aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStas Sergeev <stsp@aknet.ru>2005-04-16 15:24:01 -0700
committerLinus Torvalds <torvalds@ppc970.osdl.org>2005-04-16 15:24:01 -0700
commit5df240826c90afdc7956f55a004ea6b702df9203 (patch)
tree1782971ae77b3d902fdf56e77e9649b3b6c48ca4
parente493073d8d053429fbb42331b57a95dd0d61cadb (diff)
[PATCH] fix crash in entry.S restore_all
Fix the access-above-bottom-of-stack crash. 1. Allows to preserve the valueable optimization 2. Works for NMIs 3. Doesn't care whether or not there are more of the like instances where the stack is left empty. 4. Seems to work for me without the crashes:) (akpm: this is still under discussion, although I _think_ it's OK. You might want to hold off) Signed-off-by: Stas Sergeev <stsp@aknet.ru> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--arch/i386/kernel/entry.S3
-rw-r--r--arch/i386/kernel/process.c12
2 files changed, 14 insertions, 1 deletions
diff --git a/arch/i386/kernel/entry.S b/arch/i386/kernel/entry.S
index 1e45ff292bc..3c73dc865ea 100644
--- a/arch/i386/kernel/entry.S
+++ b/arch/i386/kernel/entry.S
@@ -245,6 +245,9 @@ syscall_exit:
restore_all:
movl EFLAGS(%esp), %eax # mix EFLAGS, SS and CS
+ # Warning: OLDSS(%esp) contains the wrong/random values if we
+ # are returning to the kernel.
+ # See comments in process.c:copy_thread() for details.
movb OLDSS(%esp), %ah
movb CS(%esp), %al
andl $(VM_MASK | (4 << 8) | 3), %eax
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
index c36fedf40e9..36145efc61b 100644
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -405,7 +405,17 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,
childregs->esp = esp;
p->thread.esp = (unsigned long) childregs;
- p->thread.esp0 = (unsigned long) (childregs+1);
+ /*
+ * The below -8 is to reserve 8 bytes on top of the ring0 stack.
+ * This is necessary to guarantee that the entire "struct pt_regs"
+ * is accessable even if the CPU haven't stored the SS/ESP registers
+ * on the stack (interrupt gate does not save these registers
+ * when switching to the same priv ring).
+ * Therefore beware: accessing the xss/esp fields of the
+ * "struct pt_regs" is possible, but they may contain the
+ * completely wrong values.
+ */
+ p->thread.esp0 = (unsigned long) (childregs+1) - 8;
p->thread.eip = (unsigned long) ret_from_fork;