tree d0318223d94974bbf93901b26dfe0ace293ce7e5
parent c9c7ed7df4e7eb384ab667d7431ad156631e7398
author Stas Sergeev <[EMAIL PROTECTED]> Tue Apr 12 08:24:36 2005
committer Linus Torvalds <[EMAIL PROTECTED]> Tue Apr 12 08:24:36 2005
[PATCH] fix crash in entry.S restore_all
Fix the access-above-bottom-of-stack crash.
1. Allows to preserve the valueable optimization
2. Works for NMIs
3. Doesn't care whether or not there are more of the like instances
where the stack is left empty.
4. Seems to work for me without the crashes:)
(akpm: this is still under discussion, although I _think_ it's OK. You might
want to hold off)
Signed-off-by: Stas Sergeev <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
entry.S | 3 +++
process.c | 12 +++++++++++-
2 files changed, 14 insertions(+), 1 deletion(-)
Index: arch/i386/kernel/entry.S
===================================================================
--- 1bb30ecd2df1beb27b267cbc4e78cab95dce9087/arch/i386/kernel/entry.S
(mode:100644 sha1:d4f2f0256e6a245abf4486c9dcc640e8909a9aa9)
+++ d0318223d94974bbf93901b26dfe0ace293ce7e5/arch/i386/kernel/entry.S
(mode:100644 sha1:c2dcfc63f7a4c1c9f97251c7901e3fac8245cacf)
@@ -245,6 +245,9 @@
restore_all:
movl EFLAGS(%esp), %eax # mix EFLAGS, SS and CS
+ # Warning: OLDSS(%esp) contains the wrong/random values if we
+ # are returning to the kernel.
+ # See comments in process.c:copy_thread() for details.
movb OLDSS(%esp), %ah
movb CS(%esp), %al
andl $(VM_MASK | (4 << 8) | 3), %eax
Index: arch/i386/kernel/process.c
===================================================================
--- 1bb30ecd2df1beb27b267cbc4e78cab95dce9087/arch/i386/kernel/process.c
(mode:100644 sha1:d9c4c28c8b93f8179385c8247699d2bf72391f75)
+++ d0318223d94974bbf93901b26dfe0ace293ce7e5/arch/i386/kernel/process.c
(mode:100644 sha1:bc6a4e2f812fff1c64e9aa906090ecf499ea6674)
@@ -405,7 +405,17 @@
childregs->esp = esp;
p->thread.esp = (unsigned long) childregs;
- p->thread.esp0 = (unsigned long) (childregs+1);
+ /*
+ * The below -8 is to reserve 8 bytes on top of the ring0 stack.
+ * This is necessary to guarantee that the entire "struct pt_regs"
+ * is accessable even if the CPU haven't stored the SS/ESP registers
+ * on the stack (interrupt gate does not save these registers
+ * when switching to the same priv ring).
+ * Therefore beware: accessing the xss/esp fields of the
+ * "struct pt_regs" is possible, but they may contain the
+ * completely wrong values.
+ */
+ p->thread.esp0 = (unsigned long) (childregs+1) - 8;
p->thread.eip = (unsigned long) ret_from_fork;
-
To unsubscribe from this list: send the line "unsubscribe bk-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
