->thread.esp = (unsigned long) childregs;
p->thread.esp0 = (unsigned long) (childregs+1); /*
* The below -8 is to reserve 8 bytes on top of the ring0 stack.
* This is necessary to guarantee that the entire "struct pt_regs"
* is accessable even if the CPU haven't stored the SS/ESP registers
* on the stack (interrupt gate does not save these registers
* when switching to the same priv ring).
* Therefore beware: accessing the xss/esp fields of the
* "struct pt_regs" is possible, but they may contain the
* completely wrong values.
*/
p->thread.esp0 = (unsigned long) (childregs+1) - 8;
p->thread.eip = (unsigned long) ret_from_fork; p->thread.eip = (unsigned long) ret_from_fork;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment